PRIVACY POLICY

PRIVACY POLICY

Trap Milano S.r.l. — www.trapmilano.it

Welcome to the website of Trap Milano S.r.l., accessible at the URL www.trapmilano.it (the “Website”). Please read this Privacy Policy carefully. It applies to any access to the Website, regardless of whether the user books the services and experiences offered therein.

This Privacy Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “Regulation” or “GDPR”) and of Italian Legislative Decree No. 196 of 30 June 2003 (the “Italian Privacy Code”). The Cookie Policy published in the Legal Area of the Website forms an integral part of this Policy.

ART. 1 – Data Controller

The Data Controller is Trap Milano S.r.l., with registered office at Via Adeodato Ressi 23, 20125 Milan (MI), Italy, reachable at the e-mail address [email protected] (hereinafter, “Trap Milano” or the “Controller”).

ART. 2 – Data Protection Contact Point

For any information regarding the processing of personal data and for the exercise of the rights described below — including a request for the updated list of any data processors appointed — you may write to the e-mail address [email protected], or send a communication to the registered office indicated above, for the attention of the person responsible for personal data protection.

ART. 3 – Purposes of Processing

Through the Website, Trap Milano collects and processes various categories of personal data for the purposes set out below.

a) Provision of services and management of bookings. Processing of the data necessary to allow browsing of the Website, the user’s registration (where applicable), the management of online bookings of the services and experiences offered by Trap Milano, the provision of the requested services and the related pre- and post-sale assistance, as well as to respond to users’ requests, queries and reports.

b) Legal obligations. Processing of the data necessary to comply with obligations set out by laws, regulations and legislation, including of a tax and accounting nature, connected with the conduct of the business and the conclusion of contracts.

c) Direct marketing (subject to consent). With the user’s express consent, sending — by means of traditional and automated tools (e.g. newsletters, e-mail, SMS, MMS, instant messages) — of informational and promotional communications, updates on services, experiences, events and initiatives promoted by Trap Milano.

d) Marketing of similar services (soft spam). In relation to services similar to those already purchased by the user, Trap Milano may send commercial communications by e-mail on the basis of its legitimate interest, without the need for specific consent, pursuant to Article 130, paragraph 4, of the Italian Privacy Code. The user may object to such processing at any time, including at the time of each communication.

e) Analysis of consumption habits and preferences / profiling (subject to consent). With the user’s express consent and by means of automated tools, analysis of data relating to purchases (value, frequency and type of services and experiences booked) and to browsing, in order to offer services, initiatives and communications more closely matching the user’s tastes and needs. Such analysis is carried out in a manner that does not intrude upon the personal sphere.

f) Cookies and tracking tools. For processing carried out through cookies and similar technologies, please refer to the Cookie Policy published in the Legal Area of the Website.

ART. 4 – Legal Bases

Personal data are processed in compliance with the lawfulness conditions set out in Article 6 of the Regulation. In particular:

• for the purposes referred to in letter a), the legal basis is the performance of a contract to which the data subject is a party or the implementation of pre-contractual measures taken at the data subject’s request (Article 6(1)(b) of the Regulation);
• for the purposes referred to in letter b), the legal basis is compliance with legal obligations to which the Controller is subject (Article 6(1)(c) of the Regulation);
• for the purposes referred to in letters c) and e), the legal basis is the data subject’s consent (Article 6(1)(a) of the Regulation), freely given and revocable at any time;
• for the purposes referred to in letter d), as well as to ensure the security of the Website and for the possible establishment, exercise or defence of a legal claim, the legal basis is the legitimate interest of the Controller (Article 6(1)(f) of the Regulation).

The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent given prior to its withdrawal.

ART. 5 – Categories of Data Processed and Their Source

Within the scope of the purposes indicated above, Trap Milano processes, by way of example and without limitation:

• identification and contact data (e.g. first name, surname, e-mail address, telephone number);
• data relating to bookings, purchases and interactions with the assistance channels;
• payment data and data necessary for invoicing;
• browsing data and data collected through cookies, for which please refer to the Cookie Policy.

Personal data are provided directly by the data subject upon any registration on the Website, the booking of services, the purchase process, or interaction with the Website and the assistance channels.

ART. 6 – Processing Methods

Processing is carried out in compliance with the principles of fairness, lawfulness, transparency and protection of confidentiality, ensuring the relevance and proportionality of the data with respect to the purposes pursued.

Processing is carried out mainly by means of IT and electronic tools, adopting technical and organisational measures appropriate to minimise the risks of destruction or loss, including accidental, of the data, of unauthorised access, or of processing that is unlawful or inconsistent with the purposes of collection.

Given the nature of the online transmission medium, such measures cannot entirely rule out every risk: users are therefore advised to equip their devices with appropriate security tools (e.g. up-to-date antivirus systems, firewalls).

ART. 7 – Nature of Data Provision

The provision of data for the purposes referred to in Article 3, letters a) and b), is necessary to allow registration, booking and the conclusion of the contract, as well as to comply with the related legal obligations: failure to provide such data makes it impossible to use the services and to process requests.

The provision of data for marketing purposes and for the analysis of consumption preferences (Article 3, letters c and e) is optional: the absence of consent does not affect the ability to browse the Website and use the services, and results solely in Trap Milano being unable to send promotional communications or to personalise its offers.

Where necessary, the mandatory or optional nature of each item of data is indicated on a case-by-case basis by means of a specific marker (*).

ART. 8 – Disclosure and Dissemination

Personal data are not subject to dissemination. They may be disclosed to third parties only within the limits permitted by law and for the purposes indicated above.

Data may be disclosed to the police or judicial authorities, in accordance with the law and upon formal request, or where this is reasonably necessary to prevent or suppress unlawful activities, to defend against third-party claims, or to protect the rights, security and property of Trap Milano, its customers, its collaborators or third parties.

ART. 9 – Categories of Recipients and Data Processors

Processing is carried out by persons authorised by the Controller, bound by confidentiality obligations and instructed in relation to the purposes pursued.

Data may also be processed, on behalf of the Controller, by entities acting as Data Processors pursuant to Article 28 of the Regulation, by way of example:

• companies providing IT services (software, maintenance, hosting, Website management, sending of e-mails and SMS);
• companies providing marketing and communications management services;
• companies providing payment services;
• consultants and professionals providing support activities (e.g. administrative, accounting, tax, legal).

The updated list of Data Processors is available upon request, by writing to the addresses indicated in this Privacy Policy.

ART. 10 – Data Retention

Personal data processed for the purposes referred to in Article 3, letters a) and b), are retained for the entire duration of the contractual relationship and, thereafter, for the time necessary to comply with legal obligations, including tax and accounting ones, and in any case for a maximum period of 10 years, in accordance with civil and tax legislation.

Data processed for the marketing purposes referred to in Article 3, letter c), are retained until consent is withdrawn and in any case for a maximum period of 24 months from collection or from the user’s last interaction, unless consent is renewed.

Data processed for the purpose of analysing consumption preferences referred to in Article 3, letter e), are retained until consent is withdrawn and in any case for a maximum period of 12 months from collection.

With regard to data processed through cookies, please refer to the Cookie Policy.

ART. 11 – Transfer of Data to Third Countries

Personal data are processed within the European Union. Should the data, for the provision of certain services (e.g. IT or marketing providers), need to be transferred to third countries outside the European Union or the European Economic Area (EEA), the transfer will take place only where adequate safeguards are in place pursuant to Articles 44 et seq. of the Regulation (e.g. an adequacy decision of the European Commission or standard contractual clauses).

ART. 12 – Rights of Data Subjects

At any time, the data subject may exercise, vis-à-vis the Controller, the rights set out in Articles 15 et seq. of the Regulation and, in particular:

• the right of access to their personal data (Article 15);
• the right to rectification (Article 16);
• the right to erasure (Article 17);
• the right to restriction of processing (Article 18);
• the right to data portability (Article 20);
• the right to object to processing (Article 21), including with regard to processing for direct marketing purposes and with reference to one or more channels of communication;
• the right to withdraw consent at any time, without prejudice to the lawfulness of processing carried out prior to withdrawal.

Requests may be submitted by writing to the e-mail address [email protected], or to the registered office indicated above.

ART. 13 – Right to Lodge a Complaint

Should the data subject consider that the processing of personal data relating to them takes place in breach of the Regulation, they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.garanteprivacy.it), pursuant to Article 77 of the Regulation, or to bring the matter before the competent judicial authorities (Article 79 of the Regulation).

ART. 14 – Amendments

The Controller reserves the right to make, at any time, such amendments to this Privacy Policy as it deems appropriate or as required by the legislation in force from time to time, giving adequate notice thereof on the Website. Users are therefore invited to consult this page periodically.

Last updated: 04/07/2026