Privacy & Cookies
Privacy and Cookie Policy
Last updated: May 5, 2026
This privacy policy describes how we collect, use, store, and protect the personal data of users who use the “Io vado a caccia con Filippo” service (hereinafter “the Service”), a geolocation-based treasure hunt experience in Venice.
We are committed to protecting users’ privacy and ensuring compliance with the European Union’s General Data Protection Regulation (GDPR) and the guidelines issued by the Italian Data Protection Authority.
1. Data Controller
Company Name: Io Vado A Caccia Con Filippo di Michele Saviolo
Registered office: Via Mar Tirreno, 3/8 - 30034 - Mira (VE)
Email: privacy@acacciaconfilippo.com
Certified email (PEC): Coming soon
VAT number: IT04953470277
2. Personal Data Collected
2.1 Registration Data
When you register for the Service, we collect the following information:
- First and last name of the group leader
- Email address
- Phone number (optional)
- Team Name
- Number of participants
- Date and time of the booked experience
2.2 Payment Information
We use a secure, certified payment gateway to process payments. The payment information we collect includes:
- Credit/debit card information (handled directly by the payment processor)
- Cardholder's Name
- Billing Address
- Transaction details (amount, date, status)
Important: Full credit card details are never stored on our servers; instead, they are securely processed by our payment processor, which complies with PCI DSS standards.
2.3 Geolocation Data
When you use the Treasure Hunt app, we collect:
- GPS coordinates of the device's location
- Timestamps of check-ins at the various stops
- Route taken during the experience
This data is necessary to verify completion of the checkpoints and to provide the geolocation-based treasure hunt experience.
2.4 Usage and Browsing Data
We automatically collect information about your use of the Service through Google Analytics, including:
- IP Address (anonymized)
- Browser and Device Type
- Operating System
- Pages Visited and Duration of Visit
- Traffic source (how the user reached the site)
- Website Navigation Behavior
2.5 Performance Data
During the scavenger hunt, let's record:
- Answers to riddles and crossword puzzles
- Time taken to complete the steps
- Scores Achieved
- Completion of the Experience
3. Purposes of the Processing and Legal Basis
Service Delivery
Legal basis: Performance of the Contract (Art. 6(1)(b) of the GDPR)
We use this data to provide the treasure hunt experience, manage reservations, process payments, and provide technical support.
GPS Geolocation
Legal basis: Explicit Consent (Art. 6(1)(a) of the GDPR) and Performance of the Contract
Geolocation data is essential for verifying that milestones have been reached and for providing directions along the route.
Statistical Analysis
Legal basis: Consent (Art. 6(1)(a) of the GDPR)
We use Google Analytics to analyze website traffic, understand user behavior, and improve the Service.
Marketing
Legal basis: Explicit Consent (Art. 6(1)(a) of the GDPR)
With your explicit consent, we may send you promotional communications, special offers, and updates about the Service.
Legal Compliance
Legal basis: Legal obligation (Art. 6(1)(c) GDPR)
We retain the data necessary to comply with tax, accounting, and legal obligations under Italian and European law.
Security and Fraud Prevention
Legal basis: Legitimate Interest (Art. 6(1)(f) GDPR)
We monitor transactions and use of the Service to prevent fraud and ensure the security of the platform.
4. Cookie Policy
4.1 What Are Cookies?
Cookies are small text files that are stored on the user’s device while browsing a website. They can be used for various purposes, such as remembering user preferences, analyzing website traffic, or personalizing content.
4.2 Types of Cookies Used
4.3 Third-Party Cookies
4.4 Cookie Management
Users can manage their cookie preferences at any time by:
- Cookie banner: The first time you visit the site, a banner appears allowing you to accept or reject cookies that are not strictly necessary
- Preferences panel: You can change your preferences at any time by clicking the "Manage Cookies" link in the website footer
- Browser settings: Most browsers allow you to block or delete cookies through the privacy settings
Guides for managing cookies in major browsers:
5. Sharing Data with Third Parties
Personal data may be shared with the following categories of recipients:
Payment Service Providers
Certified payment gateway: for secure payment processing and fraud prevention
Analytics Services
Google Analytics: to analyze website traffic and improve the user experience
Web Hosting Providers
Cloud services for hosting websites, applications, and databases
Technical Service Providers
Companies that provide technical support, maintenance, and platform development
Professional Consultants
Accountants, attorneys, and other professional consultants specializing in legal and tax compliance
Competent Authorities
Judicial, tax, or law enforcement authorities, when required by law
Important: All third-party providers are selected based on their compliance with the GDPR and are bound by contractual agreements that ensure the protection of personal data.
6. International Data Transfer
Some of our service providers (such as Google Analytics) may transfer personal data outside the European Economic Area (EEA), specifically to the United States.
We ensure that such transfers are carried out in accordance with the GDPR by:
- Supplier’s Participation in the EU-U.S. Data Privacy Framework
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Appropriate technical and organizational measures to ensure a level of protection equivalent to that of the EU
7. Data Retention Period
Personal data is retained for the time strictly necessary to fulfill the purposes for which it was collected:
| Type of data | Retention Period | Reason |
|---|---|---|
| Registration and Account Information | Until the account is deleted or 3 years after the last activity | Service Provision |
| Payment and Transaction Information | 10 years since the transaction | Tax and Accounting Obligations (Presidential Decree No. 633/1972) |
| Geolocation Data | 30 days after the experience is over | Technical Support and Troubleshooting |
| Analytics Data (Google Analytics) | 26 months | Statistical Analysis and Service Improvement |
| Marketing Data (with consent) | Until consent is revoked or 2 years after the last interaction | Sending promotional communications |
| System and Security Logs | 6 months | Cybersecurity and Fraud Prevention |
Once the periods indicated above have elapsed, the data will be permanently deleted or anonymized, unless their retention is necessary to comply with a legal obligation or to establish, exercise, or defend a right in court.
8. Rights of Data Subjects
In accordance with Articles 15–22 of the GDPR, users have the following rights:
Right of Access
To obtain confirmation that your data is being processed and to access such data (Art. 15 GDPR)
Right of Rectification
Right to have inaccurate personal data corrected or incomplete data completed (Art. 16 GDPR)
Right to Erasure
Requesting the erasure of your personal data (“right to be forgotten”) under certain conditions (Art. 17 of the GDPR)
Right to Restriction
Requesting the restriction of the processing of your personal data under specific circumstances (Art. 18 GDPR)
Right to Data Portability
To receive one’s data in a structured, machine-readable format and to transmit it to another data controller (Art. 20 GDPR)
Right to Object
Object at any time to the processing of your personal data for legitimate reasons (Art. 21 GDPR)
Withdrawal of Consent
Withdraw consent at any time, without affecting the lawfulness of processing based on consent given prior to withdrawal (Art. 7(3) GDPR)
Right to File a Complaint
Filing a complaint with the Data Protection Authority (Art. 77 GDPR)
How to Exercise Your Rights
To exercise any of the rights listed above, the user may:
- Send an email request to: privacy@acacciaconfilippo.com
- Send a written notice to the following address: Via Mar Tirreno, 3/8 - 30034 - Mira (VE)
- Log in to the private area of your account and use the data management features
We are committed to responding to all requests within 30 days of receipt, as required by Article 12(3) of the GDPR. In the case of complex requests, this period may be extended by an additional 60 days, subject to providing the data subject with a reasoned explanation.
9. Security Measures
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR:
🔒 Encryption
All data transmitted between the user's device and our servers is protected using the HTTPS/TLS protocol. Sensitive data stored in our databases is encrypted.
🔐 Access Control
Access to personal data is restricted exclusively to authorized personnel through multi-factor authentication systems and role-based access control.
🛡️ Firewall and protection
We use advanced firewalls, intrusion detection systems, and DDoS protection to prevent unauthorized access and cyberattacks.
💾 Regular backups
We perform regular data backups to ensure service continuity and resilience in the event of incidents.
📊 Continuous monitoring
We constantly monitor our systems to detect and respond promptly to any security breaches.
👥 Staff Training
All staff members who have access to personal data receive regular training on data protection and cybersecurity.
Data Breach Notification
In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects, we will:
- Notify the supervisory authority within 72 hours of discovering the breach, as required by Article 33 of the GDPR
- Notify the affected individuals of the breach without undue delay if the breach poses a high risk to their rights (Art. 34 GDPR)
- Document the violation and the measures taken to remedy it
10. Processing of Children’s Data
The Service is intended for use by families with children ages 6 and up. However, account registration and management must be performed by an adult (parent, guardian, or adult chaperone).
In accordance with Article 8 of the GDPR:
- We do not intentionally collect personal data from children under the age of 14 without the consent of their parents or guardians
- The adult in charge of the team is considered the legal representative for all minor participants
- Geolocation data for minors is collected exclusively during the experience and only if they are accompanied by an adult
- If we become aware that we have collected personal data from minors without proper consent, we will immediately delete it
11. Changes to the Privacy Policy
We reserve the right to modify or update this Privacy Policy at any time to reflect regulatory, technological, or organizational changes.
In the event of substantial changes that have a significant impact on the processing of personal data:
- We will publish the new version on the website, clearly indicating the date of the last update
- We will send an email notification to registered users
- If necessary, we will request new explicit consent for the new purposes of processing
Users are encouraged to check this page periodically for updates.
Contact Us
12. Contact Information
If you have any questions, requests, or need clarification regarding this Privacy Policy or the processing of personal data, please contact us:
A caccia con Filippo
di Saviolo Michele
Via Mar Tirreno 3/8
30034 Mira Venezia
📱 Phone
Presto disponibile
🔒 Certified email (PEC)
Presto disponibile
We are committed to responding to all inquiries within 30 business days.
Acceptance of the Privacy Policy
By using the "Io vado a caccia con Filippo" Service, the user declares that they have read, understood, and accepted this Privacy and Cookie Policy.
Your continued use of the Service following any changes to the Privacy Policy constitutes your acceptance of those changes.