Privacy Policy
Last updated: 27 October 2026
This Privacy Policy explains how Agostini Lab S.r.l. ("Festivio", "we") collects, uses, shares, and protects your personal data when you browse our site, create an account, or purchase tickets and consumables from event organizers using our platform. Data controller: Agostini Lab S.r.l., Via Montebello 3, 35141 Padova (PD), Italy, VAT no. IT04767140280.
Controller and Processor Roles
For purchases and event operations, the event organizer acts as the data controller of attendee and order data, and Festivio acts as data processor on their behalf under a Data Processing Agreement (Art. 28 GDPR). For your account, billing, platform security, fraud prevention, aggregate analytics, and product improvement, Festivio acts as an independent controller. Questions about attendee data for a specific event should be directed to the relevant organizer.
Categories of Data We Process
We may process: identification and contact details (email, first name, last name); account credentials (passwords are stored only in hashed form); billing and fiscal data (billing address, Italian Codice Fiscale, Partita IVA, PEC email, SDI code — collected only when needed for invoicing or fiscal receipts); purchase and order details (items, amounts, Stripe payment identifiers, and where the purchase started: link, campaign, PR list, venue screen, site or app); attendee data (first name, last name, age confirmation — only when required by the organizer for the specific event); wallet pass identifiers and device push tokens (only if you add a pass to Apple/Google Wallet or enable notifications); social sign-in identifiers (only if you choose to log in with Google or Facebook); messages you send us via support or contact forms; diagnostic data from the mobile app, collected when the app crashes or hits an unexpected error and not associated with your account: the error stack trace, recent in-app activity (screens and taps identified by component name, request addresses without their parameters, app log messages), operating system, app version, device characteristics such as model, screen size, memory and storage, battery and network state, time zone, locale, and a random installation identifier; on iPhone, native crash reports also include a pseudonymous identifier derived from the device's vendor identifier; and device and session data (IP address, browser, locale, last login timestamp) plus limited usage data needed to provide secure, reliable services.
Purposes of Processing
We use data to provide the platform, fulfill purchases, enable entry and redemption, issue wallet passes, send service and order notifications, generate fiscal receipts where required, support organizers, prevent fraud and abuse, secure our services, measure performance, improve user experience, and comply with legal obligations.
Usage statistics
We count visits to the site and use of the app with Umami, statistics software we run ourselves on servers in the European Union. We record the pages and screens opened (without personal codes, such as those in ticket links), where you came from (referring site, campaign parameters and PR list), device type, operating system, browser, language, screen size, the country, region and city derived from the IP address, and a few steps such as opening checkout, tied to the event and not to your account.
The IP address is shortened before it reaches Umami and is not stored. Visits by the same person are recognised by a code computed from the shortened IP and the browser, which changes every month. We use no cookies: the site keeps in storage the pages and orders already counted so they are not counted twice, and the app stores no identifier. Organizers see only totals for their own events.
The legal basis is our legitimate interest in measuring and improving the service (Art. 6(1)(f) GDPR); for statistics with these characteristics the Italian Data Protection Authority's guidelines of 10 June 2021 do not require consent. We keep this data for 13 months.
You can object at any time: in the app under Account, App, Usage statistics, which also covers the site's pages opened in the app; on the site with the switch below, which applies to this browser.
Count my visits
Legal Bases
Our processing relies on one or more lawful bases under Art. 6 GDPR: performance of a contract (e.g., fulfilling your order and providing your account); legal obligations (e.g., tax, invoicing, and fiscal-record keeping); legitimate interests (e.g., security, fraud prevention, and service improvement); and your consent (e.g. any marketing communications), which you may withdraw at any time.
Service Providers and Sub-processors
We use vetted providers that process data on our behalf or to which data is disclosed to deliver the service: Stripe (Stripe Payments Europe, Ltd., Ireland / Stripe, Inc., USA) — payment processing and Stripe Connect, the organizer being the merchant of record; Lettermint (Lettermint B.V., Netherlands, EU) — transactional email; Resend (Resend, Inc., USA) — fallback transactional email service; Hetzner (Hetzner Online GmbH, Germany, EU) — application, frontend, and database hosting; Cloudflare / Amazon Web Services (USA) — object storage and content delivery for images and pass assets; OpenAPI (OpenAPI S.r.l., Italy) — transmission of electronic fiscal receipts to the Italian Revenue Agency where required; Google (Google LLC, USA) — Google Wallet pass delivery and optional Google sign-in; Apple (Apple Inc., USA) — Apple Wallet pass delivery; Meta (Meta Platforms, Inc., USA) — optional Facebook sign-in; Sentry (Functional Software, Inc., USA, with data stored in its EU region, in Germany): crash and error reporting for the mobile app; Expo (650 Industries, Inc., USA): delivery of mobile app updates, which to check for them receives the IP address, the operating system, the app version and an anonymous installation identifier, never your name, email or account; and the push delivery services of your browser or device vendor for web push notifications. Visit statistics use an Umami instance we run on our EU infrastructure (see Visit statistics). The app does not attach your name, email or account identifier to error reports. In reports prepared by the app's own code, the app removes link parameters, access tokens and email addresses from the text before sending, on a best-effort basis. These providers process data under contractual safeguards (including, where applicable, data processing agreements) consistent with this Policy.
International Data Transfers
Some providers are located outside the European Economic Area (in particular Stripe, Resend if used as the email fallback, Cloudflare/AWS, Google, Apple, Meta, Sentry, and Expo in the USA). Where data is transferred internationally, we rely on appropriate safeguards under Chapter V GDPR, including the European Commission's Standard Contractual Clauses (Decision 2021/914) and, where the provider is certified, the EU-US Data Privacy Framework, together with supplementary technical and organizational measures.
Data Retention and Security
We keep personal data only as long as necessary for the purposes above. Indicatively: account data is retained while your account is active and deleted or anonymized within 30 days of account closure; billing, invoicing, and transaction records are retained for 10 years as required by Italian fiscal law (Art. 2220 Civil Code; D.P.R. 633/1972 and 600/1973); attendee and order data tied to an organizer are retained according to the organizer's instructions and deleted when the organizer account is removed; visit statistics data for 13 months; security and server logs are kept up to 12 months; and backups rotate on a rolling basis up to 30 days. We apply technical and organizational measures including encryption in transit, access controls, and hashed credentials. In the event of a personal data breach, we notify the Garante per la protezione dei dati personali within 72 hours where required (Art. 33 GDPR) and affected individuals without undue delay where the breach is likely to result in a high risk (Art. 34 GDPR).
Your Rights and Complaints
Subject to applicable law, you have the rights to access, rectification, erasure, restriction, objection, and data portability, and to withdraw consent at any time (Arts. 15–22 GDPR). Submit requests through the Contact page; we respond within one month (Art. 12 GDPR). Where the event organizer is the controller of attendee data, we will route your request to them. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
Cookies and Similar Technologies
We use cookies and similar technologies for essential functionality, preferences, and security. See Cookie Policy.
Contact
Questions or requests about privacy can be submitted via the Contact page.
Governing Law
Unless required otherwise by local law, this Policy is governed by Italian law and disputes are subject to the courts of Padova, Italy.