Privacy Policy

The data controller is:

This notice explains how Coro Monti Verdi APS processes the personal data of visitors to the website www.coromontiverdi.com (the "Site").

The Site is built with the Lovable platform and hosted on servers located in the European Union. It does not use first-party cookies, tracking pixels, or other profiling tools. This notice does not cover third-party websites accessed through links on the Site.

3.1 Navigation data and aggregated statistics (technical processing)

The Site is built and maintained by a technical manager appointed by the Controller (the "Technical Manager"), who acts as data processor under Art. 28 GDPR under a written agreement with the Controller. The Technical Manager in turn uses the Lovable platform (Lovable Labs Incorporated) as a sub-processor, which is likewise bound by a Data Processing Agreement (DPA). For information on Lovable's security and compliance safeguards: trust.lovable.dev.

In the normal operation of the hosting service, Lovable's systems automatically process technical browsing data, including IP addresses and session identifiers. These data are needed to provide the service and to produce usage statistics.

The Controller has access only to aggregated and anonymised statistical data (country of origin, pages visited, session duration) and has no direct access to individual identifiers.

Purpose: technical delivery of the hosting service; anonymous statistical analysis of Site usage to improve the service.

Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR).

Retention: personal data are retained for the duration of the service contract; aggregated, anonymised data may be retained by Lovable indefinitely in a form that does not identify individuals, as provided for in the DPA.

3.2 Data voluntarily provided (contact by e-mail)

The Site displays a clickable e-mail address (info@coromontiverdi.com). Sending a message entails the collection of the sender's address and of any other personal data contained in the message.

Purpose: to reply to the request and manage the resulting correspondence.

Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR) or, where applicable, performance of pre-contractual measures at the data subject's request (Art. 6(1)(b) GDPR).

Retention: for the time strictly necessary to handle the request and, in any case, no longer than three years from the last contact, unless a longer period is required by law.

These data are used solely to reply to the message received and are not disclosed to third parties, except where required by law.

3.3 Disclosure to third parties

Personal data are not disclosed, transferred or disseminated to third parties, except where:

• required by law; or
• strictly necessary to provide the requested service (e.g. the e-mail provider).

Technical service providers processing data on behalf of the Controller are appointed as Data Processors under Art. 28 GDPR and act solely on the Controller's instructions.

The Site does not use first-party cookies of any kind (technical, analytical or profiling). Nor does it use tracking pixels or third-party profiling scripts.

Some features do, however, connect to external services, as set out below.

Video content (YouTube)

Some pages of the Site embed videos from the YouTube platform (Google LLC). Videos are loaded in privacy-enhanced mode (youtube-nocookie.com) and only on request: the YouTube player is inserted into the page only when the user clicks on the video preview. Until then, the Site sends no data to Google. Once a video is played, the terms and privacy policy of Google/YouTube apply: policies.google.com/privacy.

Music streaming platforms

The Site contains links to listening platforms such as Spotify and Apple Music. These are outbound links only: the Site neither sends users' personal data to these platforms nor receives any from them. Any processing takes place solely between the user and the chosen platform, under that platform's privacy notice.

"Add to calendar" widget

Some pages allow users to add a concert to their personal calendar (e.g. Google Calendar, Apple Calendar or Outlook). This takes place entirely on the user's device, or between the user and their calendar service. The Site receives no data on the use of this feature and cannot identify who has used it.

Links to social networks (Facebook, Instagram)

The Site contains links to the official Coro Monti Verdi pages on Facebook and Instagram. These are outbound links to third-party platforms: the Site does not embed social plugins or tracking pixels and receives no data on users' activity on those platforms. Any processing takes place solely between the user and Meta Platforms, under the following notices:

• Facebook/Meta: facebook.com/privacy/policy
• Instagram: privacycenter.instagram.com/policy

Should further third-party tools be introduced, this notice will be updated and consent will be sought where the law requires it.

In accordance with Art. 32 GDPR, the Controller applies technical and organisational measures that ensure a level of security appropriate to the risk, in order to prevent the loss, misuse, unauthorised access to or unauthorised disclosure of personal data.

Under Arts. 15–22 GDPR, users have the right of:

• Access (Art. 15): to obtain confirmation of whether data concerning them are processed, and a copy of those data
• Rectification (Art. 16): to have inaccurate or incomplete data corrected
• Erasure (Art. 17): to have data erased (the "right to be forgotten") in the cases provided for by law
• Restriction of processing (Art. 18): to request that processing be restricted in certain cases
• Portability (Art. 20): to receive their data in a structured, commonly used and machine-readable format, where applicable
• Objection (Art. 21): to object to processing based on legitimate interest
• Withdrawal of consent (Art. 7(3)): to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

Requests should be addressed to the Controller by e-mail at info@coromontiverdi.com or by post to the address above.

The Controller will respond within 30 days of receiving a request. This period may be extended by a further 60 days for complex requests, in which case the data subject will be informed.

Users also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it), if they believe that the processing of their data infringes the GDPR.

The Controller may update this notice to reflect changes in the law or in its operations. Updates will be published on this page together with the date of the latest revision. Where substantial changes affect processing based on consent, the Controller will inform the data subjects concerned.