PRIVACY POLICY
pursuant to Articles 13–14 of EU Regulation 2016/679 (GDPR) Empress of Venice —
Venice Carnival Ball

1. Data Controller
   The Data Controller for the processing of personal data is:
   Giulia Luzzi
   Based in Rome, Italy
   Email: giulia.luzzi2207@outlook.it
2. Personal Data Collected
   When completing the application form for the event, the Data Controller collects the following
   categories of personal data:

• Personal details: first name, last name;
• Contact information: email address;
• Any additional information voluntarily provided through the application form (e.g. motivation,
  profession, preferences).

1. Purposes and Legal Basis for Processing
   Personal data are processed for the following purposes:
   a) Application and event management

• Reviewing and managing the participation application;
• Communicating the outcome of the application (approved or not approved);
• Managing the ticket purchase process through Weezevent;
• Managing access to the event.
  Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).
  b) Marketing and promotional communications
• Sending communications about future events organised by Giulia Luzzi;
• Newsletter and promotional updates.
  Legal basis: consent of the data subject (Art. 6(1)(a) GDPR), freely withdrawable at any time.

1. Processing Methods and Retention
   Personal data are processed using digital and electronic tools, in compliance with the security
   measures required by the GDPR. Data are processed exclusively by the Data Controller and are not
   subject to automated decision-making or profiling.
   Data collected for event management purposes are retained for the time strictly necessary for the
   event and, thereafter, for the period required by applicable tax and accounting regulations (up to 10
   years).
2. Data processed on the basis of consent for marketing purposes are retained until consent is
3. withdrawn.
4. Disclosure to Third Parties
   Personal data may be disclosed to:
5. Weezevent (the ticketing platform used to manage registrations and payments), acting as Data
   Processor pursuant to Art. 28 GDPR;
6. Aman Venice — Palazzo Papadopoli, solely for the data required to manage access to the
   event;
7. Competent authorities, where required by law.
   Data are not sold or transferred to third parties for their own purposes.
8. Photography and Video Recording
   Photographs and video recordings may be taken during the event for editorial and promotional
   purposes. Attendees who do not wish to be photographed or filmed are kindly requested to inform
   staff upon arrival.
   The legal basis for such processing is the legitimate interest of the Data Controller (Art. 6(1)(f)
   GDPR) in documenting, promoting and communicating the event, balanced against the rights of
   data subjects, who are informed in advance and may exercise their right to object by notifying staff
   upon arrival.
9. Rights of Data Subjects
   Pursuant to Arts. 15–22 of the GDPR, data subjects have the right to:
10. Access their personal data (Art. 15);
11. Obtain rectification of inaccurate data (Art. 16);
12. Obtain erasure of their data (“right to be forgotten”) (Art. 17);
13. Request restriction of processing (Art. 18);
14. Receive data in a structured format (data portability) (Art. 20);
15. Object to processing (Art. 21);
16. Withdraw consent at any time, without affecting the lawfulness of processing based on consent
    before its withdrawal.
    To exercise these rights, data subjects may contact: giulia.luzzi2207@outlook.it
17. Right to Lodge a Complaint
    Data subjects have the right to lodge a complaint with the competent supervisory authority. In Italy,
    the supervisory authority is the Garante per la protezione dei dati personali (Italian Data Protection
    Authority) at http://www.garanteprivacy.it.
18. Updates
    This Privacy Policy may be updated at any time. In the event of material changes, registered
    participants will be informed by email.
19. Last updated: May 2026 — Giulia Luzzi, Rome