We at Welance Ventures Italia S.r.l. are committed to serving our clients and contacts to the best of our ability. Part of that commitment involves responsibly handling the personal information collected through rural-pop-up.com and related interactions. Our main goals in processing this information are: — improving the user experience on our platform by understanding clients' needs and preferences; — providing timely assistance and responding to requests for information or service; — improving our products and services to meet our users' evolving needs; — carrying out necessary business operations, such as billing and account management. It is our policy to treat personal information with the utmost respect for privacy and security. We comply with all applicable regulations and guidelines to ensure that the data we process is protected against unauthorised access, disclosure, alteration and destruction. We do not have a designated Data Protection Officer (DPO), but we remain fully committed to addressing your privacy concerns. For any question, contact us at [email protected] or +39 347 533 1532.

This notice is designed to protect the personal information of everyone we interact with: website visitors, registered users and clients. Whether you are simply browsing rural-pop-up.com, using our services as a registered user, or engaging with us as a valued client, we ensure your personal data is handled to the highest standards of privacy and security.

Data storage Personal information is stored on secure servers located within the European Union. For services that require international data transfers, we ensure that such transfers comply with all applicable laws and maintain data protection standards equivalent to those of our main location. Hosting partners We work with trusted hosting providers committed to state-of-the-art security measures, selected based on their compliance with strict data protection standards. Data processing agreements When we share your data with third-party service providers, we do so under data processing agreements (DPAs) that ensure your information is handled in accordance with the GDPR and other relevant data protection laws. Transparency and control We believe in transparency and in your control over your personal data. You will always be informed of any significant change to our sharing practices and, where applicable, you will have the opportunity to consent to such changes. For any question, contact us at [email protected] or +39 347 533 1532.

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data: — Right of access (Art. 15 GDPR): request access to the personal information we hold and obtain information about how we process it. — Right to rectification (Art. 16 GDPR): request correction of inaccurate or incomplete information. — Right to erasure ("right to be forgotten", Art. 17 GDPR): request deletion of your personal information when it is no longer necessary for the purposes for which it was collected. — Right to restriction of processing (Art. 18 GDPR): request restriction of the processing of your personal data under certain conditions. — Right to data portability (Art. 20 GDPR): receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller. — Right to object (Art. 21 GDPR): object to the processing of your personal data, including for direct marketing. — Right to withdraw consent (Art. 7.3 GDPR): withdraw your consent at any time, without affecting the lawfulness of processing carried out based on consent before its withdrawal. — Right to lodge a complaint (Art. 77 GDPR): lodge a complaint with a supervisory authority if you believe the processing of your personal data violates applicable laws. To exercise any of these rights, write to [email protected] or call +39 347 533 1532. We will respond in accordance with applicable data protection laws and within the time limits they set. In some cases we may need to verify your identity as part of the process to ensure the security of your personal data.

We use cookies and other tracking technologies on rural-pop-up.com to ensure the smooth functioning of our digital platforms, improve user experience and provide insights that help us improve. Cookies are small data files placed on your device that allow us to remember your preferences and collect information about your use of the site. Tracking technologies (web beacons, pixel tags) help us understand how you interact with our site. How we use these technologies — Essential cookies: required for site functionality such as authentication and security. They do not require consent. — Performance and analytics cookies: collect information about how visitors use our site, which pages are visited most often and whether any error messages are received. — Functional cookies: allow the site to provide enhanced functionality and personalisation, for example by remembering user preferences. — Advertising and targeting cookies: used to deliver more relevant advertising and measure the effectiveness of campaigns. Your choices and consent On your first visit, our site will present a cookie consent banner where you can accept all cookies, reject non-essential cookies, or customise preferences by choosing which cookie categories to allow.

We may use your personal data to send you direct marketing communications about our products, services, promotions and other information we think may interest you. Our direct marketing practices are transparent, lawful and compliant with applicable data protection laws, including the GDPR and the ePrivacy Directive. Consent Where required by law, we will obtain your explicit consent before sending you direct marketing communications. You will have the opportunity to actively opt in before any message is sent. Unsubscribing Every direct marketing communication we send will include clear instructions on how to unsubscribe or opt out of future communications. You can exercise your right to withdraw at any time and your request will be honoured promptly.

APS means a social promotion association; SRL means a limited liability company. The social project and the platform’s commercial services are separate.

Welance Ventures Italia S.r.l. may share work contact details of municipal staff already known to the company with Rural Pop-up Events APS to identify the council contact and discuss reactivation of a place through I Custodi. Data is limited to the name, role, council and work contact details actually available. This is not a general address-book transfer: this flow excludes prospective managers’ contacts, messages and applications. Staff contact details do not become public. Disclosure requires a verified lawful basis and an assessment of compatibility with the original collection. A social purpose is insufficient. Any reliance on legitimate interests requires documented necessity, reasonable expectations and balancing of rights; disclosure must not take place without valid grounds. We do not claim that individuals have already been informed or checks completed. This page does not retrospectively validate earlier sharing. The receiving association acts for its own purposes and must provide GDPR Article 14 information, unless an applicable exception is documented, within one month and no later than its first contact if earlier. This information must identify the source, data received, lawful basis, recipients and applicable retention. Contact [email protected] about any company disclosures or to exercise access, rectification, erasure or objection rights; contact [email protected] about association processing. The rights in the dedicated section, including complaints to the Italian data protection authority, remain available.

For I Custodi, hosting and LLM services use company accounts and the company pays their costs; the main Google Drive archive uses an association account. The promoter provides ideas, digital development and consultancy free of charge. The company has restricted backroom access through the promoter, who also works there. This does not authorise company marketing, sale of contacts or other commercial use of association data. Assignments and access must be limited and formalised according to the actual activities. Company processing on behalf of the association requires a GDPR Article 28 agreement; this notice does not replace that agreement or certify that it has been signed. Financial support does not extend any user consent.