Privacy Policy

PRIVACY POLICY

(pursuant to Articles 13 and 14 of EU Regulation 2016/679)

This policy describes the methods for processing the personal data of users who consult the website http://www.buonissimatorino.it/ and/or who use the services and contact channels available on the site.

This information applies exclusively to this website and not to other websites that may be accessed via external links.

1. Data controller

The Data Controller is TO BE srl. (PI 10052800017), with registered office in Turin, Lungo Dora Voghera 34, in the person of its legal representative pro tempore.

Contacts: privacy@tobecompany.com

The project/site “Very good Turin” identifies the festival and related initiatives dedicated to food culture, food & beverage events, food and wine experiences, and activities with chefs, restaurants, partners, sponsors, cultural institutions, locations, and other parties involved in the program's creation.

2. Types of personal data processed

The following categories of personal data may be processed through the site.

1. a) Browsing data

The computer systems and software procedures used to operate this website may acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This category includes, for example:

• IP address; 
• domain names of devices used by users; 
• URI/URL addresses of the requested resources; 
• date and time of the request; 
• method used to submit the request to the server; 
• size of the file obtained in response; 
• numeric code indicating the status of the response given by the server; 
• other parameters relating to the operating system and IT environment of the interested party. 

This data is not collected to directly identify the interested party, but could, through processing and association with data held by third parties, allow for their identification.

1. b) Data provided for newsletter subscription

If the interested party subscribes to the newsletter or agrees to receive updates relating to Buonissima Torino, data such as:

• name; 
• surname; 
• e-mail address; 
• tongue;
• date and time of registration or consent collection; 
• IP address and technical logs relating to consent collection; 
• any data relating to the opening of communications or interaction with content, where measurement tools are used. 

Communications may include, for example, program updates, ticket availability, events, initiatives, experiences, editorial content, informational and promotional communications relating to Buonissima Torino and, more generally, to initiatives promoted by TO BE Srl, including through its own brands, projects, or related websites.

1. c) Data provided via generic contacts, email, telephone or other channels

If the interested party spontaneously contacts the Data Controller via email, telephone, form, messaging, or other contact details indicated on the website, the following may be processed:

• name and surname; 
• e-mail address; 
• telephone number; 
• content of the communication; 
• any attachments; 
• event, initiative or request of interest; 
• any additional information voluntarily entered by the interested party. 

Requests may include, for example, information about the festival, its program, events, tickets, participation methods, collaborations, partnerships, sponsorships, corporate activities, administrative requests, or other communications.

1. d) Data relating to press, media and press requests

If the interested party contacts the Data Controller for press, media, communication, or press accreditation requests, the following may be processed:

• name and surname; 
• newspaper, body, agency or reality represented; 
• role or qualification; 
• e-mail address; 
• telephone number; 
• content of the request; 
• any materials, attachments or professional information transmitted. 

This data will be processed to manage relationships with the press, journalists, media outlets, communications offices, and anyone interested in receiving information or materials related to the festival.

1. e) Data relating to corporate requests, partnerships, sponsorships or collaborations

If the interested party contacts the Data Controller to propose or request collaborations, sponsorships, partnerships, corporate activities, inclusion in the program, or other initiatives related to the festival, the following may be processed:

• name and surname of the contact person; 
• e-mail address; 
• telephone number; 
• company, organization, restaurant, association, cultural institution or reality represented; 
• role or qualification; 
• content of the proposal or request; 
• any materials, attachments, presentations, company profiles or documents transmitted; 
• administrative, fiscal or contractual data as necessary. 

1. f) Data relating to ticket purchases, reservations, accreditations and participation in events

If the interested party purchases tickets, makes a reservation, requests accreditation, or participates in events related to Buonissima Torino, the following may be processed:

• name and surname of the participant or purchaser; 
• e-mail address; 
• telephone number; 
• event, date, time, shift or chosen formula; 
• number of tickets or participants; 
• booking code, QR code, ticket, badge or other access identifier; 
• booking, credit or payment status; 
• data relating to attendance or access to the event; 
• any operational communications relating to the event. 

If ticket purchases, payments, or accreditation are made through ticketing platforms or third parties, these parties may process the data in accordance with their respective privacy policies and the applicable privacy role.

1. g) Data relating to widespread events, restaurants, locations and organizational partners

Buonissima Torino may include events held at restaurants, venues, cultural spaces, institutions, partners, sponsors, or other parties involved in the program.

In this context, data relating to the following may be processed:

• attendees, guests or ticket purchasers; 
• representatives of restaurants, chefs, locations, organizations, sponsors, partners or suppliers; 
• event, shift, time or place of participation; 
• any participant lists, accreditations or organizational information; 
• any communications necessary for the correct management of the event. 

The privacy roles between TO BE Srl and the parties involved will be assessed on a case-by-case basis, with these parties being able to operate, depending on the case, as independent controllers, data processors or joint controllers.

1. h) Data relating to allergies, intolerances or dietary needs

During food events, interested parties or participants may spontaneously provide information regarding allergies, food intolerances, dietary requirements, or other special needs.

This information will be processed exclusively to the extent necessary for the proper management of the event and the requested food and beverage service.

Since such data may reveal information relating to the data subject's health, processing will be carried out, where necessary, based on the data subject's explicit consent or other appropriate basis set forth in Article 9 of the GDPR.

1. i) Data relating to payments, refunds, receipts, invoices and administrative documentation

In the event that participation in events involves the purchase of tickets, payments, deposits, refunds, issuance of receipts, invoices, or other fiscal/administrative documentation, the following may be processed:

• identification and contact details of the purchaser or participant; 
• tax or administrative data; 
• amount, reason and date of payment; 
• accounting details; 
• data relating to tickets, receipts, invoices, refunds or tax documentation; 
• any data managed by banks, payment service providers, or ticketing platforms. 

The Data Controller does not necessarily process the complete data of payment instruments, which may be managed directly by authorized third parties, such as credit institutions, payment service providers, or ticketing platforms.

1. l) Data relating to chefs, restaurants, partners, sponsors, cultural institutions, locations, suppliers and collaborators

As part of organizing the festival and related events, the Data Controller may process data relating to chefs, restaurants, producers, wineries, beverage companies, sponsors, partners, cultural institutions, locations, suppliers, collaborators, and other parties involved.

Data such as: may be processed:

• name and surname of the contact person; 
• role, qualification or profession; 
• company, restaurant, organization, institution or reality represented; 
• e-mail address; 
• telephone number; 
• professional and company data; 
• content of communications; 
• data relating to agreements, collaborations, supplies, sponsorships, promotional materials, payments, and administrative documentation. 

1. m) Images, photographs, videos, galleries and promotional content

The site may publish images, photographs, videos, interviews, galleries, editorial or promotional content relating to Buonissima Torino, its events, locations, dishes, chefs, partners, sponsors, staff, guests, and participants.

If such content depicts recognizable natural persons, the Data Controller will process such data in compliance with applicable legislation, on the basis of an appropriate legal basis, such as consent, release, contractual relationship, information/documentation purposes, or other applicable basis.

During events, photographs and videos may be taken for documentary, informational, and promotional purposes. For images, videos, interviews, or content in which a person is clearly identifiable and is the main subject of the recording, the Data Controller will, where necessary, obtain specific consent or release.

1. n) Data relating to editorial content, protagonists, awards, guests and programme

The site may publish informative or editorial content relating to the program, events, chefs, protagonists, awards, guests, speakers, partners, and other subjects involved in the festival.

In this context, the following may be processed and published, where relevant:

• name and surname; 
• role, qualification or professional activity; 
• photographic images or audiovisual content; 
• statements, interviews or editorial contributions; 
• information relating to activities, experiences, awards, participations, events or collaborations. 

This data will be processed for informational, editorial, documentary, and promotional purposes consistent with the festival and the Data Controller's activities.

1. o) Cookies and tracking tools

The site may use technical cookies and, where applicable, analytical, functional, advertising, profiling, marketing, or other tracking cookies.

For further information, please refer to the specific Cookie Policy available on the site.

3. Purposes and legal bases of the processing

Personal data will be processed for the following purposes:

Purpose of the processing	Legal basis
Allow navigation and correct technical functioning of the site	Legitimate interest of the Data Controller in the technical management and security of the site
Ensure the security of the site, prevent illicit use, unauthorized access or fraudulent activity	Legitimate interest of the Data Controller in IT security and the protection of its systems
Respond to requests sent via email, telephone, form, messaging or other channels available on the site	Execution of measures requested by the interested party or legitimate interest of the Data Controller in responding to communications received
Manage press, media, press inquiries, press accreditations, and communications with journalists, media operators, or interested parties	Execution of measures requested by the interested party or legitimate interest of the Data Controller in managing press relations and communications
Manage corporate inquiries, collaborations, sponsorships, partnerships, program placements, or professional proposals	Execution of pre-contractual measures requested by the interested party; legitimate interest of the Data Controller in the organizational and commercial management of the festival
Manage ticket purchases, reservations, accreditations, admissions, QR codes, badges, participant lists, shifts, formulas and event participation	Execution of the contract or pre-contractual measures requested by the interested party
Send operational communications relating to tickets, reservations, accreditations, changes, cancellations, access or participation in events	Execution of the contract or requested service
Manage events spread across restaurants, locations, partners, sponsors, cultural institutions or other subjects involved in the program	Execution of the contract or requested service; legitimate interest of the Data Controller in the proper organization of the festival
Process any data relating to allergies, intolerances, or dietary requirements communicated by the interested party for the correct management of the event and the food & beverage service.	Explicit consent of the interested party, where necessary; execution of the requested service within the limits permitted by applicable legislation
Manage payments, deposits, refunds, receipts, invoices and administrative documentation	Contract execution; legal obligation for tax and accounting compliance
Send newsletters, informative, promotional and commercial communications relating to Buonissima Torino, the program, tickets, events, experiences, initiatives, services and activities promoted by TO BE Srl, including through its own brands, projects or connected sites	Consent of the interested party
Manage relationships with chefs, restaurants, producers, sponsors, partners, cultural institutions, locations, suppliers, collaborators and other parties involved in the festival	Execution of pre-contractual or contractual measures; legitimate interest of the Data Controller in the organizational, institutional, and commercial management of the festival
Create and publish photographic content, videos, galleries, promotional, informative, documentary or editorial content relating to the festival, events, locations, dishes, chefs, partners, sponsors and the activities of the Owner	Consent, release, legitimate documentary/promotional/editorial interest or other suitable legal basis, depending on the context
Manage editorial content related to the program, protagonists, awards, guests, speakers, chefs, partners, sponsors and subjects involved in the festival	Legitimate interest of the Data Controller in information, editorial, documentary and promotional activities; consent or other prerequisite where necessary
To ascertain, exercise or defend a right in judicial, extrajudicial or administrative proceedings	Legitimate interest of the Data Controller in protecting its rights
Manage cookies and technical tracking tools necessary for the functioning of the site	Legitimate interest of the Data Controller in the correct technical functioning of the site
Manage non-anonymized analytical cookies, advertising cookies, marketing, profiling, social plugins or other non-technical tracking tools	Consent of the interested party, where required by applicable law

4. Nature of data provision

Providing the requested data via email, telephone, form, or other channels available on the site is necessary to allow the Data Controller to respond to the user's request.

Providing the data requested for ticket purchases, reservations, accreditations, or event participation is necessary to allow the Data Controller to process the request, confirm participation, and properly organize the event.

Failure to provide the necessary data may make it impossible to submit the request, purchase tickets, receive accreditation, or participate in the event.

Providing data relating to allergies, intolerances, or dietary requirements is optional, but may be necessary to allow the Data Controller to properly manage the food & beverage service and protect the interested party during their participation in the event.

Providing data for newsletter, marketing, or promotional communications is optional. Failure to provide consent will not affect your ability to browse the site, purchase tickets, book, register, or participate in events.

5. Treatment methods

Personal data will be processed using computerized, electronic, and, where necessary, paper-based tools, using methods strictly related to the purposes indicated above.

The Data Controller adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in order to prevent the loss, illicit or incorrect use of data, unauthorized access, disclosure, modification or destruction thereof.

6. Recipients of personal data

Personal data may be processed by personnel and collaborators authorized by the Data Controller, within the limits of their respective duties and according to specific instructions.

The data may also be communicated, where necessary, to the following categories of subjects:

• IT service providers, hosting, maintenance and website management;
• providers of email services, newsletters, CRM, booking systems, ticketing, accreditation or management tools;
• providers of communication, messaging or contact management platforms;
• administrative, tax, accounting, legal or employment consultants;
• banking institutions and payment service providers;
• ticketing platforms or parties involved in payment management, where used;
• chefs, producers, restaurants, locations, partners, sponsors, suppliers, collaborators, or individuals involved in organizing and managing events, to the extent necessary for the initiative to take place;
• subjects involved in the management of accreditations, participant lists, badges, QR codes or access control;
• photographers, video makers, communications agencies or individuals involved in the creation of promotional or documentary content;
• public authorities, bodies or subjects to whom communication is required by law.

External parties processing personal data on behalf of the Data Controller will, where necessary, be appointed as data processors pursuant to Art. 28 GDPR.

Personal data will not be disclosed, except in the case of images, videos, footage, galleries, editorial or promotional content published on the Data Controller's website or channels, where this occurs based on an appropriate legal basis.

7. Transfer of data outside the European Economic Area

Personal data will be processed mainly within the European Economic Area.

If, for technical reasons related to the use of IT services, hosting, email, management platforms, or similar tools, it becomes necessary to transfer data to third countries, the transfer will take place in compliance with Articles 44 et seq. of the GDPR, based on an adequacy decision by the European Commission or, failing that, through adequate safeguards, such as the Standard Contractual Clauses approved by the European Commission.

8. Retention period

Personal data will be retained for the time strictly necessary to achieve the purposes for which they were collected.

In particular:

Data category	Retention period
Browsing data	For the time necessary for the technical management and security of the site, except for the need to ascertain illegal activities
Data collected via email, telephone, forms, messaging or other channels	For the time necessary to respond to the request and, normally, no longer than 12 months from the last contact, unless a further relationship is established
Data relating to press, media or press requests	For the time necessary to manage the request and, subsequently, for a reasonable period connected to communication, documentation or rights protection needs
Data relating to corporate requests, partnerships, sponsorships or collaborations	For the time necessary to manage the request and, in the event of an established relationship, for the duration of the relationship and for the subsequent legal terms.
Data relating to tickets, reservations, accreditations and event participation	For the time necessary to manage the event and, subsequently, for the period necessary to fulfill legal obligations or protect the rights of the Data Controller
Data relating to QR codes, badges, participant lists or access control	For the time necessary to manage the event and, normally, for a limited period after the conclusion of the event, except for administrative, security or rights protection needs
Special data relating to allergies, intolerances or dietary needs	Only for the time necessary to manage the event and the food & beverage service, unless otherwise required by law.
Data relating to payments, refunds, invoices, receipts and administrative-accounting documentation	For the period required by civil, fiscal and accounting legislation, normally 10 years
Data relating to chefs, restaurants, producers, partners, sponsors, cultural institutions, locations, suppliers and collaborators	For the duration of the relationship and, subsequently, for the period necessary to fulfill legal obligations or protect the rights of the Data Controller
Data relating to newsletters and promotional communications	Until you revoke your consent or request to unsubscribe
Newsletter or marketing consent logs	For the time necessary to demonstrate the correct collection of consent
Images, photographs, videos, galleries or published contents	For the time of publication consistent with the informational, documentary, editorial or promotional purposes pursued, unless consent is revoked where the processing is based on consent
Data processed for the protection of rights	For the time necessary to manage the dispute and in any case within the limits of the applicable limitation periods

Upon expiration of the retention periods, the data will be deleted, anonymized, or retained exclusively where necessary to fulfill legal obligations or protect the Data Controller's rights.

9. Links to third-party sites or social networks

The site may contain links to third-party websites, social media pages, external platforms, mapping tools, booking systems, payment systems, commercial partners, or other online services.

This policy does not apply to data processing carried out by third parties or external platforms, for which the interested party is invited to consult the relevant privacy policies.

10. Rights of the interested party

The interested party may exercise, within the limits and under the conditions set forth in Articles 15 et seq. of the GDPR, the following rights:

• obtain confirmation as to whether or not personal data concerning him or her is being processed; 
• access your personal data; 
• obtain the rectification of inaccurate data or the integration of incomplete data; 
• obtain the deletion of data, in the cases provided for by the legislation; 
• obtain restriction of processing; 
• oppose the processing, in the cases provided for by the legislation; 
• receive the data in a structured, commonly used and machine-readable format, where applicable; 
• revoke the consent given, without prejudice to the lawfulness of the processing carried out before the revocation; 
• lodge a complaint with the Italian Data Protection Authority. 

Requests may be sent to the Data Controller at the addresses indicated in this policy.

11. Complaint to the Supervisory Authority

The interested party who believes that the processing of his/her personal data is in violation of the applicable legislation has the right to lodge a complaint with the Guarantor for the protection of personal data, according to the methods indicated on the Authority's institutional website.

12. Updates to this policy

This information may be updated over time, including due to regulatory, technical, or organizational changes.

The interested party is therefore invited to consult this page periodically.

Last updated May 2026