Legal
Privacy Policy
Last updated: 1 August 2026
This Privacy Policy describes how personal data of users visiting www.peak-festival.it and/or booking or purchasing tickets for our events is processed, in compliance with Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Decree 101/2018 (Privacy Code).
1. Data controller
The data controller is Peak Festival, operating at La Madia, San Sicario (Cesana Torinese, TO), Italy, reachable at info@peak-festival.it.
2. Data we collect
Browsing data (IP address, browser type, operating system, pages visited, collected automatically in system logs); data you provide voluntarily (first and last name, email, phone, provided when booking/purchasing tickets, subscribing to the newsletter or contacting us); payment data, handled directly by the payment provider or the ticketing platform — we never store full card or bank details; cookies and similar technologies (see section 8 and the Cookie Policy); photos and video possibly taken during the event, as stated in the Terms & Conditions.
3. Purposes and legal bases
Managing ticket bookings/purchases and event access (performance of a contract, Art. 6.1.b GDPR); customer support and replies to enquiries (contract / legitimate interest, Art. 6.1.b and 6.1.f); newsletter and promotional communications (consent, Art. 6.1.a); tax and accounting obligations (legal obligation, Art. 6.1.c); website security and fraud prevention (legitimate interest, Art. 6.1.f); publication of promotional photos/video (consent / legitimate interest, per the event Terms); statistical analytics (consent, where required).
4. Provision of data
Providing the data required to book/purchase a ticket is mandatory: without it the booking cannot be completed. Providing data for the newsletter and promotional communications is optional and can be withdrawn at any time.
5. Processing methods
Processing is carried out with electronic and/or paper tools, with logic strictly related to the stated purposes, ensuring data security and confidentiality through appropriate technical and organisational measures preventing loss, misuse, unauthorised access or disclosure.
6. Recipients
Data may be shared, for the stated purposes, with: the Xceed ticketing platform; electronic payment providers; email/newsletter providers; hosting and website providers; tax/accounting advisors; public authorities where required by law. Where necessary these parties are appointed as data processors under Art. 28 GDPR. Data is never sold or transferred to third parties for unrelated purposes.
7. Transfers outside the EU
Where providers are based outside the European Economic Area, transfers take place under GDPR safeguards (European Commission Standard Contractual Clauses or adequacy decisions).
8. Cookies
The website uses technical cookies necessary for its operation and, subject to consent collected via a banner, analytics or third-party cookies. Preferences can be changed at any time via the banner or your browser settings. Full details are in the Cookie Policy.
9. Retention
Booking/purchase data is retained for as long as needed to provide the service and thereafter for the period required by tax law (10 years for accounting records). Newsletter/marketing data is retained until consent is withdrawn. Browsing data is retained only as long as strictly necessary, except where needed to investigate computer crime.
10. Your rights
Under Arts. 15-22 GDPR you have the right to access, rectification, erasure, restriction, portability, objection (in particular to direct marketing) and withdrawal of consent at any time, without affecting the lawfulness of prior processing. Requests: info@peak-festival.it. You may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
11. Minors
The website and related services are reserved for adults: the event is 18+ and access is not permitted to anyone under 18. Ticket purchases, bookings and the provision of personal data are allowed only for persons aged 18 or over. We do not knowingly collect data from minors; if we become aware of such data, we will delete it without undue delay.
12. Event photos and video
By purchasing or booking a ticket, free or paid, the data subject gives free and informed consent to photo, audio and video recording during the event and to its use, reproduction, publication and distribution by the controller and its partners for both commercial/promotional and non-commercial purposes (documentation, aftermovie, archive, press, social channels, website and advertising materials), with no time or territorial limits and without compensation. The legal basis is consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time by writing to info@peak-festival.it: withdrawal applies to future uses and does not affect the lawfulness of processing already carried out.
13. Data security
The controller adopts appropriate technical and organisational measures to protect data from unauthorised access, loss, destruction or unlawful disclosure, in line with Art. 32 GDPR.
14. Changes
The controller may amend this Privacy Policy at any time, notifying users by publishing the update on the website. Please check this page periodically.
15. Contact
For any question about the processing of personal data write to info@peak-festival.it.
