PRIVACY NOTICE – MONDADORI MEDIA S.p.A.

1. Introduction

This Privacy notice ("Policy") aims to describe the purposes and methods by which Mondadori Media S.p.A. collects and processes your personal data when you browse this website ("Site").

The information contained in this Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of 27 April 2016 ("GDPR"), Legislative Decree No. 196 of 30 June 2003 ("Privacy Code"), and applicable national and/or EU legislation, as well as relevant interpretations thereof.

The Site uses tracking tools to access and/or store information on your device ("Trackers"). For further information regarding which Trackers we use and how they process your personal data, please consult our Cookie Policy

2. Data Controller and contacts

The Data Controller is Mondadori Media S.p.A., with registered office at Via Gian Battista Vico 42, 20123 Milan, Tax Code and VAT no. no. 08009080964, a company belonging to the Mondadori Group – the corporate group consisting of its parent Arnoldo Mondadori Editore S.p.A. and its subsidiaries under Article 2359 of the Italian Civil Code ("Mondadori Group").

For questions about how the Data Controller processes your data or to exercise your rights under the GDPR (as better described in section 9 of this Policy), please contact us by e-mail at privacy@mondadori.it.

3. Data Protection Officer (DPO)

The Mondadori Group has appointed a Data Protection Officer ("DPO").

You may contact the DPO freely for any matters relating to the processing of your personal data and/or if you wish to exercise your rights as described in section 9 below, by writing to dpo@mondadori.it.

4. Purposes and legal basis of processing, and categories of personal data processed

We process your personal data for specific purposes and only where a legal basis under Article 6 GDPR exists.

Below is a summary of the purposes, legal basis, and categories of processed personal data. The Site offers numerous features and services: the categories listed indicate the data that may be processed for each purpose, depending on the specific feature or service, the Data Controller may process fewer data than those listed.

Purposes of processing	Legal basis	Personal data processed
To enable, including through Trackers, the functioning and operation of the Website and its features, including (where provided) the ability to register and publish reviews, images and comments.	The processing of your Personal data for this purpose is based on the necessity to follow up on your request (Article 6(1)(b) of the GDPR).	Browsing data (IP address, device identifiers, operating system details, Tracker preferences, device characteristics, date of access to Site). Data you provide when you using Site features, including third party services: name, contact details; password and other login credentials when you register or log in to the Site, including via Facebook and Google authentication; reviews, images, comments, and any other data you decide to record in the reserved area. Information about communication you will have with the Data Controller.
Moderate the reviews, comments, and content you publish on the Site.	The processing is based on the legitimate interest of the Data Controller to comply, in the manner deemed most appropriate, with a regulatory obligation applicable to it (Article 6(1)(f) of the GDPR).	Data you provide when using certain features of the Site, such as name, contact details, password, and other login details when you register or log in to the Site, including through authentication via Facebook and Google; reviews, images, and comments.
To complete your subscription to the Newsletter service, where applicable.	The processing is based on the necessity to follow up on your request (Article 6(1)(b) of the GDPR).	Identification and contact details.
Manage reports, complaints, and other requests relating to the content of the Site.	The processing is based on the need to comply with legal obligations to which the Data Controller is subject (Article 6(1)(c) of the GDPR).	Identification and contact details. Other information you provide us in this context.
To perform statistical analyses on the use of the Site, including through the use of Trackers.	The processing is necessary for the legitimate interests pursued by the Data Controller (Article 6(1)(f) of the GDPR), for the processing of statistics for the improvement of the Site and the services offered by the Data Controller.	Browsing data.
To allow, where applicable, the sending of promotional communications by e-mail concerning initiatives, products, and/or services of the Data Controller (so-called direct marketing).	The processing is based on your consent (Article 6(1)(a) of the GDPR).	Browsing data. Identification and contact details.
To enable, where applicable, the sending of promotional communications via push notifications as set up on your device.	The processing is based on your consent (Article 6(1)(a) of the GDPR).	Preferences regarding Trackers and other Site services, such as when you request to receive notifications and reminders, where applicable.
To allow, where applicable, the Data Controller to send promotional communications by email concerning initiatives, products, and/or services promoted, sold, and/or provided by third parties with whom the Data Controller has legal relationships (so-called indirect marketing). This processing will not involve the communication and/or transfer of your personal data to such third parties.	The processing is based on your consent (Article 6(1)(a) of the GDPR).	Browsing data. Identification and contact details. Marketing preferences.
Where applicable, to enable you to participate in prize promotions and other initiatives promoted by the Data Controller and/or its commercial partners.	The processing of your Personal data for this purpose is based on the necessity to follow up on your request (Article 6(1)(b) of the GDPR).	Identification and contact details.
To customize, where applicable, the content of promotional communications concerning initiatives/events, products, and/or services of the Data Controller. This activity involves processing personal data to evaluate certain personal aspects of you, such as analyzing and predicting your personal preferences and interests.	The processing is based on your consent (Article 6(1)(a) of the GDPR).	Browsing data, including behavior in relation to communications sent. Marketing and profiling preferences.
Where applicable, to comply with regulatory provisions and requests from competent authorities, including provisions arising from the application of Regulation (EU) no. 2022/2065 (so-called DSA).	The processing is based on the need to comply with legal obligations to which the Data Controller is subject (Article 6(1)(c) of the GDPR).	Any information that may be necessary and/or requested.
To enable the execution of any corporate transactions (e.g., merger, acquisition, sale, transfer of assets or business units, reorganization, restructuring, due diligence).	The processing is based on the legitimate interest of the Data Controller in carrying out its corporate operations (Article 6(1)(f) of the GDPR).	Any information that may be necessary, according to criteria of proportionality and minimization.
To enable the Data Controller and/or third parties to protect their rights.	The processing is based on the legitimate interest of the Data Controller in protecting its own rights or those of third parties (Article 6(1)(f) of the GDPR).	Any information that may be necessary, according to criteria of proportionality and minimization.

The Data Controller does not collect or process special categories of personal data (Article 9 of the GDPR). Therefore, when you publish a review or content on the Site, we ask you not to share information or images of third parties or that are sensitive in nature, such as health status, intolerances, allergies, religious beliefs, or racial or ethnic origins.

The Data Controller may also collect and process your personal data through social and public platforms such as Meta (Facebook, Instagram), X (Twitter), Pinterest, TikTok, and YouTube. For example, if you tag the Data Controller in comments or other content you post on these platforms, the Data Controller may process information related to that content. Such processing will be carried out in accordance with your account settings on that platform and the terms for the processing of personal data provided by the relevant platform.

When you browse our official pages on these platforms, they collect data to provide aggregate statistics (so-called "insights") on interaction with their content. As administrators of these pages, we only have access to aggregate data on insights. For these processing operations, the Data Controller and the platform owners act as joint controllers. For further information on this, please consult the privacy policy of the relevant platform.

If you subscribe to the Data Controller's WhatsApp or Telegram channels, we may process some of your personal data. However, we will not collect your mobile phone number. For full details on how we manage your data in these cases, please read the dedicated privacy notice, which you will find on the subscription page for the respective services.

6. Means of processing and retention period of personal data processed

The data will be processed using electronic and paper-based tools.

The processed data will be stored for the time strictly necessary to pursue the purposes indicated above, except for any regulatory obligations and/or legal protection requirements that require them to be stored for a longer period. For example:

data relating to your account on the Site and actions carried out through it, such as reviews, images, and comments, will be stored until you decide to delete them and/or until your account is deleted. If your account is inactive for 24 months, it will be deleted;
data processed for direct and indirect marketing and profiling purposes will be stored to a maximum of 24 months from the last interaction with the Data Controller or, if earlier, until consent is revoked;
data processed in connection with the newsletter service will be stored until you decide to unsubscribe from the service;
browsing data will be stored for a maximum period of 30 days from the date of collection;
data processed in the context of initiatives at your request (e.g., prize contests) will be processed for the entire duration of the initiative and in accordance with the methods provided for in the context of the initiative itself;
data processed for analysis purposes will be promptly anonymized once it is no longer necessary for the original purpose of collection;
Data processed in the context of extraordinary corporate transactions will be deleted promptly upon completion of the transaction (unless the third party takes over as data controller).

7. Mandatory or necessary nature of data provision and consequences of refusal

Depending on the purpose, the communication of personal data constitutes a legal or contractual obligation or a necessary requirement for the conclusion of the contract. In other words, except for processing that requires your consent – and which, in its absence, will not be carried out (nor will refusal to give consent have any adverse consequences in relation to the use of the Site) – the data requested is necessary to enable the Site to function or to provide a specific feature, and without it, it may not be possible to use the Site.

When we collect data through forms, we indicate the mandatory fields with asterisks. If you do not provide the data marked with an asterisk, you may not be able to access the functionality requested through the form. In any case, you will still be able to browse the Site. There are no consequences if you decide not to provide information marked as optional.

8. Categories of recipients and transfer of data outside the EEA

In order to carry out processing activities, the Data Controller requires the support of third parties, who act as data processors, joint controllers, or data controllers, depending on their nature and the agreements entered into with the Data Controller. In particular:
third parties who perform activities connected with or instrumental to the activities of the Data Controller (such as, for example, other companies in the Mondadori Group to which the Data Controller belongs, suppliers entrusted with the management and maintenance of the Site infrastructure, IT and telematic services or hosting companies and, with reference to personal data collected through Trackers, suppliers and managers of cookies and other tracking technologies);
third parties who carry out research and advertising content related to or connected with products or services on the Site, who may become aware of your data in order to send promotional communications relating to such products or services, if you have given your consent for this purpose;
consultants, lawyers, accountants, and other professionals of the Data Controller or other party involved in a corporate transaction, as well as the party involved as a potential and/or actual transferee, purchaser, etc.;
judicial, administrative, regulatory, and public security authorities, in the event of compliance with legal obligations incumbent upon the Data Controller.

Some sections of the Site include links to third-party services. If you decide to click on these links, your data may be shared with these third parties and/or these third parties may collect your data directly through your interactions with these linked sites or features.

Your personal data may be transferred outside the European Economic Area ("EEA"). Should the Data Controller need to transfer personal data outside the EEA, appropriate transfer tools will be adopted and, if necessary, additional measures will be taken to ensure that personal data is protected to a level of protection substantially equivalent to that guaranteed in the EU, in accordance with Chapter V of the GDPR.

The complete and updated list of these entities is available upon request at the contact details indicated at the beginning of this Policy.

9. Your rights

At any time and free of charge, you may exercise the following rights, within the limits and under the conditions (where applicable) set out in the GDPR and the Privacy Code:

the right of access: (i.e. the right to obtain confirmation as to whether or not personal data is being processed, to obtain information on the processing carried out and to receive a copy of the data processed);
the right to obtain the rectification, updating, and integration of inaccurate data without undue delay;
the right to obtain the erasure of data without undue delay;
the right to request the restriction of processing;
the right to receive the data in a structured, commonly used and machine-readable format and to transmit it to another controller without hindrance;
when the data is processed to pursue a legitimate interest of the Data Controller, the right to object to the processing, in whole or in part, for reasons related to the particular situation;
the right to withdraw consent to the processing of data, without prejudice to the processing based on consent carried out prior to the withdrawal. For more details on how to withdraw consent to Trackers, please see our Cookie Policy.

You also have the right to lodge a complaint with the Italian Data Protection Authority or to seek judicial remedy if you believe that your rights have been violated as a result of processing.

To exercise your rights or to address any requests regarding the processing of personal data, you can contact the Data Controller or the DPO at the addresses indicated in sections 2 and 3 above, respectively.

Last updated: 23/02/2026