Personal Data Processing Notice

The Data Controller for the personal data collected via this Site and the Amazed application is:

Amazed S.r.l.

Registered office: Via Volturno 5, 20900 Monza (MB), Italy — VAT: 14657960960 — REA: MB-2798911 — Share capital: € 10,000.00 fully paid — Website: amazed.tours — General email: privacy@amazed.tours — Certified email (PEC): amazed@pec.it

For any request concerning personal data processing, the Data Controller can be contacted at the addresses above.

The Data Controller has not appointed a Data Protection Officer (DPO), not being required to do so under Article 37 of the GDPR.

This Notice describes the processing of personal data carried out by the Data Controller through:

• the Site amazed.tours (browsing, online survey, waitlist subscription, contact requests);
• the Amazed Application (Account registration and management, Tour purchase and use, gameplay functionality, geolocation, internal virtual currency).

Where a specific provision applies only to the Site or only to the Application, this is expressly indicated.

Personal data is processed for the following purposes:

The legal basis varies according to the purpose:

• Purposes 5.1 (survey), 5.2 (waitlist) and geolocation 5.4: free, specific, informed and unambiguous consent of the data subject (Art. 6(1)(a) GDPR), expressed respectively by the voluntary submission of data and, for location, by authorization at device level. Consent is revocable at any time, without affecting the lawfulness of processing carried out before revocation.
• Purposes 5.3 (Account and Service provision) and 5.5 (payments): performance of a contract to which the data subject is party or pre-contractual measures (Art. 6(1)(b) GDPR).
• Purposes 5.6 (security) and 5.7 (statistical analysis): legitimate interest of the Data Controller (Art. 6(1)(f) GDPR) in the protection of the Service, prevention of abuse and improvement of user experience, within the limits in which the data is statistical, not linked to a persistent identifier and free of individual profiling.
• Any legal obligations (e.g. tax, accounting): compliance with a legal obligation (Art. 6(1)(c) GDPR).

The data subject has the right to object at any time to processing based on legitimate interest by writing to privacy@amazed.tours.

Data is processed with electronic and IT tools, using infrastructures developed and managed by Amazed S.r.l. and its Data Processors, in compliance with technical and organizational security measures provided for by Articles 25 and 32 of the GDPR.

In particular, the Data Controller adopts:

• encryption of data in transit (HTTPS / TLS);
• encryption of data at rest in the databases used;
• rate limiting systems to prevent abuse;
• data access limited to authorized personnel and designated Data Processors;
• Row Level Security policies on databases, which prevent unauthorized access to data even in case of compromise of public credentials.

Personal data will never be sold or transferred to third parties for commercial purposes.

Data may only be communicated to entities acting as Data Processors pursuant to Article 28 GDPR, on the basis of specific appointment contracts that guarantee GDPR compliance. In particular:

• Vercel Inc. (United States): hosting of the site and APIs.
• Supabase Inc. (European Union, Frankfurt): storage of survey responses and Site waitlist subscribers.
• Upstash Inc. (European Union / United States): abuse prevention and traffic control.
• Resend Inc. (United States): sending service emails and operational communications.
• PostHog Inc. (United States; EU instance with data processing in Frankfurt, Germany): collection and statistical analysis of usage data. PostHog uses local storage on the User's device (LocalStorage) with a pseudonymous identifier that allows correlating interactions during the same session and across different sessions. Traditional cookies are not used. Details are provided in the Cookie Policy.
• Keycloak (self-hosted on Amazed S.r.l. infrastructure): authentication system and user Account management. Since the system is hosted directly on the Data Controller's infrastructure, no third-party communication takes place for this purpose.
• Mapbox Inc. (United States): provision of interactive maps used during Tours. Mapbox may receive the User's IP address and information about the map request. Data is processed according to Mapbox's privacy policy: https://www.mapbox.com/legal/privacy
• Stripe (for web purchases) and Apple / Google (for in-app purchases): payment management. These entities process payment data as independent controllers or processors, in accordance with their respective privacy notices.
• Google Ireland Ltd. / Google LLC (United States) — Site only: statistical analysis of web traffic via Google Analytics 4. Data is processed according to Google's privacy policy: https://policies.google.com/privacy

Note: some of the services listed are indicated in view of the full operability of the Application and are not active as of the date of this version: in particular in-app purchases through the Apple App Store and Google Play, which presuppose the native app not yet released. The list will be updated at the launch of the related functionalities.

Data may also be communicated to expressly authorized employees and collaborators of Amazed S.r.l., and to competent authorities where required by legal obligation.

The updated list of Data Processors is available on request by writing to privacy@amazed.tours.

Some of the providers indicated in paragraph 8 (in particular Vercel, Resend, PostHog, Stripe and partly Upstash) are based in the United States of America or may process data outside the European Economic Area. For PostHog analytics data processing, storage takes place in the provider's EU instance (Frankfurt, Germany); the parent company nevertheless remains subject to US jurisdiction.

In all cases of extra-EU transfer, Amazed S.r.l. ensures that the transfer takes place in compliance with Articles 44-49 of the GDPR, through appropriate safeguards, in particular:

• Standard Contractual Clauses (SCC) approved by the European Commission with Implementing Decision (EU) 2021/914;
• EU-US Data Privacy Framework, where the provider has adhered to it;
• additional technical and organizational measures, including encryption and pseudonymization.

The data subject may request a copy of the safeguards adopted by writing to privacy@amazed.tours.

• Survey data: for the time strictly necessary for the purposes and, in any case, no longer than 24 months from collection.
• Waitlist data: until consent revocation or product launch completion, and in any case no longer than 24 months from subscription in the absence of interactions.
• Account and gameplay data: for the entire duration of the Account; upon Account deletion, data is deleted or anonymized, except for data that must be retained for legal obligations (e.g. purchase data for tax and accounting purposes, retained for legal terms).
• Geolocation data: processed only during gameplay session and not retained as location history beyond what is necessary for the game to work.
• Security data and server logs: no longer than 30 days, except in case of need for investigation of abuse.
• Statistical analytics data (PostHog): no longer than 12 months, after which they are irreversibly deleted or anonymized.
• Data for aggregated and completely anonymized statistical analysis, no longer traceable to the data subject: may be retained for longer periods.

After these terms, data will be irreversibly deleted or anonymized.

The provision of data requested in the survey is optional; failure to provide mandatory data makes it impossible to complete and submit the survey. The email field in the survey is optional.

For waitlist subscription, the provision of the email address is necessary.

For the use of the Application, the provision of registration data is necessary to create the Account and use the Service; failure to provide it prevents its use. The provision of geolocation data is necessary for location-based gameplay features: in the absence of authorization, such features are not available.

The Service is intended for Users who have reached the age of 16. Users under this age may use the Service exclusively under the supervision and with the consent of a parent or guardian. Should the Data Controller become aware of having processed data of a minor in the absence of valid consent, it will proceed to delete it.

The data subject has the right to:

• Access their personal data (Art. 15 GDPR);
• Obtain rectification of inaccurate or incomplete data (Art. 16 GDPR);
• Obtain deletion of their data (Art. 17 GDPR, right to be forgotten);
• Request restriction of processing (Art. 18 GDPR);
• Obtain portability of their data in a structured, readable format (Art. 20 GDPR);
• Object to processing based on legitimate interest (Art. 21 GDPR);
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome — https://www.garanteprivacy.it).

To exercise their rights, the data subject may write to privacy@amazed.tours or via PEC to amazed@pec.it. The Data Controller will respond within 30 days of receipt, extendable by a further 60 days in case of particular complexity, notifying the data subject.

The Data Controller reserves the right to modify, update or supplement this Notice at any time, including based on regulatory developments or service changes. Changes will be published on this page with an indication of the last update date. In case of material changes, the Data Controller may send email notification to users who have provided their address.

By submitting the survey, subscribing to the waitlist, registering with the Application or activating features that require consent, the User declares to have read this Notice and provides, where required, their consent to the processing of personal data for the purposes indicated, pursuant to Article 6(1)(a) GDPR.

This notice is drafted in Italian. Versions in other languages are translations provided for the User's convenience. In the event of any discrepancy, the Italian version prevails.