Privacy Policy

Purpose of the Processing and Legal Basis

The Controller will process your personal data within YOUNG GUNS event and related official side events, which will take place in Bolzano on the 11th of September 2026 (hereinafter the "Young Guns Event"):

1. allow users to browse the website. The processing of your personal data is based on the legitimate interest of the Controller pursuant to Article 6(1)(f) of the GDPR, ensuring the proper functioning and security of the website.
2. allow the using the ticket for Young Guns Event. The processing of your personal data is based on the performance of a contract pursuant to Article 6(1)(b) of the GDPR, allows processing necessary for fulfilling a contract to which the data subject is a party.
3. if necessary, the Controller will process your personal data to establish, exercise, or defend a legal claim, whether in judicial, administrative, or extrajudicial proceedings, and/or to comply with legal obligations and requests from competent authorities. The processing of personal data is based on the legal bases set forth in Article 6(1)(c) and (f) of the GDPR.

Any partner or co-organizer involved in the Event shall process personal data exclusively on behalf of the Controller, unless otherwise explicitly stated.

Personal Data Processed

The Controller will process the following personal data:

• IP number;
• depending on the section of the website https://www.tothepeak.eu/ on which the requested data is provided: Name, surname, email address, phone number, WhatsApp contact, information related to your job and education, and provided by you on the website.

Categories of Data Subjects

The processing activities are directed towards the following categories of data subjects: event participants, volunteers.

Processing Methods and Storage Period

The Controller will process your personal data through IT, with methods suitable to ensure their security and confidentiality in accordance with the provisions of the GDPR. Your personal data will be processed for the period strictly necessary to achieve the purposes of the Young Guns Event and in accordance with the Controller's data retention policies.

Personal data will be retained for the following periods: Data related to ticket purchase for the time necessary to comply with contractual and legal obligations; Data processed for the matchmaking platform for a limited period related to the duration of the Event and subsequent networking activities; Data processed for marketing or sponsor communication purposes until consent is withdrawn. At the end of the retention period, data will be deleted or anonymized.

Recipients of the Data

The Controller may communicate your personal data to the following categories of subjects:

• authorized and duly trained personnel — including volunteers — of the Controller, also regarding security measures and confidentiality obligations;
• Rancilio Cube SICAF S.p.A. may process personal data on behalf of the Controller in connection with the organization, promotion and operational management of the Young Guns Event.
• where applicable, third-party subjects participating in the Young Guns Event as sponsor;
• where applicable, subjects and authorities whose right to access personal data is expressly recognized by law or by measures issued by competent authorities.

Data Transfer Outside the European Union

The Controller will process your personal data within the European Union.

Data Subject Rights

The data subject may exercise the rights set forth in Articles 7(3) and 15 to 22 of the GDPR by submitting the request directly to the Controller by using the following e-mail address: hello@tothepeak.eu. The Controller may request additional information necessary to verify the identity of the data subject before processing the request.

The data subject may exercise, where applicable, the rights set out in Articles 15 to 22 of the GDPR, including:

• Right of access – Article 15 GDPR: The right to obtain confirmation as to whether or not personal data concerning you is being processed, and, if so, to access such data.
• Right to rectification – Article 16 GDPR: The right to obtain, without undue delay, the correction of inaccurate personal data concerning you and/or the completion of incomplete personal data.
• Right to erasure (right to be forgotten) – Article 17 GDPR: The right to request the deletion of personal data concerning you without undue delay, provided that the conditions set out in the GDPR are met. This right does not apply where processing is necessary for compliance with a legal obligation, the performance of a task carried out in the public interest, or for the establishment, exercise, or defense of legal claims.
• Right to restriction of processing – Article 18 GDPR: The right to obtain restriction of processing where one of the following applies:
  1. You contest the accuracy of your personal data, for the period necessary for the controller to verify its accuracy;
  2. The processing is unlawful, and you oppose the erasure of the personal data and request instead the restriction of its use;
  3. The controller no longer needs the personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims;
  4. You have objected to processing pursuant to Article 21(1) GDPR, pending the verification of whether the controller's legitimate grounds override yours.
• Right to data portability – Article 20 GDPR: The right to receive your personal data in a structured, commonly used, and machine-readable format and the right to transmit such data to another controller without hindrance, where processing is based on consent or a contract and is carried out by automated means. This right includes, where technically feasible, the ability to have your personal data transmitted directly from one controller to another.
• Right to object – Article 21 GDPR: The right to object, at any time, to the processing of your personal data where it is based on legitimate interest, including profiling. The controller shall no longer process your data unless it demonstrates compelling legitimate grounds for processing that override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.
• Right not to be subject to automated decision-making – Article 22 GDPR: The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This right does not apply where the decision is necessary for entering into or performing a contract, is authorized by law, or is based on your explicit consent. In any case, you have the right to obtain human intervention from the controller, express your opinion, and contest the decision.
• Right to lodge a complaint with the Data Protection Authority: You have the right to lodge a complaint with the competent Data Protection Authority, which in Italy is the Garante per la Protezione dei Dati Personali: http://www.garanteprivacy.it.
• Right to withdraw consent: Where processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. The withdrawal of consent shall be as easy to perform as the act of giving it.

The exercise of the rights as a data subject is free of charge, in accordance with Article 12 GDPR.

Data Controller