Italy adds GDPR, consumer, and digital-market duties.
This supplement identifies the additional rules and product gates for offering Galaxy Cue to people or Businesses in Italy. It supplements the Privacy Notice, Terms, DPA, Marketplace Terms, and Storage & Retention Policy.
When this supplement applies
This supplement applies when Galaxy Cue or a participating Business is established in Italy, offers Galaxy Cue goods or services to people in Italy, or monitors their behavior in a way covered by Regulation (EU) 2016/679 (GDPR). The Italian Privacy Code, Legislative Decree 196/2003 as amended, also applies where its territorial rules are met.
Nothing here removes mandatory rights granted by Italian or EU law. If this supplement conflicts with a mandatory consumer or data-protection rule, that mandatory rule controls for the protected person.
Controller, processor, and representative identity
The final Italian notice must name Galaxy Cue’s legal operator, physical address, privacy contact, and—if required by GDPR Article 27—its representative established in the European Union. If a Data Protection Officer is required or voluntarily appointed, the DPO contact must also be published.
A Business ordinarily controls the purposes of Client and Event information in its workspace. Galaxy Cue acts as its processor for that information under an Article 28-compliant DPA, while separately controlling account, security, subscription, public-site, and platform-administration data. The exact allocation must follow the actual processing, not a label in the contract.
Purposes and GDPR legal bases
| Processing | Expected basis | Required control |
|---|---|---|
| Account, booking request, Event workflow, quote, contract, planning, files, messages | Contract or steps requested before contract; processor instructions for Business-controlled data | Collect only necessary fields and explain whether providing them is required |
| Tax, accounting, fraud, legal claims, regulatory response | Legal obligation or legitimate interests, as applicable | Document the law or balancing assessment and apply limited retention |
| Security, access logs, service reliability, abuse prevention | Legitimate interests and legal obligations, as applicable | Necessity, proportionality, restricted access, and documented retention |
| Promotional email/SMS, optional media/social use, non-essential tracking | Freely given, specific, informed, unambiguous consent unless a narrow statutory exception applies | No pre-checked box; prove the choice; make withdrawal as easy as consent |
| Marketplace matching | Client-requested pre-contract steps and/or consent for optional disclosure, depending on the field and purpose | Separate opt-in and privacy-safe provider visibility |
The final Article 13/14 notice must state the specific purposes, bases, legitimate interests, recipients, required/optional fields, retention, transfers, rights, complaint route, and any automated decision-making actually used.
Rights of people in Italy
Subject to the GDPR’s conditions and exceptions, people may request access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. They may object at any time to direct marketing. They also have the right not to be subject to certain decisions based solely on automated processing and may complain to the Garante per la protezione dei dati personali.
Galaxy Cue and the responsible Business must respond without undue delay and ordinarily within one month, with a permitted extension for complex or numerous requests. The response must identify the responsible controller and explain any refusal and complaint rights.
Transfers outside the European Economic Area
Galaxy Cue currently uses providers that may process information in the United States. Before Italy launch, each transfer must be mapped and supported by an applicable adequacy decision, valid EU Standard Contractual Clauses, or another lawful transfer mechanism. Where required, Galaxy Cue must complete a transfer-impact assessment and supplemental technical/contractual measures.
The DPA and Subprocessor List must identify applicable safeguards and explain how to obtain a copy. This draft does not claim that the EU–U.S. Data Privacy Framework or Standard Contractual Clauses cover a provider until the operator verifies and documents that provider’s current status and contract.
Electronic marketing
Promotional email, SMS, and comparable automated communications to Italian users require prior, specific consent under the ordinary rule. Consent must be separate from service acceptance and from unrelated profiling or third-party marketing. Every message must identify the sender and provide a free, effective opt-out.
The limited Italian “soft spam” exception should be used only after counsel confirms every condition, including an email obtained through an actual sale and promotion of the controller’s own similar products or services. A booking inquiry, public directory, social connection, or Marketplace interest is not by itself marketing consent.
Italian and EU consumer subscriptions
Before a consumer buys a Galaxy Cue subscription or digital service, the checkout must clearly present the trader’s identity and contacts, main service characteristics, total price including taxes and fees, billing interval, automatic renewal, minimum duration, cancellation process, complaint route, compatibility/functionality where relevant, and the statutory withdrawal right.
- The final order control must unambiguously state that the order creates an obligation to pay.
- Paid extras may not use pre-checked boxes.
- The consumer must receive confirmation in a durable medium, such as email or a record they can store and Galaxy Cue cannot unilaterally alter.
- The ordinary distance-contract withdrawal period is 14 days unless a valid statutory exception applies.
- If digital performance begins during the withdrawal period, the required express request/acknowledgement and consequences must be captured exactly as counsel approves.
- Mandatory digital-service conformity and consumer remedies cannot be disclaimed.
The final Terms must be available in Italian, use plain language, and may not impose unfair limitations of mandatory consumer rights.
Marketplace transparency
Before enabling Open Marketplace in Italy, Galaxy Cue must determine its classification under the EU Digital Services Act and consumer law. At minimum, the interface should identify the responsible Business, indicate whether the provider is acting as a trader, explain the principal matching/ranking factors, distinguish platform services from the Business’s Event services, preserve reporting/complaint channels, and avoid presenting Galaxy Cue as the provider of an Event service it does not perform.
Each selected Business enters its own Quote, Contract, payment, cancellation, and fulfillment relationship. The Client’s statutory rights depend in part on whether that provider is a trader and must be explained before commitment.
Children and Event information
Galaxy Cue is intended for adult Business users and adult Event organizers. Italian law permits a person aged 14 or older to consent to certain information-society processing offered directly to them, but that rule does not by itself give contractual capacity or make Galaxy Cue child-directed. Galaxy Cue should retain an 18+ account rule unless counsel approves a verified parental/guardian flow.
An adult may enter limited information about a minor only when authorized and genuinely necessary for the Event. Special-category, biometric, government-ID, health, or safeguarding information must not be collected through ordinary forms or messages.
Security incidents and accountability
The controller must assess personal-data breaches promptly and notify the competent supervisory authority within 72 hours of awareness when the GDPR threshold is met. High-risk breaches may also require notice to affected people. Galaxy Cue must notify affected Business controllers without undue delay, preserve an incident record, and support their assessment.
Before Italy launch, Galaxy Cue must maintain records of processing, Article 28 processor terms, privacy-by-design reviews, documented legal-basis decisions, processor due diligence, role-based training, and DPIA screening for processing likely to create high risk.
Italy launch gates
Until these gates are complete, the product must not market itself as GDPR-compliant or legally ready for Italy.