Privacy Policy

Last updated: 15 July 2026

TABLE OF CONTENTS

Introduction

1 - Requirements of the Policy

2 - Types of Data Subject to Processing

3 - Purposes of Processing

4 - Processing Methods and Security Measures

5 - Legal Basis for Processing

6 - Data Sharing

7 - Disclosure of Data to Third Parties

8 - Data Retention

9 - Transfer of Data outside the EU or to International Organisations

10 - Rights of the Data Subject

11 - Cookies

12 - Use of Automated Decision-Making Processes - Profiling

13 - Responsible Parties

Introduction

SharryLand is a Platform designed, developed and managed by SharryLand S.r.l. Società Benefit. It consists of a multichannel and integrated application: web, mobile app, Android App, iOS App and Digital Signage with a wiki system, search engine, networking tools, community and social marketplace.

SharryLand is a platform dedicated to leisure time and slow, sustainable tourism. Its purpose is twofold: on the one hand, to enhance the value of the territory, with particular regard to “secondary” areas, outside cities of art and classic tourist circuits, through the “Map of Italy's hidden Wonders”; on the other hand, to provide Users with tools and services, through the Community and Marketplace, to network, organise, manage, book, purchase, find inspiration, connect with others, express appreciation and contribute to the growth of the SharryLand Community, inspired by the values of beauty, sharing and a slow and sustainable lifestyle and way of travelling.

1 - Requirements of the Policy

This Privacy Policy is drawn up in compliance with EU Regulation 2016/679 on the protection of personal data (“GDPR”) and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 and by the applicable Italian legislation.

This policy, provided in written form and in compliance with the requirements of conciseness, transparency, intelligibility and easy accessibility, explains the purposes and methods of processing the personal data of SharryLand Users.

For the purposes of this policy, “Users” means natural persons who use the Platform, as well as natural persons acting on behalf of professionals, businesses, associations, bodies, organisations or other entities present on the Platform.

2 - Types of Data Subject to Processing

2.1 - Data Provided by the User

At the time of registration on the Platform and through the subsequent use of its features, SharryLand receives the following categories of personal data from Users.

Mandatory registration data. These are the data required for registration and Account management. For natural persons: first name, last name, email address. Professionals and entities other than natural persons are also required to provide the name of the organisation, business or company name and, where necessary, the role or position of the person acting on behalf of the organisation. Failure to provide these data prevents registration or the use of features reserved for registered Users. Upon registration, a temporary password is issued, which is necessary to log in and may be changed at any time by the Registered User.

User age. Registration on the Platform requires a minimum age of 18. A User who, during registration, has made incorrect or untruthful statements may be asked to align their data with the actual situation. In the event of failure to comply, the Account may be suspended or deleted.

Optional data of private Users. After registration, private Users may add further information about themselves, including, by way of example: profile photo, introductory text, areas of interest, preferences, location or area of interest, saved or favourite content, and other data voluntarily entered in the available fields. Providing these data is optional: failure to provide them does not prevent registration, but may limit certain personalised, social or Community features. In order to use specific Platform functions and services other than viewing Content, the User may be required to provide certain data originally indicated as optional.

Professional profile data. Professional Users may be asked to provide data necessary to present their activity and to use professional or commercial features, including: logo or other profile image, photo gallery, introductory text, field of activity, skills and qualifications, languages, area of operation, professional contacts, links, data relating to experiences, products, services or content offered. Users who use the Marketplace are also required to provide the tax, administrative and accounting data necessary for invoicing, payments and legal compliance. Professional Users may also upload documents certifying skills, qualifications, authorisations or titles. These data may be amended according to the available features.

Public data. The data provided by the User for the Profile Page, visible to other Users or to visitors to the Platform depending on the type of profile and the available settings, are: first name and last name, for natural persons, or name of the organisation, business or company name, for professionals and entities other than natural persons; where present, profile image or logo, trademark or business sign; photo gallery; introductory texts; field of activity; skills and qualifications; languages; area of operation; contacts entered in public areas; content and contributions published on the Platform.

The public Profile may also show the list of Contributions, if any, published on the Platform, the number of Cherry points collected, badges or other participation indicators, Followers, Users followed and favourite content, if such elements are intended to be visible by the Platform features. Other data remain private and may be used by the Platform only for specific services and features, for technical, statistical, administrative or security reasons, or to comply with legal obligations.

The User must exercise caution before entering their own or third-party personal data in public areas, free fields, descriptions, comments, reviews, images or contributions. Public content may be indexed by search engines or shared by other Users.

Payment data. Payments for experiences, products and services provided by Sellers on the Marketplace are made through external payment platforms, including Stripe. Payment methods may include credit card, debit card, prepaid card, Apple Pay, Google Pay, Klarna or other systems available during the payment procedure. The User must provide the data necessary to complete the transaction.

The full details of the payment instrument, such as full card number, CVC and expiry date, are processed by the payment service provider in accordance with its own terms and privacy policies. SharryLand retains only the information necessary to confirm the transaction, manage the order, comply with tax and accounting obligations, prevent fraud and manage any disputes, unless otherwise technically indicated by the payment procedure.

If the Seller is enabled to issue invoices, the personal data necessary for that purpose will be requested: first name, last name, full address, tax code, email contact, telephone number, or company data such as company name, full address, VAT number, tax code, SDI code, email or certified email address (PEC). These data are made available to the Seller within the limits necessary to manage the transaction, and SharryLand keeps a record of them within the limits provided by law and by this policy. The Seller/Supplier may be required to open an account with the payment service provider and to provide the data required by the relevant procedure.

Authentication information. For the purposes of transparency and reliability in relations among Community members and between each of them and the Platform, as well as for the fulfilment of contractual obligations, management of the Marketplace, fraud prevention or compliance with legal obligations, SharryLand may ask certain Users to provide authentication information or documents, such as identity card, passport, driving licence, professional licences, authorisations, concessions, permits, administrative licences, certifications or other documents suitable for verifying identity, status, expertise, authorisation or powers of representation.

Such data are processed only to the extent necessary for verification. Where possible, SharryLand retains only the outcome of the verification or the strictly necessary information, avoiding the retention of document copies for longer than necessary. Failure to provide the requested documents may prevent the activation or maintenance of specific features, professional profiles, commercial offers or Marketplace services.

2.2 - Data Acquired through Use of the Platform

The IT systems and software procedures used to operate the Platform acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

Browsing data. This category includes IP addresses, domain names of the devices used by Users, URI notation addresses of the requested resources, time of the request, method used to submit the request to the server, size of the file obtained in response, numerical code indicating the status of the response given by the server, and other parameters relating to the User’s operating system and IT environment.

These data are used to enable browsing, ensure the security and proper functioning of the Platform, prevent abuse and obtain statistical information, including in aggregate form.

Communication data. When the User communicates with the Platform or with other Community members, SharryLand may process the information necessary to enable, manage, moderate, protect or document such communications, within the limits of the features used and the applicable legislation.

Geolocation data. Through certain Platform functions, data relating to the User’s location may be processed. Location may be approximate, for example through the IP address, or precise, through GPS or other functions of the mobile device, only if the User enables or authorises that function through the browser, app or operating system.

Location data may be used to show nearby places, content, experiences, operators or offers, improve searches in the Map of Italy's hidden Wonders, propose content consistent with the area of interest, or enable features requested by the User. The User may disable geolocation through the settings of the device, browser or app; in that case, certain features may not be available or may be limited.

2.3 - Data Collected from Third Parties

Some of the User’s personal data may be collected by the Platform from other sources or through third-party services connected to the Platform, such as payment systems, authentication tools, maps, embedded content, social networks, app stores, newsletter services, analytics or other providers.

If the User connects through the Platform to services provided by third parties, the Platform may acquire data registered by the User with those third parties. Processing carried out directly by such third parties is governed by their respective privacy policies, for which SharryLand is not the controller, except where it acts as joint controller or pursuant to specific agreements.

User Contributions. A User who reports on the Platform an entity or initiative in the territory that is significant for the purposes and functions performed by the Platform may communicate certain public data relating to that entity or initiative, including name, address, description, website, images or public contacts. The User who enters data or content relating to third parties must ensure that they are entitled to do so and that they do not violate third-party rights, confidentiality obligations or applicable laws.

3 - Purposes of Processing

3.1 - General Purposes of the Platform

The data listed above are processed by SharryLand for the following purposes:

to enable browsing and the proper functioning of the Platform;
to create and manage the User’s Account;
to enable use of the Community, the Map of Italy's hidden Wonders, profiles, contributions and social features;
to enable the publication, consultation and management of content, experiences, products, services, initiatives and offers;
to manage purchases, bookings, payments, gift cards, orders, invoicing, refunds and disputes;
to connect Users, local operators, Sellers, Suppliers and other parties involved in the requested services;
to provide assistance and respond to requests, reports or complaints;
to ensure security and prevent abuse, fraud or unauthorised access;
to comply with legal, tax, accounting and administrative obligations;
to establish, exercise or defend a right;
to improve and personalise the User experience, within the limits provided for by the applicable legislation.

3.2 - Communications, Newsletters and Initiatives

SharryLand may use Users’ data to send communications by email, newsletters, notifications or other tools, distinguishing between:

Service communications, which are necessary or useful for managing the relationship with the User, for example registration confirmation, password recovery, Account-related notifications, communications relating to purchases, bookings, payments, assistance, security, changes to terms or technical information about the Platform.

Editorial newsletter and informational updates, relating to content, places, experiences, local products, services, Platform news, opportunities, initiatives and stories consistent with SharryLand’s purposes.

Promotional communications or direct marketing, relating to services, offers, initiatives, experiences, products, trips, gift cards or commercial activities of SharryLand.

Partner initiatives, calls to action, surveys or other activities carried out by SharryLand, including in collaboration with partners, bodies, local operators or other parties.

Service communications do not require marketing consent, as they are necessary for managing the service or are based on SharryLand’s legitimate interest. Newsletters, promotional communications and communications relating to partners are sent within the limits of the applicable legal basis, including the User’s consent where required by law.

The User may unsubscribe from the newsletter and from non-necessary communications at any time through the link included in the communications received.

4 - Processing Methods and Security Measures

The processing of data acquired by SharryLand is carried out in compliance with the principles of necessity and minimisation, reducing the use of personal data to a minimum, as well as in compliance with the principles of lawfulness, fairness, transparency, purpose limitation, accuracy, updating, relevance, non-excessiveness, storage limitation, integrity and confidentiality.

Browsing data and data voluntarily provided by the User are processed and stored according to security criteria, for technical, administrative, legal, statistical and informational purposes, and to satisfy the User’s requests.

SharryLand adopts appropriate technical and organisational measures to minimise the risks of destruction, loss, alteration, unauthorised disclosure, unauthorised access or processing of personal data that is not permitted or does not comply with the purposes for which the data were collected.

Such measures may include access control, authorisation management, authentication systems, backups, technical monitoring, application security measures, internal procedures and agreements with suppliers that process data on behalf of SharryLand.

Each User is advised to keep their credentials carefully, use suitable passwords and keep devices, antivirus systems, firewalls and antispam filters up to date.

5 - Legal Basis for Processing

The legal basis for processing varies according to the purpose pursued.

In particular, SharryLand processes personal data:

for the performance of a contract or pre-contractual measures, where processing is necessary to register the User, manage the Account, enable use of the Platform, the Community, the Marketplace, purchases, bookings, payments, profiles and the requested services;
to comply with legal obligations, where processing is necessary for tax, accounting, administrative or security purposes, to respond to authorities or to fulfil other obligations provided for by the applicable legislation;
on the basis of the User’s consent, where required for specific activities such as newsletters not attributable to service communications, marketing, non-technical cookies, precise geolocation, profiling not necessary for the service or other optional features;
on the basis of SharryLand’s legitimate interest, where processing is necessary to ensure security, prevent abuse or fraud, improve the Platform, compile statistics, manage service communications, protect rights, moderate content or ensure the reliability of the Community, always in compliance with the fundamental rights and freedoms of Users.

Failure to provide the data necessary for the performance of the contract, for pre-contractual measures or for legal obligations may prevent access, in whole or in part, to the features and services offered by the Platform. Failure to provide optional data or failure to give consent does not prevent general use of the Platform, but may limit certain personalised, informational, promotional or location-based features.

Where processing is based on consent, the User may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. Where processing is based on legitimate interest, the User may object in the cases and within the limits provided for by the GDPR.

6 - Data Sharing

In order to enable the transfer of information among Community members, the best use of the Platform and the performance of the proposed activities, including for the purpose of fulfilling contractual obligations, it may be necessary to share certain personal data of Users with some Community members or with parties involved in the requested service.

By way of example, identification data, public profile data, published content, information necessary for bookings, purchases, experiences, activities in the territory, communications between Users, and data necessary for Sellers or Suppliers to provide the requested service may be shared.

Sharing takes place within the limits necessary for the function used by the User, the visibility chosen by or provided for by the Platform, the management of the requested service and the applicable legislation.

7 - Disclosure of Data to Third Parties

The data collected from the individual User are not disclosed or transmitted to third parties, unless such transmission is necessary to satisfy a User’s request, to manage a Platform service, to comply with legal obligations, to protect rights or in the cases provided for by the applicable legislation.

The third parties that may receive the communication of Users’ data processed by SharryLand include, depending on the case:

other Community Users, within the limits of the visibility of profiles and content;
Sellers, Suppliers, local operators, professionals, associations, bodies or partners involved in managing purchases, bookings, experiences, products, services, initiatives or activities requested by the User;
technical suppliers, hosting providers, cloud providers, developers, maintenance providers, security systems and IT support providers;
providers of email, newsletter, notification, analytics, statistics and communication tool services;
payment service providers, anti-fraud systems and financial intermediaries;
tax, legal, accounting and administrative consultants and appointed professionals;
couriers, logistics services or parties involved in delivery, where necessary;
public authorities, supervisory bodies, law enforcement agencies, judicial authorities or other parties to whom disclosure is mandatory by law;
commercial or territorial partners, only within the limits of the stated purposes and the applicable legal basis.

For the purposes of market research, statistics or analysis activities for third parties, Users’ data may be communicated in aggregate or anonymous form. The communication of identifiable personal data to third parties for their own marketing purposes takes place only where there is an appropriate legal basis, for example the User’s specific consent.

The parties that process personal data on behalf of SharryLand are appointed as processors pursuant to Art. 28 GDPR, where required. Parties that independently determine the purposes and means of processing act as independent controllers. The updated list of processors may be requested from SharryLand using the contact details indicated in this policy.

8 - Data Retention

The retention of personal data processed by SharryLand is strictly linked to the purposes of processing and takes place for the time necessary to pursue those purposes, in compliance with the principle of storage limitation.

In the event of Account deletion, the personal data associated with the profile are deleted or anonymised, except for those that SharryLand is required or entitled to retain for legal obligations, tax, accounting or administrative purposes, management of disputes, security, prevention of abuse or establishment, exercise or defence of a right.

In particular:

registration and Account data are retained for the duration of the Account and, after deletion, for the technical time necessary for closure, unless further retention is necessary for legal obligations or the protection of rights;
optional profile data are retained until removed by the User or until the Account is deleted;
public or professional profile data are retained for the duration of the profile and subsequently deleted or anonymised, except for legal obligations or the protection of rights;
Contributions published in the Community may be deleted or retained in anonymous form or in a form not directly attributable to the User, if necessary to preserve the continuity, comprehensibility and integrity of the Community, the Map or editorial content;
data relating to purchases, bookings, orders, gift cards, Marketplace, invoices, tax documents, accounting data and payments are retained for the time necessary to manage the transaction and subsequently in accordance with the applicable civil, tax and accounting obligations, generally up to 10 years where provided for by law;
data relating to communications, assistance, complaints or disputes are retained for the time necessary to manage the request and, if necessary, to protect rights;
data processed for security, prevention of abuse or fraud are retained for the time necessary to manage or document the event, according to proportionate criteria;
data processed for newsletters and marketing are retained until consent is withdrawn, an objection is made or the User unsubscribes, without prejudice to the retention of minimum data in exclusion lists to avoid further unwanted communications;
data collected through cookies and tracking tools are retained according to the durations indicated in the Cookie Policy or in the consent management panel.

During any residual retention periods, the data will not be used for the ordinary purposes of the Platform, marketing or profiling, but only for the purposes that justify their retention.

For any processing of data for purposes other than those indicated in this policy, the User will be provided with an updated policy and, where necessary, new consent will be requested.

9 - Transfer of Data outside the EU or to International Organisations

Personal data are processed, as a rule, within the European Economic Area.

Some providers or sub-providers used by SharryLand may also process data in countries located outside the European Economic Area.

In such cases, the transfer is carried out in compliance with Articles 44 et seq. of the GDPR, on the basis of adequacy decisions by the European Commission, standard contractual clauses approved by the European Commission, supplementary measures where necessary, or other transfer tools permitted by the applicable legislation.

The User may request further information on the safeguards applied by contacting SharryLand using the contact details indicated in this policy.

10 - Rights of the Data Subject

At any time, the User concerned may request from SharryLand access to their personal data, rectification, updating, integration, erasure, restriction of processing, objection to processing, withdrawal of consent given and data portability, in the cases and within the limits provided for by the GDPR.

The User may also object at any time to the processing of data for direct marketing purposes and may withdraw any consents given without affecting the lawfulness of processing carried out before withdrawal.

The relevant request must be addressed to SharryLand S.r.l. Società Benefit, as Data Controller, by email or certified email (PEC) using the contact details indicated in Art. 13 or on the Contact page of the Platform.

In the event of a request for erasure of Profile data, the personal data will be deleted from the Platform within the limits established by law and by this policy. Aggregated and anonymous data will remain intact, and Contributions uploaded by the User to the Platform may be retained with references to the User anonymised or made not directly attributable to them, where necessary to preserve the continuity of the Community, the Map or editorial content.

Account deletion does not automatically entail the deletion of data already communicated to Sellers, Suppliers, payment service providers, authorities or other independent controllers, for which the User must contact the respective controllers directly, unless SharryLand is able to intervene pursuant to the applicable agreements.

In order to protect their rights, the data subject may lodge a complaint with the competent supervisory authority, namely the Italian Data Protection Authority, or bring the matter before the competent judicial authority.

11 - Cookies

Cookies are short strings of code that are downloaded onto a device used by the User to browse a website, typically through a browser. When the User accesses the site again, the device may be recognised. Cookies make it possible to temporarily store information relating to the visit and the visitor’s preferences, in order to improve the user experience and facilitate browsing.

The Platform may use different categories of cookies and similar tools.

Technical cookies. These are necessary to allow the User to browse the site, use its features, access secure areas, maintain the session, manage login and security, and remember technical preferences such as language or essential settings. These cookies do not require the User’s consent.

Analytics cookies. These are intended to assess the effectiveness of the site and improve it. They collect information on how the Platform is used, such as the most visited pages, the User’s source, the number of error messages or performance. When they are configured so as not to allow direct identification of the User and are used only for aggregate statistics, they may be treated as technical cookies within the limits provided for by law. In other cases, they require the User’s consent.

Functionality cookies. These allow the site to store the User’s preferences and choices in order to facilitate browsing during future visits, for example automatic authentication, language or location.

Profiling or marketing cookies and tools. These may be used, subject to the User’s consent, to personalise content, measure campaigns, propose communications consistent with the User’s interests or integrate third-party tools, social networks, videos, maps or advertising systems.

Third-party cookies and tools. Cookies or tools from third parties may be added to the Platform and may collect information about the User in accordance with their respective privacy policies, such as social networks, videos, maps, analytics, payment tools or other embedded services. SharryLand does not directly control cookies installed by independent third parties.

The User may manage cookie preferences through the banner or management panel available on the site, where provided, and may change the browser or device settings. If the User does not wish to allow the site to send cookies to their device, they may refuse the use of cookies through the browser options or settings, without prejudice to the fact that some features may not be available or may not function properly.

This section must be read together with the Cookie Policy or the consent management panel, where available, which provide updated information on cookies, providers, purposes and duration.

12 - Use of Automated Decision-Making Processes - Profiling

The User is informed that, for the purposes specified above, the Platform may use automated systems to improve and personalise the user experience, propose content, places, experiences, products, services or communications consistent with the User’s interests, sort search results, enhance participation in the Community and promote full usability of the Platform’s features.

For this purpose, by way of example, preferences, declared interests, behaviour on the Platform, content viewed, saved or marked as favourite, interactions with the Community, location or area of interest, purchases or bookings made, participation in initiatives, points, Cherries, badges or other participation indicators may be taken into account.

Such processing is intended to personalise the experience and does not produce legal effects concerning the User nor similarly significantly affect them, unless expressly indicated otherwise for specific services.

If SharryLand were to introduce automated processing capable of producing legal effects or similarly significant effects concerning the User, it will provide specific information on the logic used, the significance and the envisaged consequences of the processing, as well as on the User’s rights, including the possibility to obtain human intervention, express their point of view and contest the decision.

For profiling processing based on cookies, tracking tools or non-technical technologies, SharryLand obtains the User’s consent where required by the applicable legislation.

13 - Responsible Parties

The Data Controller is:

SharryLand S.r.l. Società Benefit - Piazza F. Facchetti 12, 35013 Cittadella (PD) - Tax Code / VAT No. 05096140289 REA PD 442705 - email: direzione@sharry.land - certified email (PEC): legal@pec.sharry.land

For any request concerning the processing of personal data and the exercise of the rights provided for by the GDPR, the User may contact SharryLand using the contact details indicated above or through the Contact page of the Platform.

External parties that process personal data on behalf of SharryLand, where necessary, are appointed as processors pursuant to Art. 28 GDPR. The updated list of processors may be requested from SharryLand using the contact details indicated in this policy.