Privacy Policy

Privacy and Cookie Policy

Last updated: 11/02/2026

The purpose of this document is to inform the data subject (“Data Subject”) about the processing of their personal data (“Personal Data”) collected by the data controller, What a Show S.r.l. (sole shareholder company), with registered office at Via Domodossola 23, 00183 Rome, Italy, CF/VAT 11000301009, e-mail info@whatashow.it, (the “Controller”), through the website whatashow.it (the “Application”).

Amendments and updates will be binding as soon as they are published on the Application. If the Data Subject does not accept the amendments to this Privacy Policy, they must cease using the Application and may request the Controller to delete their Personal Data.

1. Categories of Personal Data processed

   The Controller processes the following types of Personal Data voluntarily provided by the Data Subject:

   • Contact data: name, surname, address, e-mail, phone, images, authentication credentials, and any further information sent by the Data Subject.

   The Controller processes the following types of Personal Data collected automatically:

   • Technical data: Personal Data produced by devices, applications, tools and protocols used (e.g. device information, IP addresses, browser type, ISP).
   • Browsing and usage data: e.g. pages visited, number of clicks, actions taken, session duration.
   • Security and authentication data: For security purposes and fraud prevention, the Controller collects and processes the following data in connection with access attempts to reserved areas (client area and administrative area): IP address, user agent (browser and device information including browser type, version, operating system, device type), email address used in login attempts, date and time of access attempts, outcome of authentication (successful or failed), session identifiers, and any other technical data necessary for security monitoring. These data are logged and stored in dedicated databases to monitor unauthorized access attempts, prevent security breaches, protect the Controller's systems and users, comply with legal obligations, and enable forensic analysis in case of security incidents. In case of suspicious or unauthorized access attempts, the Controller may block IP addresses, suspend or revoke access credentials, and report incidents to competent authorities. These data are processed on the basis of the Controller's legitimate interest in ensuring the security of its systems and protecting users' data, as well as for compliance with legal obligations regarding cybersecurity and data protection.

   Failure to provide mandatory Personal Data may prevent the Controller from establishing or continuing the relationship. The Data Subject who communicates to the Controller Personal Data of third parties is solely responsible for their origin and processing.

2. Cookies and similar technologies

   The Application uses cookies, web beacons, unique identifiers and similar technologies. You can view the full Cookie Policy at the following address: Cookie Policy.

3. Legal basis and purposes of processing

   Processing is necessary for the performance of the contract, for legal obligations, for the legitimate interest of the Controller (e.g. marketing, technical management, security, statistics), and on the basis of consent (e.g. profiling, marketing). Personal Data may also be used to protect the Controller in legal proceedings.

4. Processing methods and recipients

   Processing is carried out by means of paper and IT tools, with appropriate security measures. Personal Data are processed only by authorised persons, by data processors (e.g. partners, consultants, hosting providers), and by entities to whom disclosure is required by law. Personal Data will not be disseminated.

5. Location

   Personal Data will not be transferred outside the European Economic Area (EEA).

6. Retention period

   Personal Data are retained for the time necessary to fulfil the purposes for which they were collected (e.g. duration of the contractual relationship plus 10 years for prescription; until consent is withdrawn for consent-based processing). Thereafter they are deleted or anonymised.

7. Data Subject rights

   The Data Subject may: be informed about processing, withdraw consent, restrict processing, object, access, rectify, obtain erasure or portability of their data, and lodge a complaint with a supervisory authority or bring legal action.

   To exercise these rights, send a request to info@whatashow.it. Requests will be handled as soon as possible, in any case within 30 days.

Last updated: 11/02/2026