Below you can find information on how personal data is processed on the LUDO App.  We would like to point out that this privacy policy does not apply to data processing carried out by or via third-party web pages to which this app may provide a link, as the Data Controller, as defined below, has no influence or control over their configuration and content. We therefore recommend that you consult the relevant privacy and cookie policies.

1. Data Controller

Ponderosa Music & Art (hereinafter, the ‘Data Controller’) with registered office in Milan, Piazza Santa Maria delle Grazie, 1, VAT number 02557880123, acts as the data controller. You can contact the Data Controller by ordinary mail at the address of the registered office, or by e-mail at privacy@ponderosa.it.

2. Purpose of data processing, legal basis, nature of the provision of data and consequences of a refusal to answer

Personal data will be collected and processed for the following purposes:

• for the provision of the requested services and the performance of related contractual obligations (including: ACCESS TO TO EXCLUSIVE ARTIST CONTENT) For the achievement of this purpose, the legal basis legitimising the corresponding processing of personal data is the performance of a contract to which the data subject is a party and the fulfilment of related legal obligations. The communication of personal data is optional, but necessary for the achievement of this purpose: therefore, if personal data are not communicated, it will not be possible to proceed with the provision of the requested services;
• to comply with legal obligations or orders from public authorities, in relation to, and on the basis of, the data provided in pursuance of the preceding purposes. The legal basis for this purpose is the fulfilment of a legal obligation. Consequently, the processing of personal data is compulsory, notwithstanding the fact that such data are communicated by the data subject for the fulfilment of one of the preceding purposes;
• to assert and defend the rights of the Data Controller also before the judicial authorities. For the fulfilment of this purpose, the legal basis justifying the corresponding processing of personal data is the legitimate interest of the Controller in asserting and defending the relevant rights, an interest that is fairly balanced with that of the data subject, as the processing activity is limited to what is strictly necessary for the pursuit of this purpose.

Finally, it should be noted that the computer systems and software procedures used to operate the Data Controller’s sites acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. For further details, please refer to the text of the cookie policy.

3. Data retention period

The retention period of personal data varies according to the purposes for which they are collected and processed. Specifically:

• personal data are retained for 10 Years from _Jan 3^rd 2025, except where retention for a longer period is required for litigation, requests by the competent authority or under applicable law;
• for the purpose of asserting and defending the Data Controller’s rights, including before the judicial authorities, personal data are retained for 10 years following their communication, except in cases where retention for a longer period is required for litigation, by the competent authority or pursuant to applicable legislation;
• in order to comply with legal obligations or orders from public authorities, personal data are retained for as long as required by the specifically applicable legislation.

4. Areas of communication of personal data

For the pursuit of each of the above-mentioned purposes, the personal data collected may be communicated to the following categories of subjects: (a) employees of the Data Controller specifically entrusted with the processing of data, in particular for the purposes of online customer support, sales, accounting, human resources, IT and, in general, to duly appointed employees; (b) providers of tax and legal assistance and consultancy services; (c) providers of IT or archiving services; (d) companies entrusted with providing a service to the Data Controller (e.g. printing and mailing companies), including subjects and partners involved in delivery activities; (e) law enforcement agencies, government bodies, regulatory bodies, courts or other public authorities authorised by law; (f) third parties or organisations to which the disclosure of data is required by law.

The aforementioned parties may also act as data processors or autonomous data controllers, as the case may be. Personal data will not be disclosed to parties other than those indicated.

 

5. Rights of the data subject

Pursuant to applicable legislation, the data subject may exercise his or her rights, including the right at any time to obtain confirmation of the existence or otherwise of his or her personal data and its communication in an intelligible form; he or she may also obtain information on the origin of his or her personal data, the purposes and methods of processing, the logic applied in the event of processing carried out with the aid of electronic instruments, the identification details of the Data Controller and the persons to whom his or her personal data may be communicated; you may also request access, updating, rectification, integration of your personal data, deletion, restriction of processing, transformation into anonymous form or blocking of data processed in breach of the law, including data whose storage is not necessary in relation to the purposes for which the data were collected or subsequently processed; you will have the right to lodge a complaint with the supervisory authority, as well as the right to data portability.

The data subject may withdraw consent, where given, at any time without prejudice to the lawfulness of the processing prior to withdrawal. Finally, he/she shall have the right to object to the processing of personal data concerning him/her by contacting the Data Controller at the address given.