privacy notice.

who controls your data.

the data controller is NOVA CLUB, located at Via Copernico 38, 20125 Milano, Italy. privacy questions can be sent to info@novaclubroom.com.

what we collect.

when you join the mailing list, we collect your email address, consent status, signup source, and the date and version of the notice you accepted.

when you make a reservation, we also collect your first and last name, email address, selected release, listed amount due at the club, reservation status, confirmation and cancellation times, check-in status, the ip address used to make the reservation, and any optional mailing-list consent.

we use random reservation and qr identifiers to verify reservations and prevent duplicate entry. sensitive token values are stored as hashes in the database. if you enter through a mailing-list or pr link, the reservation and aggregate visit information may be attributed to that link.

short-lived hashed technical identifiers are used for rate limiting, abuse prevention, and approximate unique-visit measurement. we do not use advertising trackers, and we do not collect card or online payment information because payment is made at the club.

why we use your data.

reservation information is used to hold and confirm your place, send essential service emails, issue and validate your qr code, manage capacity, process cancellation, collect the listed amount at the door, and prevent duplicate or fraudulent entry. the legal basis is taking steps at your request and performing the reservation service under article 6(1)(b) of the gdpr.

security, rate limiting, operational analytics, audit records, and reliable door management are based on our legitimate interests under article 6(1)(f) of the gdpr. promotional messages and priority access for future events are separate and rely on your optional consent under article 6(1)(a). refusing promotional consent does not prevent a reservation or essential reservation emails.

who processes your data.

namecheap provides website and email infrastructure, and supabase provides database and authentication infrastructure. authorized NOVA staff can access only the information required by their role. pr managers receive aggregate attribution information and do not receive customer names, email addresses, or reservation ip addresses through the dashboard. reservation ip addresses are visible only to authorized owner and ceo accounts.

how long we keep it.

mailing-list information is retained for 24 months from joining the waitlist, unless consent is withdrawn earlier, unless you withdraw consent or request deletion sooner.

reservation, cancellation, check-in, security, and audit information is retained only for as long as needed to operate the event, resolve entry or reservation issues, prevent misuse, and comply with applicable legal obligations. the final operational deletion schedule will be confirmed before launch.

your rights.

depending on the circumstances, you may request access, correction, deletion, restriction, or portability of your data, or object to processing based on legitimate interests. you may withdraw mailing-list consent at any time without affecting earlier lawful processing. contact info@novaclubroom.com to exercise these rights. promotional emails also contain an unsubscribe link and support one-click unsubscribe.

international transfers.

some infrastructure providers may process data outside the european economic area. where this occurs, transfers must use a lawful safeguard such as an adequacy decision or the european commission's standard contractual clauses.

complaints.

you may complain to the garante per la protezione dei dati personali in italy, or to the supervisory authority where you live or work.