Privacy Policy

(Notice addressed to Merchants and visitors to the website tovibe.co) Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) Version 1.1 – last updated on 29 September 2026

1. Controller

The controller is Livesfirm S.r.l., with registered office in Corso Vittorio Emanuele 112, 90016 Collesano 90016 (PA) Sicilia, Tax Code (C.F.) and VAT No. 07118620827, certified email (PEC) livesfirmsrl@pec.it, email support@livesfirm.com.

2. Scope of this privacy notice

This privacy notice describes the processing carried out by Livesfirm as an independent controller, and concerns:

a) visitors to the showcase website tovibe.co;
b) persons requesting commercial information through the contact form;
c) Merchants, their legal representatives, contact persons and staff and collaborators enabled to access the ToVibe dashboard.

This privacy notice does not concern the data of ticket purchasers, in respect of which the controller is the individual Merchant and Livesfirm acts as processor pursuant to Article 28 GDPR: for such processing, please refer to the privacy notice published by the Merchant in its Shop.

3. Categories of data processed

3.1 Website browsing. IP address, device and browser identifiers, pages visited, date and time of access, technical log data.

3.2 Commercial contact requests. Name, email address, telephone number, name of the business or project, content of the message.

3.3 Account registration and management. Company name, legal form, VAT number and tax code, registered office, business email address, telephone contact details, details of the legal representative, details of contact persons and enabled users, login credentials in encrypted form.

3.4 Administrative and payment data. Bank details, electronic invoicing details (recipient code (codice destinatario), PEC), data relating to transactions, payouts, collections and fees.

3.5 Identity verification. Outcome of the KYC/AML procedure carried out by Stripe, status of the connected account and of its operational capabilities. Identification documents are collected and stored directly by Stripe, which acts as an independent controller for its own anti-money laundering obligations.

3.6 Use of the Platform. Access and activity logs, events created, operations performed in the dashboard, support data and correspondence with the support service.

4. Purposes and legal bases

The data are processed for the following purposes:

a) provision of the service and management of the contractual relationship — legal basis: performance of a contract (Article 6(1)(b) GDPR);
b) registration, verification and management of the Account — performance of a contract (Article 6(1)(b) GDPR);
c) management of collections and payouts, recording and storage of the transaction history, management of invoicing and of the related administrative relationships with the Merchant — performance of a contract and legal obligation (Article 6(1)(b) and Article 6(1)(c) GDPR);
d) tax, accounting and other legal obligations — legal obligation (Article 6(1)(c) GDPR);
e) customer support and assistance — performance of a contract (Article 6(1)(b) GDPR);
f) security of the Platform, prevention of fraud and abuse — legitimate interest of the Controller in protecting its systems (Article 6(1)(f) GDPR);
g) responding to commercial contact requests — pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR);
h) sending commercial communications relating to services similar to those already provided — legitimate interest, with the right to object in every communication (Article 6(1)(f) GDPR);
i) sending newsletters and promotional communications to non-customers — consent (Article 6(1)(a) GDPR);
j) establishment, exercise or defence of legal claims — legitimate interest (Article 6(1)(f) GDPR).

5. Nature of the provision of data

The provision of the data indicated in sections 3.2, 3.3, 3.4 and 3.5 is necessary for the conclusion and performance of the contract: failure to provide them prevents registration, the activation of payments or the continuation of the relationship.

6. Cookies and tracking tools

The website uses technical cookies and, subject to consent, analytics and profiling cookies, as set out in the Cookie Policy available at https://app.legalblink.it/api/documents/6abff6171b81a6002205c6fe/cookie-policy-en, which forms an integral part of this privacy notice.

7. Recipients of the data

The data may be disclosed to:

• hosting and cloud infrastructure service providers;
• Stripe, as payment service provider and independent controller for its own obligations;
• providers of transactional email and customer support services;
• accounting, tax and legal advisers, auditors;
• judicial and administrative authorities, in the cases provided for by law.

Parties processing data on behalf of Livesfirm are appointed as processors pursuant to Article 28 GDPR. The data are not disseminated or transferred to third parties for their own marketing purposes.

8. Transfers outside the EEA

Any transfers to third countries take place only on the basis of an adequacy decision or of appropriate safeguards pursuant to Articles 44 et seq. GDPR, including the Standard Contractual Clauses, a copy of which may be requested using the contact details set out in section 1.

9. Retention periods

• technical logs: 90 days;
• data collected through cookies and other tracking tools: in accordance with the periods indicated in the Cookie Policy;
• contact requests not followed by a contract: 24 months;
• contractual and Account data: for the duration of the relationship and for 10 years after its termination, to comply with civil-law and tax obligations;
• tax and accounting data: 10 years;
• data necessary for the defence of legal claims: until the final settlement of the dispute and the expiry of the subsequent time limits for appeal.

10. Rights of data subjects

Pursuant to Articles 15 to 22 GDPR, the data subject may exercise the rights of access, rectification, erasure, restriction, portability and objection, and may withdraw the consent given at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Requests must be sent to the contact details set out in section 1. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.gpdp.it).

11. Automated decision-making

Livesfirm does not use decision-making based solely on automated processing which produces legal effects concerning the data subject. The anti-fraud and KYC checks carried out by Stripe follow Stripe’s own rules, to which reference is made.

12. Amendments

This privacy notice may be updated. Material changes are communicated to Merchants by email or via the dashboard.