This notice, provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR"), explains how personal data is processed when you take part in Trova la Margherita, the Conad activity at Cous Cous Fest 2026 available at conad.couscousfest.it. The Italian version prevails in case of discrepancy.
1. Controller and processor
The data controller is PAC 2000A Società Cooperativa, Via del Rame, zona industriale Ponte Felcino, 06134 Perugia, VAT no. 00163040546. The controller has appointed a Data Protection Officer (DPO), whom you can contact for any request about your personal data at dpo_pac2000a@protectiontrade.it.
Feedback S.r.l. unipersonale, Via Libertà 103, 90143 Palermo, organiser of Cous Cous Fest, builds and runs the platform on behalf of the controller and is appointed data processor under Article 28 GDPR. For the purpose described in section 3, point e) only, Feedback S.r.l. unipersonale acts as an independent controller.
2. What data we process
- Data you provide: first name, last name, email address, city of origin, number of days you spend at the festival, your consent choices.
- Game data: the QR codes you scanned, with date and time, and whether your daisy is complete.
- Verification codes: the temporary code emailed to you to confirm sign-up and login.
- Technical data: IP address, browser and device type, pages visited and server logs, generated automatically when you use the site. Visit statistics are collected only with your consent, as described in the cookie policy.
We do not collect special categories of data or data relating to criminal convictions.
3. Purposes and legal bases
- a) Taking part in the game. Sign-up, login, petal count, completion check and gadget collection at the stand, including service messages strictly related to the game. Legal basis: performance of a contract to which you are party (Art. 6(1)(b) GDPR).
- b) Identity verification and security. Sending the email code, preventing duplicate accounts and abuse. Legal basis: performance of the contract and the controller's legitimate interest in protecting the service (Art. 6(1)(b) and (f)).
- c) Event statistics. City of origin and length of stay are used only in aggregated, anonymous form to measure the activity. Legal basis: legitimate interest (Art. 6(1)(f)).
- d) Conad communications. Only if you opt in, commercial and promotional emails from Conad and information about Conad initiatives at Cous Cous Fest. Legal basis: consent (Art. 6(1)(a)), optional and revocable at any time. Conad's general privacy notice also applies to Conad's commercial activities.
- e) Cous Cous Fest communications. Only if you opt in, commercial and promotional emails about Cous Cous Fest sent by Feedback S.r.l. unipersonale, which processes your data as an independent controller for this purpose. Legal basis: consent, optional and revocable at any time by writing to info@feedback.it.
- f) Legal obligations and defence of rights. Compliance with applicable law and, where necessary, establishing or defending a legal claim. Legal basis: legal obligation and legitimate interest (Art. 6(1)(c) and (f)).
4. Provision of data
First name, last name, email, city and length of stay are required to take part: without them you cannot register. Consent to commercial communications is optional and does not affect participation. You can withdraw it at any time with no effect on the game.
5. Minimum age
The activity is open to people aged 14 or over. By registering you confirm you are at least 14. If we become aware of data relating to younger persons, we delete it.
6. Who can access the data
- Authorised staff of the controller and the processor. At the Conad stand, staff see your name, email and completion status in order to hand over the gadget.
- Vercel Inc. (United States), which hosts the site: pages are processed on servers in the European Union and delivered through its content delivery network.
- Turso (ChiselStrike Inc., United States), which provides the database: data is stored on AWS infrastructure in Ireland.
- The Cous Cous Fest email service, operated by Feedback S.r.l. unipersonale, used to send verification codes.
These providers process data as processors or sub-processors under agreements compliant with Article 28 GDPR. Data is never published or sold.
7. Transfers outside the European Union
Data is stored and processed in the European Union. Some providers are based in the United States and may access it for technical support; such transfers are governed by the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) and, where applicable, by the EU-US Data Privacy Framework.
8. How long we keep the data
- Registration and game data: up to 60 days after the end of Cous Cous Fest 2026, then deleted or anonymised.
- Verification codes: 10 minutes.
- Session cookie: 30 days from the last login.
- Data used for commercial communications: until consent is withdrawn and in any case no longer than 24 months.
- Aggregated statistics: indefinitely, as they cannot identify you.
- Technical logs: as long as needed to keep the service secure.
9. Your rights
You may at any time request access to your data, rectification, erasure, restriction of processing and portability; you may object to processing based on legitimate interest and withdraw any consent given, without affecting the lawfulness of prior processing. To exercise your rights write to dpo_pac2000a@protectiontrade.it; for Cous Cous Fest communications write to info@feedback.it. If you believe the processing infringes the law you may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of your country of residence.
10. Automated decisions
We do not make decisions based solely on automated processing, including profiling, that produce effects on you.
11. Security
Data travels over encrypted connections, access is protected by temporary email codes and signed sessions, and the staff area is restricted to authorised personnel.
12. Changes
This notice may be updated; the date of the latest revision is shown at the top. Significant changes will be announced on the site.