How we handle your data.

1. Data controller

The data controller is MATTERHORNCERVINOXPERIENCE S.R.L., registered office at Via Roma 11/2, 16121 Genoa (GE), Italy.

VAT / Tax ID: 02962160996 · REA: GE-523156.

For any request regarding personal data you can write to info@mcxperience.com or call +39 351 504 9075.

2. Data we process

We only process the data strictly needed to respond to user requests and to keep the site working correctly.

• Contact details voluntarily provided via email, phone or WhatsApp (name, contact info, message content).
• Booking data collected through the booking form — the form is provided by a third-party supplier acting as either a data processor or an independent controller depending on the case; their privacy notice applies inside the widget.
• Technical browsing data needed for the site to operate (IP address, user agent, pages visited) collected by the hosting server logs for security and diagnostic purposes.

3. Purposes and legal basis

Data is processed for the following purposes:

• To respond to information requests, quotes or bookings — legal basis: pre-contractual measures at the request of the data subject (art. 6.1.b GDPR).
• To manage the booking of experiences and deliver the service — legal basis: performance of the contract (art. 6.1.b GDPR).
• To ensure security, diagnostics and continuity of the website — legal basis: legitimate interest of the controller (art. 6.1.f GDPR).
• To comply with legal obligations (e.g. tax, accounting) — legal basis: legal obligation (art. 6.1.c GDPR).

4. Cookies and tracking technologies

The site www.mcxperience.it does not use profiling cookies or third-party tracking that would require the user's prior consent. For this reason no consent banner is shown.

Only cookies and identifiers strictly necessary for the technical operation of the site are used (e.g. language preference, session), exempt from consent under art. 122 of Italian Legislative Decree 196/2003 and the Italian Data Protection Authority guidelines of 10 June 2021.

To view the address on Google Maps a link is provided that opens the service in a new tab: at that point you leave the site and Google Ireland Ltd's terms and privacy policy apply.

The booking form is delivered as a widget by SimplyBook (SimplyBook.me UAB, Lithuania, EU), which manages its own technical cookies and notice shown inside the widget itself. Please refer to SimplyBook's official privacy policy at https://simplybook.me/en/privacy-policy.

5. Recipients of the data

Personal data may be disclosed to entities acting as data processors or independent controllers, only for the purposes above:

• Amazon Web Services EMEA SARL (Luxembourg) — site hosting via AWS Amplify in a European region. AWS acts as a data processor for the cloud service.
• Aruba S.p.A. (Italy) — domain registrar for mcxperience.it and email provider for info@mcxperience.com. Data stored on Italian infrastructure.
• SimplyBook.me UAB (Lithuania, EU) — online booking form provider; acts as an independent controller for the booking data collected through its widget.
• Hotel Lo Stambecco, as operational partner, solely to deliver the agreed experiences (snowcross, dinner at altitude).
• Consultants, accountants and competent authorities within the limits of legal obligations.

6. Transfers outside the EU

Data is mainly processed within the European Union: the AWS Amplify hosting runs in a European region, Aruba stores data in Italy, and SimplyBook is based in Lithuania (EU).

Amazon Web Services Inc. is a US company: any transfer to the United States within the cloud service occurs under the EU-US Data Privacy Framework (EU Commission adequacy decision of 10 July 2023, to which AWS is a certified entity) and, as a complementary safeguard, under the Standard Contractual Clauses (SCC) approved by the EU Commission pursuant to art. 46 GDPR.

7. Retention period

Contact and booking data are kept for the time needed to handle the request and, if the service is signed, for the periods required by tax and accounting obligations (10 years under art. 2220 of the Italian Civil Code).

Technical logs are kept for the time strictly needed for security and diagnostic purposes, generally no longer than 30 days unless an incident investigation is needed.

8. Rights of the data subject

At any time you can exercise the rights provided by articles 15 to 22 of GDPR by writing to info@mcxperience.com:

• Access to your data and receipt of a copy.
• Rectification of inaccurate data or completion of incomplete data.
• Erasure of the data (right to be forgotten), within the limits allowed by law.
• Restriction of processing in the cases provided by art. 18 GDPR.
• Objection to processing on legitimate grounds.
• Portability of the data in a structured, machine-readable format.
• Lodging a complaint with the competent supervisory authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

9. Changes to this notice

This notice may be updated to reflect regulatory or organisational changes. The date of the latest update is shown at the top of the page. Please review it from time to time.