Privacy and cookies
1. Data controller and contact details
The data controller is Spirit Clubs S.r.l., with its registered office at Via Piacenza 15, 20135 Milano (MI), Italy, tax code and VAT number 09502050967. For information about the processing of personal data or to exercise your rights, you can write to contact@thespirit.it or to our certified email (PEC) address spiritclubs@pec.it.
2. Scope of this notice
This notice covers visits to www.thespirit.it and its menus, as well as enquiries, bookings and requests for catering or event quotations sent through the contact details provided on the website. You do not need to register to browse the website.
The membership section describes the venue’s programme and does not contain an online registration form. This page does not cover the management of membership; please refer to the privacy notice provided when membership data is collected.
3. Data, purposes and legal bases
| Processing | Purpose and legal basis |
|---|---|
| Technical browsing data: IP address, requested resources, time, request outcome and technical information transmitted by the browser, to the extent actually collected by the hosting service. | Providing the website and protecting its security and operation: the controller’s legitimate interests, Article 6(1)(f) GDPR. |
| Name, contact details, message content and information needed to handle a request, voluntarily provided by email, telephone or WhatsApp. | Responding, arranging bookings and preparing quotations or requested services: steps prior to entering into a contract or performance of a contract, Article 6(1)(b). For non-contractual enquiries: the legitimate interest in responding, point (f). |
| Data and documents relevant to administrative obligations or the protection of a right, where applicable. | Compliance with legal obligations, Article 6(1)(c); establishing, exercising or defending legal claims, point (f), limited to the data necessary. |
| Data collected by Google Analytics 4 after consent: pages visited, browser technical data, analytics cookie identifiers and clicks on WhatsApp links. | Measuring traffic and interest in bookings: optional consent, Article 6(1)(a) GDPR. Refusal does not limit access to the website. |
Providing contact details is optional; without the necessary information, we may be unable to respond to or handle your request. Contact details collected through the website are not intended for use in automated promotional campaigns. Any subsequent marketing activities require separate arrangements.
For routine enquiries, please do not send identity documents, payment details or unnecessary health information.
4. Cookies and loaded resources
The website uses Google Analytics 4 (Google Ireland Limited) to measure page visits and clicks on booking links. The service and its analytics cookies load only after you choose “Accept”. Your choice is stored in the browser for six months. The website does not use Google Analytics for advertising or profiling.
Photos, videos, PDFs and fonts are hosted within the website’s hosting space. The WhatsApp and Maps buttons are external links: these services open when you choose to follow them. No maps, messaging widgets or videos from other platforms are embedded. The events calendar is updated server-side from a shared Google Calendar: the visitor’s browser communicates only with The Spirit website and does not load Google Calendar resources directly.
You can reject analytics cookies in the banner and continue using the website. You can change your choice at any time using the “Review cookie choices” button in the footer of every page. After withdrawal, no further measurements are sent, and the website attempts to remove first-party analytics cookies. For more information about Google’s processing, see Google’s privacy policy.
5. Recipients, hosting and external services
Data is processed by authorised personnel and providers supporting the operation of the website, email and requested services, within their respective roles and under the applicable agreements. Optional analytics use Google Ireland Limited; processing may involve transfers outside the European Economic Area under the safeguards described by Google. Website hosting and company email are provided through Aruba services. Data may also be disclosed to parties entitled to receive it under the law or an order from a competent authority. Personal data received in enquiries is not intended for public disclosure.
6. Retention
WhatsApp chats. Conversations are kept for as long as needed to handle the enquiry, booking or service. The company reviews chats every six months, deleting those relating to completed enquiries and services that are no longer necessary. Conversations still needed to manage an ongoing relationship are reviewed again at the next check. Any information retained to meet legal obligations or to establish, exercise or defend a legal claim is limited to what is relevant and necessary for those purposes.
Email. Enquiries that are solely requests for information are deleted when the enquiry is closed. Communications needed to manage outstanding bookings or services are retained until that process is complete. Documentation required for administrative obligations or disputes is kept separately, limited to relevant data and for the period required by the applicable obligation or the protection of the right concerned.
Google Analytics. Event data is retained according to the Analytics property’s retention settings; you can ask the controller for the applicable period. The analytics cookie preference is stored in the browser for six months.
Technical hosting logs. The hosting service may record technical data relating to access and security. The actual retention period applied to our service is being verified with the provider. For information about this processing, you can contact us at contact@thespirit.it.
7. Your rights
In the cases and within the limits provided by the GDPR, you may request access, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
Requests can be sent to the controller’s contact details above. Any identity verification must be limited to what is necessary. The website does not include profiling systems or automated decision-making with legal effects on users.