Privacy Policy

Last updated: 2 October 2026

This Privacy Policy explains how we process personal data of visitors, prospects and customers of the website, in accordance with Regulation (EU) 2016/679 (the "GDPR") and Italian Legislative Decree 196/2003 (Personal Data Protection Code) as amended by Legislative Decree 101/2018.

1. Data controller

COLINE di Agheorghiesei Alexandra (sole proprietorship / ditta individuale), trading as Best Luxury Events
Registered office: Via Medaglie d'Oro 70, 48018 Faenza (RA), Italy
VAT no. (P.IVA): IT 02748550395 · Tax code: GHRLND03E44Z140Q · [REA no.: RA-______ / Companies Register, if applicable]
Email: [email protected] · Phone/WhatsApp: +39 327 440 5035
Website: https://bestluxuryevents.com

We have not appointed a Data Protection Officer, as we are not required to. For any privacy request write to the email address above.

2. Personal data we process

  • Contact and enquiry data: first name, last name, email, phone number, preferred language, information about your wedding (date, destination, number of guests, budget, style and preferences) and any message you send us.
  • Booking data: date and time of consultations booked through the calendar and the information entered in the booking form.
  • Purchase and billing data: name, address, tax code or VAT number where required, products purchased, amount and payment status. Card data are handled directly by Stripe; we never receive the full card number.
  • Members area data: login credentials, access logs and use of digital content.
  • Quiz answers you give in our online quizzes.
  • AI chat messages exchanged with our AI assistant "Roberta".
  • Marketing preferences: your consent (or refusal) to receive newsletters, and email interaction data (opens, clicks), if you have consented.
  • Technical data: IP address, browser type, device, and cookies or similar technologies as described in our Cookie Policy.

Special categories of data. We do not ask for data revealing health, religious beliefs or other special categories (art. 9 GDPR). If, for the planning of your wedding, you choose to share such information (for example, the type of religious ceremony, or dietary or accessibility needs of you or your guests), we will process it only with your explicit consent (art. 9(2)(a) GDPR) and only to provide the requested service. If you share data about guests or other third parties, please make sure you are entitled to do so and inform them.

3. Purposes and legal bases

  • Answering enquiries, booking consultations and preparing quotes – steps taken at your request prior to entering into a contract (art. 6(1)(b) GDPR).
  • Delivering free resources and quiz results you request – performance of the agreement under which you receive the resource (art. 6(1)(b) GDPR).
  • Selling and delivering digital content and services, managing the members area, payments and customer support – performance of a contract (art. 6(1)(b) GDPR).
  • Complying with tax, accounting and other legal obligations (e.g. invoicing and record-keeping) – legal obligation (art. 6(1)(c) GDPR).
  • Sending newsletters, resources and commercial offers by email – your consent (art. 6(1)(a) GDPR and art. 130 Privacy Code), given through a separate, optional checkbox. Refusing has no effect on purchases or free resources. [OWNER TO CONFIRM whether to use the "soft spam" rule: "If you are a customer, we may send you emails about products and services similar to those you purchased, on the basis of our legitimate interest (art. 130(4) Privacy Code), unless you object; you can object at any time, also via the link in each email."]
  • Operating the AI assistant to answer your questions and help you book a consultation – our legitimate interest in providing quick information to visitors (art. 6(1)(f) GDPR) and, where you ask for a quote or booking, steps prior to a contract (art. 6(1)(b) GDPR).
  • Personalising suggestions based on quiz answers and preferences for marketing purposes – your consent (art. 6(1)(a) GDPR).
  • Analytics and advertising cookies (if introduced in future) – your consent (art. 6(1)(a) GDPR and art. 122 Privacy Code).
  • Website security, fraud prevention, and establishing, exercising or defending legal claims – our legitimate interest (art. 6(1)(f) GDPR).

Providing data marked as required in forms is necessary to answer you or perform the contract; without it we cannot provide the service. Other data are optional. We do not carry out automated decision-making producing legal or similarly significant effects on you (art. 22 GDPR).

4. Retention periods

  • Enquiries, bookings and quotes that do not lead to a contract: [24] months from the last contact.
  • Contract, billing and accounting data: 10 years from the end of the relevant year (art. 2220 Italian Civil Code and tax rules), and in any case for the limitation period of any claims.
  • Members area account: for the duration of access to the content, then [12] months, unless you ask for earlier deletion compatible with legal obligations.
  • Marketing data: until you withdraw your consent or unsubscribe; contacts inactive for [24] months may be deleted.
  • AI chat messages: [90 days] in our systems, unless they become part of an enquiry or booking, in which case the enquiry retention applies.
  • Cookies: as indicated in the Cookie Policy.

At the end of these periods data are deleted or anonymised.

5. Recipients and processors

Data are processed by the owner and by authorised persons bound to confidentiality. We use the following service providers, appointed as data processors under art. 28 GDPR where they process data on our behalf:

  • HighLevel Inc. / LeadConnector (USA) – CRM, website, forms, booking calendar, email sending and members area;
  • Stripe (Stripe Payments Europe Ltd., Ireland, and affiliates) – payment processing; for certain activities (e.g. fraud prevention and regulatory compliance) Stripe acts as an independent controller;
  • Zoom Communications Inc. (USA) – online consultations;
  • Netlify Inc. (USA) – hosting of the AI assistant;
  • Anthropic (Anthropic PBC, USA, and/or its EU affiliate) – AI model that generates the assistant's replies;
  • Google (Google Ireland Ltd. / Google LLC) – delivery of web fonts (Google Fonts), which involves the transmission of your IP address to Google [OWNER: consider self-hosting fonts to avoid this transfer];
  • in future, only with your consent: Meta Platforms Ireland Ltd. (Meta Pixel) and Google (Google Analytics).

Data may also be disclosed to our accountant and tax advisors, to the Italian Revenue Agency (electronic invoicing system), to banks, to public authorities where required by law and, if you ask us to do so as part of a service, to venues and suppliers involved in your event. We never sell your personal data.

6. Transfers outside the European Economic Area

Some providers are established in the United States or may access data from there. Transfers take place on the basis of the European Commission adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for providers certified under it, and/or the Standard Contractual Clauses approved by Commission Decision (EU) 2021/914, with additional measures where appropriate (art. 45-46 GDPR). You may request information on the safeguards in place by writing to us.

7. Your rights

You have the right to: access your data; obtain rectification; obtain erasure; restrict processing; data portability; object at any time to processing based on legitimate interest and, without any justification, to direct marketing; and withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal (articles 15-22 and 7(3) GDPR). You can unsubscribe from emails using the link in each message.

To exercise your rights, write to [email protected]. We will reply within one month, extendable in the cases provided by art. 12 GDPR.

You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU Member State where you live or work, or where the alleged infringement took place (art. 77 GDPR).

8. Minors

Our services are intended for adults. We do not knowingly collect data of persons under 18. Under Italian law, minors under 14 cannot give valid consent to information society services (art. 2-quinquies Privacy Code) and may use AI systems only with the consent of those exercising parental responsibility (art. 4 Law 132/2025). If you believe a minor has provided us with data, please contact us and we will delete them.

9. AI chat

Messages you write to our AI assistant "Roberta" are sent, through our server hosted by Netlify, to Anthropic, which processes them as our processor solely to generate the reply. Please do not share sensitive data (health, religion, financial or identity documents) in the chat. More information is available in our AI Policy.

10. Security

We adopt appropriate technical and organisational measures to protect your data (encrypted connections, access control, providers with recognised security certifications). No transmission over the internet is completely secure, but we work to reduce risks and will notify data breaches where required by arts. 33-34 GDPR.

11. Changes

We may update this Policy. The current version is always available on this page with its update date. Where changes are significant, we will inform you by appropriate means.