Privacy Policy for the Processing of Personal Data Pursuant to Art. 13 of EU Regulation 2016/679 (GDPR)
This Privacy Policy describes how the personal data of users (hereinafter, the “Data Subjects”) who use the WE LOVE SICILY mobile App—managed by INDUSTRIA01 S.r.l. Società Benefit—as well as its related services, including the sale of physical products of Sicilian excellence, is processed.
This information notice is provided pursuant to Art. 13 of EU Regulation 2016/679 (GDPR) and applicable national legislation (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

1. Data Controller
The Data Controller of the personal data is INDUSTRIA01 S.r.l. – Società Benefit, with registered office in Tremestrieri Etneo (CT), Via Trinacria 34, VAT no. IT04847380872, in the person of its pro-tempore legal representative, e-mail: [email protected] (hereinafter, the “Data Controller” or “We Love Sicily”).
The Data Controller processes personal data in compliance with current legislation on personal data protection, in particular EU Regulation 2016/679 (“GDPR”) and applicable national legislation.

2. Types of Data Processed
2.1 Navigation and App Usage Data
During the use of the App, certain personal data is automatically collected, such as:
  • IP address;
  • Device identifiers;
  • Operating system and version;
  • Access logs;
  • Technical data related to the use of the App;
  • Anonymous statistical data on the use of functionalities.
This data is used exclusively for security purposes, the proper functioning of the App, and statistical analysis in an aggregated form.

2.2 Data Voluntarily Provided by the User
The user may voluntarily provide:
  • Identification data (first name, last name);
  • Contact data (e-mail, phone number);
  • Billing data;
  • Data necessary for the purchase and shipping of physical products;
  • Any data included in customer support requests;
  • Data relating to the recipients of the purchased products.
2.3 Payment Data
Payment data is processed directly by the payment service providers (e.g., credit cards, wallets, electronic payment providers). The Data Controller does not become aware of, nor does it store, the full data of the payment instruments used by the user.

2.4 Cookies and Tracking Tools
The App uses technical cookies and similar tracking tools as indicated in the dedicated Cookie Policy, available within the App and on the Data Controller’s website.

3. Purposes of Processing and Legal Bases
Personal data is processed for the following purposes:
  • a) Provision of App services
    • User registration;
    • Account management;
    • Access to App content and features;
    • Purchase and shipping of physical products.
    • Legal basis: Performance of a contract or pre-contractual measures (Art. 6, par. 1, lit. b GDPR).
  • b) Legal obligations
    • Tax, accounting, and administrative obligations;
    • Responding to requests from Authorities.
    • Legal basis: Legal obligation (Art. 6, par. 1, lit. c GDPR).
  • c) Payment management
    • To enable the processing of payments through certified third-party providers (PSP).
    • Legal basis: Performance of the contract (Art. 6, par. 1, lit. b GDPR).
  • d) Customer support
    • Management of support requests, returns, refunds, and complaints.
    • Legal basis: Performance of the contract and legitimate interest (Art. 6, par. 1, lit. b and f GDPR).
  • e) Newsletters and promotional communications
    • Sending promotional communications about the Data Controller’s products and news.
    • Legal basis: Consent (Art. 6, par. 1, lit. a GDPR).
  • f) Marketing
    • Sending promotional communications from We Love Sicily.
    • Legal basis: Express consent (Art. 6, par. 1, lit. a GDPR).
  • g) IT security and protection of rights
    • Prevention of fraud and unauthorized access; legal defense.
    • Legal basis: Legitimate interest (Art. 6, par. 1, lit. f GDPR).
4. Provision of Data
The provision of data for the purposes referred to in letters a), b), c), and d) is mandatory for the performance of the contract and for compliance with legal obligations. Failure to provide it will make it impossible to register on the App, make purchases, or receive assistance.
The provision of data for marketing purposes (letters e) and f)) is optional and subject to the express consent of the user, which can be revoked at any time without affecting the lawfulness of the processing carried out prior to revocation.

5. Methods of Processing
The processing will be carried out using both manual and/or computer and electronic tools, with organizational and processing logics strictly related to the purposes themselves and, in any case, in such a way as to guarantee the security, integrity, and confidentiality of the data in compliance with the organizational, physical, and logical measures provided for by current regulations.
The processing operations to which the data is subject are defined in Art. 4, no. 2) of EU Reg. 2016/679: collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, and destruction of data.
“Personal Data” means any information relating to an identified or identifiable natural person, with particular reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, mental, economic, cultural, or social identity.
The Data Controller does not adopt automated decision-making processes that produce significant legal effects on the user.

6. Data Retention
  • Contractual and tax data (orders, invoices): 10 years from the transaction.
  • Active user account data: For the entire duration of the relationship + 12 months from account closure.
  • Data for customer support purposes: 3 years from the resolution of the request.
  • Data for marketing purposes: Until consent is revoked.
  • Technical navigation and log data: Maximum 12 months.
  • Data for legal protection purposes: For the time necessary to defend rights.
Once the applicable retention period has expired, the data will be deleted or definitively anonymized.

7. Data Recipients
Your Personal Data may be shared, for the purposes specified above, with:
  • Subjects acting on behalf of the Data Controller who provide services for the proper functionality of the App, typically acting as Data Processors (e.g., hosting providers, system administrators, CRM platforms);
  • Couriers and shipping agents for the delivery of purchased products, limited to the data necessary for shipping (name, delivery address, phone number);
  • Payment Service Providers (PSPs) for transaction processing, operating as independent Data Controllers;
  • Persons authorized to process Personal Data who have committed themselves to confidentiality or have an appropriate legal obligation of confidentiality;
  • Professional firms, as well as banking institutions and subjects involved in the execution of contractually offered services;
  • Third parties to whom there is an obligation of communication for legal or regulatory reasons, or because they are involved in the process of executing the services provided;
  • Authorities, including judicial authorities, in the exercise of their functions when required by applicable law.
8. Third-Party Partners and Products Sold Through the App
The We Love Sicily App promotes and sells physical products from Sicilian producers and artisans (the “Partners”). The contractual sales relationship exists exclusively between the user and Industria01: Partners are not a party to the sales contract and do not establish direct relationships with the final user.
The data strictly necessary for shipping orders (name, delivery address) is transmitted to the Partner who physically fulfills the order, exclusively for that purpose. Partners are designated as Data Processors pursuant to Art. 28 GDPR and are contractually bound not to use the data for their own purposes.
Payment data is never transmitted to Partners.

9. Data Transfer Outside the EU
Any transfers to countries outside the EU will take place in compliance with Articles 44 et seq. of the GDPR, through adequacy decisions of the European Commission, Standard Contractual Clauses (SCCs), or other appropriate safeguards provided for by the GDPR.

10. Profiling
WE LOVE SICILY does not carry out activities requiring automated profiling of personal data and does not use, either directly or indirectly, automated tools that generate such classifications pursuant to Art. 22 GDPR.

11. Rights of the Data Subject
Users may exercise certain rights with reference to the Data processed by the Data Controller.
In particular, the User has the right to:
  • Withdraw consent at any time. The User can withdraw previously expressed consent to the processing of their Personal Data.
  • Object to the processing of their Data. The User can object to the processing of their Data when it occurs on a legal basis other than consent, including direct marketing.
  • Access their Data. The User has the right to obtain information on the Data processed by the Data Controller, on certain aspects of the processing, and to receive a copy of the processed Data.
  • Verify and request rectification. The User can verify the accuracy of their Data and request its update or correction.
  • Obtain the restriction of processing. When certain conditions are met, the User can request the restriction of the processing of their Data.
  • Obtain the erasure or removal of their Personal Data. When certain conditions are met, the User can request the erasure of their Data by the Data Controller.
  • Receive their Data or have it transferred to another controller. The User has the right to receive their Data in a structured, commonly used, and machine-readable format and, where technically feasible, to obtain its transfer without hindrance to another controller.
  • Lodge a complaint with the competent personal data protection supervisory authority (www.garanteprivacy.it) or take judicial action.
The above rights may be exercised against INDUSTRIA01, as Data Controller, by writing to the e-mail address: [email protected]

12. Minors
The App’s services are not intended for minors under 18 years of age. The Data Controller does not knowingly collect personal data of minors. If a minor has provided personal data without the consent of a parent or legal guardian, they may request its deletion by writing to the address indicated in point 1.

13. Use of the App on iOS and Android
The WE LOVE SICILY App is distributed through the Apple App Store and Google Play Store platforms. Downloading the App may involve the communication of personal data to the respective platform managers, who act as independent data controllers according to their respective privacy policies:
The Data Controller is not responsible for processing carried out independently by Apple and Google.

Device Permissions
The App may request the following optional permissions:
  • Access to the camera for sending content (e.g., photos for product reviews);
  • Access to push notifications.
These permissions can be managed and revoked directly from the device settings.

Push Notifications
Subject to the user’s consent, the App may send push notifications for:
  • Confirmation and updates on order status;
  • Service communications related to purchases;
  • Promotions and commercial communications (only with prior marketing consent).
Consent can be revoked at any time from the device settings or from the App.

In-App Purchases
Purchases made through the App are managed by Industria01 through certified third-party payment providers. The Data Controller does not process full payment card data. For payments managed through the native features of Apple Pay or Google Pay, please refer to the respective privacy policies of Apple Inc. and Google LLC.

SDK and Analytics Tools
The App may integrate third-party SDKs for technical functions and anonymous statistics. These tools operate in compliance with the GDPR and process data in an anonymous or pseudonymized form.

14. Changes to the Privacy Policy
The Data Controller reserves the right to modify this Privacy Policy at any time to adapt it to regulatory, technological, or operational changes. Changes will be communicated through the App or official stores, indicating the date of entry into force.
The version currently in force can be consulted at any time within the App, in the “Privacy Policy” section, and at the address welovesicily.it/en/privacy-policy/

INDUSTRIA01 S.R.L. – Società Benefit | Via Trinacria 34 – Tremestrieri Etneo (CT) | VAT ID IT04847380872

Privacy Policy We Love Sicily – Version 1.0 – 9th July 2026