This notice explains what personal data NTBLDO collects through this website and through the events it organises, why we collect it, how long we keep it and what you can ask us to do about it. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Who is responsible for your data
The data controller is ENTABLADO, trading as NTBLDO, with registered office at [ADDRESS — to be completed], VAT number [VAT — to be completed].
- General enquiries: [EMAIL — to be completed]
We have not appointed a Data Protection Officer. Our processing does not meet any of the conditions in Article 37(1) GDPR that would make one mandatory: we do not carry out large-scale systematic monitoring and we do not process special categories of data on a large scale. Write to the address above for anything concerning your data.
2. What we collect, why, and on what legal basis
2.1 The contact form
When you send a message from the contact page we collect your name and surname, email address, company, the reason for your enquiry, the project name, the message itself, and technically your IP address.
- Purpose: to read your message, reply to it, and keep a record of the exchange.
- Legal basis: your consent, Article 6(1)(a) GDPR. The form asks for it explicitly and does not submit without it. You can withdraw that consent at any time and we will erase the message; withdrawal does not affect anything we did lawfully before it.
- The IP address is separate: we store it on the basis of our legitimate interest in keeping the form from being abused for spam or automated submissions, Article 6(1)(f) GDPR. It is deleted well before the message is.
- Providing the data is voluntary, but without a name, an email address and a message we have no way to answer you.
2.2 Date and slot requests
The booking panel on the contact page lets you ask us to hold a production date. It records your name, email address, the date and time you asked for, and the type of request. That request appears on our internal production calendar as pending until someone confirms or declines it.
- Legal basis: Article 6(1)(b) GDPR, steps taken at your request before entering into a contract.
2.3 If you attend one of our events
NTBLDO is the organiser of the events published on this site. Tickets are sold through authorised ticketing platforms which act in our name and on our behalf: the platform handles the transaction, but the contract for admission to the event is between you and NTBLDO. We therefore receive from the platform the data needed to run the event, typically name, surname, email address, ticket type and order reference, and where the law requires named tickets, the identification details printed on them.
- Purpose and legal basis: performing the admission contract and managing access, refunds and communications about the event, Article 6(1)(b) GDPR.
- Named tickets: where an event exceeds the capacity threshold set by Italian law, tickets must carry the attendee's name and surname and be checked against an identity document at the door. We process those details to comply with a legal obligation, Article 6(1)(c) GDPR.
- Accounting and tax records arising from ticket sales are kept under Article 6(1)(c) GDPR.
- The ticketing platform is a separate controller for its own presale service and its account system. Its own privacy notice governs that part and is linked from the checkout page you are sent to.
2.4 Photography and filming at events
We photograph and film our shows, and audience shots are part of that. Images in which individuals are recognisable but are not the subject of the shot are used to document and promote our productions on the basis of our legitimate interest, Article 6(1)(f) GDPR. You can object at any time under Article 21 GDPR, and where an image singles you out we ask for your consent before publishing it.
2.5 Running the website
Our hosting provider keeps standard server logs (IP address, date and time, pages requested, browser type) for security and diagnostics, on the basis of our legitimate interest under Article 6(1)(f) GDPR. The site sets two strictly necessary cookies and no others. See the Cookie Policy.
2.6 The team area
The /team section is for NTBLDO staff and collaborators. It is protected by a shared passcode stored only as a bcrypt hash, and it is excluded from search engines. It carries no personal data beyond what is described above.
3. Who else sees your data
We do not sell your data and we do not share it for anyone else's marketing. It is accessible to:
- our hosting provider, which stores the site and its database, acting as a processor under Article 28 GDPR;
- our email provider, which delivers the notification of your message to our inbox;
- ticketing platforms, for events, as described in 2.3;
- venues, security staff and production partners, strictly where an event cannot otherwise be run, for example an accessibility request passed on to the venue;
- accountants and lawyers, and public authorities where we are legally required to disclose.
4. Data leaving the European Economic Area
Loading a page from this site sends nothing to anyone but our server. Typefaces, stylesheets and the one JavaScript library the site uses are all served from here rather than from external providers, so simply reading these pages transfers no data anywhere.
Our own storage of your data, meaning the database and the mailbox, is within the European Economic Area.
A transfer outside the EEA can still arise from the recipients in section 3 — most obviously the ticketing platform you are sent to when you buy a ticket, which is a separate controller with its own notice. Where such a transfer happens it rests on the European Commission's adequacy decision for the EU–US Data Privacy Framework or on Standard Contractual Clauses.
5. How long we keep it
| Data | Kept for |
|---|---|
| Contact form messages | 24 months from the last exchange, then deleted |
| IP address attached to a message | 12 months, then cleared from the record |
| Date requests that were declined or never confirmed | 12 months, then deleted |
| Confirmed production dates | For as long as the production is live, then as part of our project records |
| Attendee data for an event | Until the event has taken place and any refund or dispute window has closed |
| Accounting records | 10 years, as required by Article 2220 of the Italian Civil Code |
| Server logs | Our hosting provider's standard retention, no longer than 12 months |
These periods are enforced automatically rather than by hand: a scheduled task deletes expired records.
6. Your rights
Under Articles 15 to 22 GDPR you may ask us to give you access to your data, to correct it, to erase it, to restrict how we use it, and to hand it to you or to another controller in a portable format. You may object to processing we base on legitimate interest. Where we rely on your consent you may withdraw it at any time.
Write to [EMAIL — to be completed]. We answer within one month, extendable by two further months for complex requests, as Article 12(3) GDPR allows. There is no charge unless a request is manifestly unfounded or excessive.
If you believe we have handled your data badly you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it, or to the authority in the country where you live. You can also bring the matter to court.
7. Automated decisions
We take no decisions about you by automated means and we do not profile you. Article 22 GDPR does not come into play here.
8. Security
The site is served over HTTPS. The team area sits behind a passcode stored only as a hash, rate-limited to five attempts per minute per IP address. Public forms are rate-limited against automated abuse. Uploads are checked by actual file type rather than by file extension.
9. Changes to this notice
If we change how we handle personal data we update this page and move the date at the top. Where a change materially affects you and we hold your contact details, we tell you directly.