Last updated: 8 September 2026

This privacy notice describes how Auge Experience S.r.l. processes the personal data of users who visit the website, who get in touch with the company or who have commercial and professional dealings with it, pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and of Italian Legislative Decree no. 196/2003, as amended by Legislative Decree no. 101/2018 (the “Italian Privacy Code”).

This notice covers only the processing carried out by Auge Experience S.r.l. and does not extend to third-party websites, pages or services that may be reached through links.

The Data Controller is:

AUGE EXPERIENCE S.R.L.

Viale Gran Sasso 35 - 20131 Milan (MI), Italy
Italian Tax Code and VAT number: 14298400962
EU VAT number: IT14298400962
Registered with the Milan Companies Register - REA no. MI 2772748
Share capital: € 10,000.00
Certified e-mail (PEC): augeexperiencesrl@pec.it
E-mail for privacy matters and for exercising your rights: info@auge-xp.com

The Data Controller has not appointed a Data Protection Officer (DPO), as the conditions set out in Article 37 of the GDPR do not apply. Any request concerning the protection of personal data may be sent to the contact details indicated above.

Depending on the type of relationship and on the features used, Auge Experience S.r.l. may process:

- identification and contact data: first name, last name, company name, job role, address, e-mail address, telephone number;

- data relating to enquiries sent on the user's own initiative, by e-mail, telephone or social media channels, including the content of the communication. The website does not host any contact forms: contact takes place solely through the link to the published e-mail address, which opens the user's own mail application without any data passing through the website;

- data concerning clients, prospective clients and suppliers that is necessary to manage the relationship: contractual, administrative, tax, banking and invoicing data;

- technical and browsing data necessary for the operation and security of the website: IP address, browser and device type, operating system, URIs of the resources requested, time of the request, server response status code, technical logs and session data;

- data on the use of the website collected through cookies or equivalent tools, as set out in the Cookie Policy;

- data disclosed to the providers of the video content featured on the website's pages, consisting of the IP address and technical information about the device, subject to the distinctions described in section 9.

Users are asked not to enter unnecessary personal data in free-text fields, messages or documents sent to the company and, in particular, not to include special categories of personal data within the meaning of Article 9 of the GDPR (data concerning health, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation, biometric or genetic data), unless this is strictly necessary and compliant with applicable law.

a) Responding to requests for information and to business enquiries

Handling enquiries received by e-mail, telephone or other contact channels, sending quotations and proposals, and carrying out the steps preliminary to entering into a contract. Legal basis: taking steps at the data subject's request prior to entering into a contract (Article 6(1)(b) GDPR).

b) Provision of services and management of the contractual relationship

Conceiving, planning and delivering advertising campaigns and communication activities, managing projects, coordinating with suppliers, and providing client support. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

c) Administrative, accounting, tax and statutory obligations

Issuing and storing invoices, bookkeeping, tax compliance, document retention obligations, and responding to requests from public authorities. Legal basis: compliance with a legal obligation to which the Data Controller is subject (Article 6(1)(c) GDPR).

d) Website security and protection of rights

Ensuring the proper functioning and security of the systems, preventing abuse and fraud, diagnosing malfunctions, establishing liability in the event of computer-related offences, and establishing, exercising or defending a right in or out of court. Legal basis: the legitimate interests pursued by the Data Controller (Article 6(1)(f) GDPR).

e) Statistics and measurement of website visits

Analysing use of the website through Google Analytics 4, implemented by means of the Google tag (gtag.js), in order to ascertain the number of visitors, the pages viewed, the source of traffic and browsing behaviour in aggregate form, and thereby to improve the content and structure of the website. Legal basis: the data subject's consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code). The tool is activated only after the user has made an express choice through the consent management banner, and consent may be withdrawn at any time.

f) Playback of video content

Loading and playing the videos featured on the website's pages.

For videos embedded by means of an external player (YouTube), loading entails the disclosure to the provider of the user's IP address and of information about the device, as well as the possible setting of cookies by that provider. Legal basis: the data subject's consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code). The player is not loaded until the user gives consent through the banner.

For videos played directly on the website using the browser's native player, the only operation performed is the request for the video file from the server hosting it, which receives the user's IP address: no cookies are set and no information is stored on the user's device. Legal basis: carrying out the user's request to view the content, and the legitimate interest of the Data Controller in delivering the website's content efficiently (Article 6(1)(b) and (f) GDPR).

g) Collection and retention of evidence of cookie consent

Obtaining, recording and retaining the preferences expressed by the user in relation to cookies, by means of the Cookiebot platform, in order to demonstrate compliance with legal obligations. Legal basis: compliance with legal obligations and the legitimate interest in documenting the lawfulness of the processing (Article 6(1)(c) and (f) GDPR); the operation of the consent collection system falls among the technically necessary tools.

Providing the data indicated as necessary is essential in order to act on a request or to perform the relationship: failure to provide such data may make it impossible to reply to an enquiry, to prepare a quotation, to enter into or perform the contract, or to issue an invoice.

Giving consent for statistical purposes and for external video players is, by contrast, entirely optional: refusal has no consequences for access to the website or for any ongoing relationship, save that embedded videos cannot be played within the pages themselves, although they remain accessible on the respective platforms.

In carrying out its business of devising and managing advertising campaigns, Auge Experience S.r.l. may process personal data relating to third parties (for example business contacts, recipients of communications, users of advertising platforms, or participants in promotional initiatives) made available by the client or collected on the client's behalf.

In such cases, the data protection role is determined by the actual nature of the processing and by the applicable agreements. Where Auge Experience S.r.l. processes such data on behalf of the client, it acts as data processor within the meaning of Article 28 of the GDPR, under a dedicated agreement (a Data Processing Agreement) setting out the subject matter, duration, purposes, instructions and security measures of the processing; the client remains the data controller.

The client is accountable for the lawfulness of the data it chooses to transmit or make available, for the existence of an appropriate legal basis and for providing privacy notices to data subjects, and undertakes not to transfer data that is not necessary for the purposes of the project.

Data subjects whose data is processed in this context may exercise their rights against the data controller (the client); any requests received by Auge Experience S.r.l. will be forwarded promptly to the competent controller.

The data may be processed by the Data Controller's authorised staff, collaborators and professional advisers, who act under express instructions pursuant to Article 29 of the GDPR.

To the extent necessary for the purposes set out above, the data may also be disclosed to:

- providers of hosting, cloud infrastructure, website management and maintenance services;

- Google Ireland Limited and Google LLC, for the Google Analytics 4 statistical measurement service and for the YouTube video player, subject to the user's consent;

- Vimeo.com, Inc., as the provider of the infrastructure that hosts and delivers the video files referenced in the website's pages;

- Usercentrics A/S, for the Cookiebot consent management platform;

- providers of e-mail services, document storage and productivity tools;

- e-mail marketing and customer relationship management (CRM) platforms;

- advertising sales houses, media agencies, advertising platforms and social networks, for the planning and activation of campaigns;

- creative and technical suppliers and collaborators involved in projects (production companies, photographers, printers, partner agencies, freelancers);

- banks and payment service providers;

- accounting, tax, employment and legal advisers, auditors and debt collection agencies;

- public authorities, supervisory bodies and any party to which disclosure is required by law, regulation or order of a competent authority.

Parties processing data on behalf of the Data Controller are appointed as data processors pursuant to Article 28 of the GDPR. An up-to-date list of the main processors may be obtained by writing to the contact details given in section 1.

The data is not disseminated to the public, nor transferred to third parties for those third parties' own marketing purposes.

Some technology providers and advertising platforms may involve the processing of personal data outside the European Economic Area.

Any transfers to third countries take place in compliance with Chapter V of the GDPR, on the basis, as the case may be, of adequacy decisions of the European Commission (including the EU-U.S. Data Privacy Framework for recipients certified under it), of Standard Contractual Clauses adopted by the European Commission, or of further safeguards provided for by applicable law, together with supplementary technical and organisational measures where these are necessary.

With specific regard to Google Analytics 4, the data is collected by Google Ireland Limited and may also be processed by Google LLC in the United States. The transfer takes place on the basis of the European Commission's adequacy decision concerning the EU-U.S. Data Privacy Framework, to which Google LLC is certified, as well as of the Standard Contractual Clauses incorporated into Google's data processing terms. The Data Controller has also configured the service so as to limit the data transmitted, in particular by enabling IP address anonymisation and by disabling data sharing with other Google services and personalised advertising features.

As regards video content, loading the YouTube player entails the disclosure of data to Google LLC, whereas requesting the video files hosted on Vimeo entails the disclosure of the IP address alone to Vimeo.com, Inc. and to the content delivery network it uses; both companies are based in the United States. These transfers take place on the basis of the adequacy decision concerning the EU-U.S. Data Privacy Framework, where the recipient is certified under it, and of the Standard Contractual Clauses incorporated into the respective providers' terms.

Website hosting is entrusted to a provider that delivers the service on infrastructure located within the European Economic Area, as is the Cookiebot platform, supplied by an entity established in the European Union, whose consent data is processed within the same territorial scope.

Further information on the safeguards applied may be requested from the Data Controller.

Data is retained for as long as is necessary to achieve the purposes for which it was collected and, thereafter, for the period needed to comply with legal obligations or to protect any rights. In particular:

- Contact enquiries and quotations not followed by a relationship: up to 24 months from the last contact.

- Contractual data of clients and suppliers: for the duration of the relationship and, thereafter, for 10 years from its termination, in line with the ordinary limitation period.

- Administrative, accounting and tax data: 10 years, pursuant to civil law and tax obligations.

- Technical logs and security data: for a period proportionate to the security purposes pursued, as a rule no longer than 12 months, save where the investigation of unlawful acts requires otherwise.

- Cookies and equivalent tools: for the durations set out in the Cookie Policy generated by Cookiebot.

- Google Analytics 4 data: 14 months, corresponding to the retention period configured in the property; the _ga cookies have a maximum lifespan of 24 months.

- Records of cookie consent: 12 months from collection, unless renewed, and in any event for as long as is necessary to demonstrate compliance.

- Cookies set by the external video player: for the durations established by the provider and set out in the Cookie Policy.

- Data processed on the basis of consent: until consent is withdrawn, or for the shorter period laid down for the specific processing activity.

Once the periods indicated have elapsed, the data is deleted or irreversibly anonymised.

The website uses cookies and equivalent technologies. Technical cookies, which are strictly necessary for the operation and security of the website and for storing the choices expressed by the user in relation to consent, are set without the need for consent, pursuant to Article 122 of the Italian Privacy Code.

In addition to these, the website uses the following tools.

Google Analytics 4, implemented by means of the Google tag (gtag.js), for the purpose of statistical measurement of visits. The service sets first-party cookies, including ga and ga_ followed by the property identifier, and sends Google data relating to browsing activity, such as the IP address, pages visited, source of traffic, device and browser. It is activated only with the user's prior consent and is not used for direct marketing, personalised advertising or remarketing purposes.

YouTube video player embedded in certain pages. The player is not loaded before consent is given: until that point, a placeholder is shown in its place and no data is disclosed to the provider. Once consent has been given, Google receives the IP address and information about the device and may set its own cookies, including advertising cookies and cookies attributable to third parties, in accordance with its own terms. Where technically possible, the Data Controller uses the privacy-enhanced playback mode (the youtube-nocookie.com domain), which limits the setting of cookies to cases where the content is actually played.

Videos played through the browser's native player, the files of which are hosted on Vimeo and referenced directly in the pages. This method does not involve the setting of any cookie, does not load third-party scripts and does not allow the provider to link the visit to a persistent identifier: the only operation performed is the request for the file from the server hosting it, which receives the IP address and technical information about the device, as happens with any other resource needed to display a web page. For this reason, such content does not appear in the cookie list and is not subject to consent; the Data Controller has configured the website so that the file is not downloaded until the user starts playback.

The Data Controller does not set advertising profiling cookies for its own purposes, and the website contains no conversion pixels, social network widgets or feeds, nor any tools for sharing data with advertising platforms. The links to social media profiles on the website are plain hyperlinks: they transmit no data to those platforms until the user chooses to follow them and, once followed, the processing is governed by the platforms' own privacy notices.

Consent management

The collection and management of consent is entrusted to the Cookiebot platform, provided by Usercentrics A/S (Denmark), which acts as data processor pursuant to Article 28 of the GDPR. Cookiebot:

- displays the banner on first access and pre-emptively blocks non-necessary cookies and scripts, including the YouTube player, pending any consent;

- records and stores evidence of consent given, refused or withdrawn, linking it to a consent identifier;

- makes available the summary panel through which the user may modify or withdraw their choices at any time.

Cookie Policy

The complete and continuously updated list of the cookies used - stating the name, purpose, category, lifespan and the party setting them - is generated and maintained automatically by Cookiebot through periodic scanning of the website, and may be consulted in the dedicated Cookie Policy section, available at https://auge-xp.com/privacy#cookie-policy and from the consent management banner.

The Cookie Policy forms an integral part of this privacy notice. In the event of any discrepancy between the information set out here and the list generated by the automatic scan, the latter shall prevail, as it reflects the actual configuration of the website.

The Data Controller does not carry out decision-making based solely on automated processing which produces legal effects concerning data subjects or similarly significantly affects them within the meaning of Article 22 of the GDPR.

The Data Controller does not carry out profiling through the website: Google Analytics 4 is used for statistical and aggregate measurement purposes only. The provider of the embedded video player may nonetheless process data for its own purposes, including profiling, in accordance with its own privacy notice, to which reference is made; such processing is in any event conditional upon the user's consent.

In the context of the advertising activities carried out on behalf of clients, by contrast, segmentation and optimisation features made available by advertising platforms may be used: such processing takes place on the instructions of the client, as data controller, and is governed by the privacy notices issued by that client and by the policies of the relevant platforms.

Any automated or artificial intelligence tools used to support creative and analytical work are aids only and do not replace human assessment.

The Data Controller implements technical and organisational measures appropriate to the risk, pursuant to Article 32 of the GDPR, in order to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to such data. These measures include, among others, access control, encryption of communications, backup procedures and the instruction of the persons authorised to process the data.

No computer system can, however, guarantee absolute security.

Within the cases and limits laid down by the GDPR, data subjects have the right to:

- access their personal data and obtain a copy of it (Article 15);

- obtain the rectification of inaccurate data or the completion of incomplete data (Article 16);

- obtain the erasure of their data (Article 17);

- obtain the restriction of processing (Article 18);

- receive their data in a structured, commonly used format and transmit it to another controller (data portability, Article 20);

- object to processing based on legitimate interests and, at any time, to processing for direct marketing purposes (Article 21);

- withdraw their consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3));

- not be subject to a decision based solely on automated processing (Article 22).

Requests may be sent to the contact details given in section 1. The Data Controller will respond without undue delay and, in any event, within one month of receipt of the request, which may be extended by a further two months where the request is complex.

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome - www.garanteprivacy.it), or with the supervisory authority of the Member State of their residence or of the place of the alleged infringement, and to seek a judicial remedy.

The Data Controller's services are not directed at children under the age of sixteen. The Data Controller does not knowingly collect the personal data of children below that age without the consent of the holder of parental responsibility over them. Should any such processing come to light, the data will be erased without delay.

This Privacy Policy may be updated to reflect regulatory, organisational or technical changes, or changes in the services offered. The updated version is published on this page, stating the date it was last updated. In the event of material changes, the Data Controller may provide a specific notification to data subjects, where appropriate.