Last revised: 13 October 2026

The purpose of this document is to inform the natural person (hereinafter “Data subject”) concerning the processing of your personal data (hereafter “Personal Data”) collected by the controller, ToBePolo S.r.l., with registered office at Via Campasso 65, 46043 Castiglione delle Stiviere, tax code / VAT number 02784100204, email info@tobepolo.com (hereinafter “Controller”), via the website www.tobepolo.com (hereinafter “Application”).

Changes and updates will be binding as soon as published on the Application. In the event of non-acceptance, the Data Subject shall cease using the Application and may request the deletion of its Personal Data.

---

1. Categories of Personal Data processed

The Data Controller processes the following Data provided voluntarily by the Data Subject:

• Contact details: name, surname, address, e-mail, phone, images, authentication credentials.
• Tax and payment data: tax code, VAT number, credit card details, bank account details.
• Professionals’ data: date of birth, address of residence or registered office, tax regime, Companies Register number, IBAN and identity document, which are needed for payments, for mandatory tax reporting and to verify identity.
• Messages to AI Colombo: the texts and, if you use them, voice messages and spoken conversations.

The following are also collected automatically:

• Technical data: IP addresses, browser type, device information, Internet provider (ISP).
• Browsing data: pages visited, number of clicks, actions completed, duration of sessions.

If Data required by law or by contract are not provided, the relationship cannot be established or continued.

2. Cookies and similar technologies

The Application uses cookies and unique identifiers to collect Data about the actions performed by the Data Subject. They are stored so that they can be sent back on the next visit.

3. Legal basis and purposes of processing

Processing is necessary:

1. To perform the contract: performance of contractual obligations, registration, authentication and payment management.
2. To comply with a legal obligation: compliance with applicable laws, in particular on tax matters. For professionals, every year by 31 January we report to the Italian Revenue Agency (Agenzia delle Entrate) their name, address, tax code, VAT number, date of birth, Companies Register number, IBAN, amounts collected, fees withheld and number of crafts and experiences in each quarter, as required by the DAC7 rules (Legislative Decree No. 32 of 1 March 2023 and, from 1 January 2027, Articles 210–226 of Legislative Decree No. 141 of 5 August 2026), and we send a copy to the professional.
3. On the basis of legitimate interest: statistical analysis of anonymous, aggregated data to improve the services, and protection of rights in court.

4. How data is processed and who receives it

Processing is carried out with paper and electronic tools and with adequate security measures. The Data are processed only by:

• Persons authorized by the Data Controller and bound to confidentiality.
• Necessary external parties (business partners, consultants, IT companies, hosting providers) appointed as Data Processors.
• Bodies or authorities, for legal obligations.

Personal Data will not be disclosed indiscriminately.

For some functions we use external providers, which process the Data only for that purpose:

• AI Colombo, the assistant that recommends experiences, is an artificial intelligence. It can be used after accepting its terms of use with the checkbox at sign-up. What the Data Subject writes to Colombo, and the text of their voice messages, is processed by OpenRouter, Inc. (United States), our artificial intelligence service provider, and by the computing providers it uses. Voice messages are transcribed on our own server, which deletes the audio right after: OpenRouter only receives the text. The answers are read aloud by a synthetic voice from OpenAI (United States): OpenRouter passes it only the text of Colombo’s answer, never the Data Subject’s audio. When that voice is not available, the answers are read by our own server. Beyond the usage limits of the voice, Colombo answers in writing only. The spoken conversation with Colombo works in turns: the Data Subject’s voice is handled only on our own server. Please do not say or write personal data. The conversation is not used to build a profile.
• The support chat «Speak with the team» uses Intercom (Intercom R&D Unlimited Company, Ireland) to deliver messages to the team of ToBePolo.
• Payments are handled by Stripe: you can pay by card, Apple Pay, Google Pay or Klarna. Stripe and the service you choose to pay with receive the data needed for the payment. ToBePolo does not store card numbers.
• The banks that process payments on Stripe’s behalf are listed in Stripe’s acquirer disclosure. Stripe processes your personal data under its privacy policy.
• Phone notifications go through Apple’s service (iPhone) or Google’s (Android).

5. Location

We process Personal Data mainly in the European Economic Area (EEA). Some of the providers listed in section 4 may also process them outside the EEA, in particular in the United States. In those cases the transfer takes place only with the safeguards set out in Articles 45 and 46 of Regulation (EU) 2016/679: an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for the providers that have joined it, or the standard contractual clauses approved by the Commission. You can ask for a copy of the safeguards at info@tobepolo.com.

6. Data retention period

The Data will be kept for as long as needed for the stated purposes:

• Performance of the contract: for the duration of the relationship and for the following 10 years (ordinary limitation period).
• Legal obligations and protection of rights: for the periods required by the law in force.
• Consent: until the Data Subject withdraws it.
• Data for DAC7 reporting: until 31 December of the fifth year after the year of the report.

At the end of that period, the Data will be deleted or anonymised.

7. Rights of the data subject

The data subject may exercise the following rights:

• Access, verification and rectification of your Data.
• Withdrawal of consent at any time.
• Objection to or restriction of processing.
• Erasure of your Data (right to be forgotten).
• Portability of the Data to another controller.
• Lodging a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

To exercise these rights, you can write to: info@tobepolo.com. Requests will be processed within 30 days.

8. Deleting your account and Personal Data

You can delete your ToBePolo account yourself, at any time, from the site and the apps: sign in, open My account and choose Delete account (direct address: tobepolo.com/mio-account/wpf-delete-account/). Deleting the account removes your profile, contact details, uploaded photos and videos, messages and preferences. Only the tax and accounting documents for the purchases made (invoices and receipts, 10 years) and the data needed to handle any disputes are kept, for the time required by law. If you prefer, you can ask us to delete your account or individual data by writing to info@tobepolo.com from your registered email address: we reply within 30 days. Accounts of professionals with upcoming bookings cannot be deleted until the booked experiences have taken place or been refunded.

9. Professionals’ identity documents

To verify professionals’ identity, award the “verified” badge and open their payment account, we ask for an identity document, front and back. The document is examined only by the ToBePolo staff in charge of verification and by Stripe (Stripe Payments Europe, Limited, Ireland), which is required by law to verify the identity of the account holder; it is not shown to other users and is not used for any other purpose. ToBePolo keeps it outside the public area of the site for as long as the verification requires and deletes it automatically within 30 days of the outcome; Stripe keeps it in accordance with its own privacy policy. Legal basis: performance of the contract with the professional, legal obligations of Stripe and ToBePolo’s legitimate interest in preventing fraud and fake profiles.