Privacy Policy
Information on the processing of personal data pursuant to art. 13 of EU Reg. 2016/679 (GDPR)
Last updated: 28 July 2026
Courtesy translation — in case of discrepancy, the Italian version prevails.
1. Data controller
GREEN13 SRL
Via della Resistenza 129/c, 20090 Buccinasco (MI), Italy
VAT / Tax code: 14697160969 — REA MI-2801512
Email: info@green13.agency
To exercise your rights write to: info@green13.agency
2. Categories of data processed
Data provided by the user
- Identification data: first name, last name, email address, password (encrypted)
- Month and year of birth: collected at registration solely to verify the minimum age requirement (Section 7). We do not collect the day of birth
- Contact data: phone number (if provided)
- Profile data: avatar photo (optional)
- School data (for admins): company name, VAT number, address, website, logo
Automatically collected data
- Access logs (IP address, browser, operating system, date and time)
- Technical session cookies (see Cookie Policy)
- Consent-only: advertising measurement and remarketing cookies (Google Ads) — see Cookie Policy
Payment data
Payments are handled directly by Stripe, Inc. through its PCI DSS infrastructure. WeDanceHub does not process or store credit card numbers or sensitive financial data. Stripe acts as an independent controller for payment data.
Data for the School's payment activation (Stripe Connect)
Schools that activate online payment collection via Stripe Connect provide directly to Stripe, through an activation flow hosted by Stripe itself, the data needed to verify identity and open the account (e.g. the legal representative's identity document, bank details/IBAN, company data). WeDanceHub does not receive or store these documents: our database only records the Stripe account identifier and its verification status (active/not active), needed to correctly route payments and calculate the platform commission described in the Terms and Conditions.
3. Purposes and legal bases of processing
| Purpose | Legal basis | Retention |
|---|---|---|
| Service provision (account, bookings, subscriptions) | Performance of contract (art. 6.1.b GDPR) | Account lifetime + 12 months after deletion |
| Payment processing via Stripe Connect and calculation of the platform commission | Performance of contract (art. 6.1.b GDPR) | Account lifetime + tax retention periods |
| Transactional emails (confirmations, notifications, password reset) | Performance of contract (art. 6.1.b GDPR) | 30-day logs |
| Verification of the minimum age requirement (16 years) at registration | Legal obligation (art. 6.1.c GDPR) — art. 8 GDPR | Account lifetime (month and year of birth, without the day) |
| Tax and accounting obligations | Legal obligation (art. 6.1.c GDPR) | 10 years (tax obligation) |
| Service improvement (aggregate analysis) | Legitimate interest (art. 6.1.f GDPR) | Anonymous aggregate data |
| Marketing and newsletter (with consent only) | Consent (art. 6.1.a GDPR) | Until consent is withdrawn |
| Advertising and remarketing on Google Ads (production site only, with consent only) | Consent (art. 6.1.a GDPR) | Until consent is withdrawn — see Cookie Policy |
4. Recipients and data processors
| Provider | Service | Country | Safeguards |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, storage | Ireland (AWS eu-west-1) | SCC + DPA |
| Vercel, Inc. | Application hosting | USA (EU edge) | SCC + DPA |
| Stripe, Inc. | Online payments, including Stripe Connect for direct transfers to School accounts | USA | SCC |
| Aruba S.p.A. | Transactional email delivery (SMTP) | Italy (EU) | EU-based provider — DPA |
| Google LLC | Google Ads — conversion measurement and remarketing, consent only, production site only | USA | SCC — see Google Ads Data Processing Terms |
Data is not sold or transferred to third parties for commercial profiling purposes.
5. Transfers outside the EU
Some providers listed in section 4 are based in the United States. Transfers are protected by Standard Contractual Clauses (SCC) adopted by the European Commission pursuant to art. 46 GDPR. A copy of the safeguards is available on request at info@green13.agency.
6. Data subject rights
Under arts. 15–22 GDPR you have the right to:
- Access (art. 15): obtain confirmation that data concerning you is being processed and receive a copy.
- Rectification (art. 16): correct inaccurate or incomplete data.
- Erasure (art. 17): request deletion of data, except for legal obligations.
- Restriction (art. 18): obtain restriction of processing in certain cases.
- Portability (art. 20): receive data in a structured, machine-readable format.
- Objection (art. 21): object to processing based on legitimate interest.
- Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
To exercise your rights write to: info@green13.agency
We respond within 30 days of receiving the request.
You have the right to lodge a complaint with the competent supervisory authority: that of the Member State where you habitually reside, where you work or where the alleged infringement took place (art. 77 GDPR). For Italy this is the Italian Data Protection Authority; the list of the authorities of all Member States is published by the European Data Protection Board.
7. Minors
The Service may be used independently only by users who are at least 16 years old. Art. 8 GDPR allows each Member State to set the threshold for children's digital consent between 13 and 16 years (14 in Italy, 15 in France, 16 in Germany): we adopt the highest threshold provided for by the Regulation, which is therefore valid throughout the European Union, with no distinction by country of residence. This is why registration requires the month and year of birth, processed solely to verify the age requirement (legal basis: legal obligation, art. 6.1.c GDPR) and stored together with the profile.
Users aged 16 to 17 must still have the consent of whoever exercises parental responsibility to enter into paid contracts (e.g. purchase of packages or subscriptions), as they do not yet have full legal capacity.
For students under 16, the account is not created by the minor: the relevant data is entered into the platform by the School or by a parent/guardian, who acts as an independent data controller under Section 8 of the Terms and Conditions, with the obligation to obtain the parental consent required under the law applicable in their own country.
If you believe a minor's data has been processed without the conditions described above being met, contact us at info@green13.agency.
8. Changes to this notice
We reserve the right to update this notice. Substantial changes will be notified by email or in-app notice. The "Last updated" date at the top of the page indicates the current version.