Skip to main content
Handsome — Workshop Creativi

Legal

Privacy Policy

Last update: 28 September 2026

This Privacy Policy describes how the data controller processes your personal data when you visit handsomemakers.com or use the "Handsome" service (booking and workshop management). Processing complies with EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.

1. Data controller

The data controller is Michael Balleroni (sole proprietorship, "Handsome" project), VAT no. 02871720419, Tax code BLLMHL95D22C357W, registered office at Via C. Menotti, 184, 61122 Pesaro (PU), Italia.

Contact: info@handsomemakers.com · PEC: michaelballeroni@pec.it. We have not appointed a DPO as it is not mandatory for our activity; data protection requests are handled at the address above.

2. Data we collect

  • Account data: name, surname, email, password (stored as a hash), phone.
  • Booking data: chosen workshop, date, participants, deposit paid, payment confirmation.
  • Maker onboarding data: studio name, VAT, address, bio, payout account (via Stripe Connect).
  • In-app chat messages (mediated maker ↔ customer), reviews, gift cards, loyalty points (Handpoints).
  • Payment data: handled directly by Stripe (we do not store card numbers).
  • Browsing/advertising data: IP, user-agent, cookie and pixel identifiers — analytics and marketing only after your consent (see cookie banner).
  • Anonymised error reports via Sentry.
  • Email engagement data: opens and clicks of the emails we send you (via Resend).
  • Private and custom event requests, which you can send without an account: name, email, phone, number of participants, available dates, occasion, area and free-text message. The phone number is required because we may need to call you to agree the date and the details.
  • Push notifications: if you enable them, the technical address (endpoint) your browser provides to deliver them. You can turn them off at any time in your browser or app settings.
  • Maker tax data (identification details, VAT or tax code, payout IBAN, amounts earned on the platform), processed for the reporting duties that apply to digital platforms.

3. Purpose & legal basis

  • Service delivery and account management — performance of a contract (Art. 6(1)(b) GDPR).
  • Payment processing via Stripe — performance of a contract.
  • Transactional emails about your bookings — performance of a contract.
  • Email open/click tracking — to measure the effectiveness of our communications and improve the service — legitimate interest (Art. 6(1)(f)) for transactional emails, and consent (Art. 6(1)(a)) for marketing/newsletter emails. It is not used for marketing profiling without your consent.
  • Newsletter — consent (Art. 6(1)(a)), revocable any time.
  • Analytics (Google Analytics 4, Microsoft Clarity) — consent (Art. 6(1)(a)), via the cookie window.
  • Marketing and advertising (Google Ads, Meta), including remarketing and audience profiling — consent (Art. 6(1)(a)), via the cookie banner.
  • Tax and accounting records, AML/CFT obligations — legal obligation (Art. 6(1)(c)).
  • Platform security and abuse/fraud prevention — legitimate interest (Art. 6(1)(f)).
  • Electronic invoicing and transmission of documents to the Italian Revenue Agency exchange system — legal obligation (Art. 6(1)(c) GDPR).
  • Annual reporting of Maker earnings to the Italian Revenue Agency, as required of digital platform operators (EU Directive 2021/514, “DAC7”) — legal obligation (Art. 6(1)(c) GDPR).
  • Handling private and custom event requests, including the phone calls needed to agree the date and the details — pre-contractual measures at your request (Art. 6(1)(b) GDPR).
  • Push notifications about your bookings, messages and events — consent given by enabling them in the browser (Art. 6(1)(a) GDPR), revocable by turning them off.
  • Temporary phone-number sharing between Customer and Maker within a window around the event (from 24h before to a few hours after), solely for event logistics — performance of a contract (Art. 6(1)(b) GDPR). The number is visible in-platform only within that window, is not stored in the chat history, and may be used only for the event (never for marketing or disclosure to third parties).

3-bis. Market & event tickets

When you request the free ticket of a market published on Handsome we collect your name, email (plus companions' names and emails, if provided), language, the consents you give and — at the entrance — the check-in date and time.

  • The market organiser is the independent data controller for the participants of their own event: your name and email are shared with them because the event is theirs and they run it. Before you provide any data, at the moment you request the ticket, you are shown their name (or legal name), their city and the email for requests about your data — an address the organiser confirmed by clicking a link we sent them, so it exists and is theirs. For that processing Handsome acts as their data processor (Art. 28 GDPR), limited to ticket issuing and entry check-in.
  • Legal basis for sharing with the organiser: performance of the service you requested, namely attending their event (Art. 6(1)(b) GDPR).
  • The organiser's promotional messages about their next editions require a separate, optional consent (Art. 6(1)(a)), which you can withdraw at any time from the link in every email or by writing to the organiser's privacy address.
  • Handsome's own communications are covered by a distinct consent: two different recipients never sit under the same checkbox.
  • Tickets requested before 26 August 2026 were collected under a different notice, in which contacts were not shared with the organiser. That data is not handed over, not even now: they still see only name and entry status.
  • Legal basis: issuing and managing the ticket — performance of the requested service (art. 6.1.b GDPR); event updates — consent (art. 6.1.a).

4. Recipients and processors

We share data strictly necessary with the following processors (Art. 28 GDPR) / autonomous controllers:

  • Supabase — database hosting (EU).
  • Stripe — payments and Stripe Connect payouts (EU/US).
  • Resend — transactional and newsletter emails, incl. open/click tracking (EU/US).
  • Cloudinary — image hosting/CDN.
  • Vercel — application hosting/CDN, and cookieless Web Analytics (aggregate page views, no cookies and no individual identifiers).
  • Sentry — error monitoring (EU).
  • Netsons — domain, DNS and provider email (EU).
  • Upstash — temporary store for request rate limits, used to prevent abuse (EU).
  • TeamSystem – Fatture in Cloud — issuing and storing tax documents (EU).
  • Italian Revenue Agency — exchange system for electronic invoices and annual reporting of Maker earnings (DAC7).
  • Meta Platforms Ireland Ltd — if you choose to write to us on WhatsApp, that conversation is handled under WhatsApp's own privacy policy.
  • Google Ireland Ltd — Google Analytics 4 and Google Ads (only with consent).
  • Microsoft Ireland Operations Ltd — Microsoft Clarity, heatmaps and anonymous session recordings (only with consent).
  • Meta Platforms Ireland Ltd — Meta Pixel for advertising (only with consent).
  • The Maker you book with — receives the participant's name, email and phone number, the notes you left (allergies, needs, level) and, where required to issue the fiscal document for the workshop, the Customer's tax code and address. The contact details are there so they can run the day and reach you if something changes; the Maker undertakes not to use them for their own promotional messages without consent they have collected themselves. The Maker acts as an autonomous data controller for these data and uses them only to fulfil the booking and its own tax obligations. Private events mediated by Handsome are the exception: there the Customer's contact details are not shared.

We never sell your personal data.

5. Transfers outside the EU

Some providers (e.g. Stripe, Google, Meta, Vercel) may process data in the United States. Transfers are protected by adequacy under the EU-US Data Privacy Frameworkand/or the EU Commission's Standard Contractual Clauses, with additional safeguards where required.

6. Profiling and automated decisions

With your marketing consent, Google and Meta may build advertising profiles to show you relevant ads (remarketing). We do not carry out automated decision-making producing legal or similarly significant effects on you under Art. 22 GDPR.

7. Retention

Booking and tax records: 10 years (Italian tax law). Data reported to the Italian Revenue Agency under DAC7: 10 years, as required by law. Private and custom event requests that do not lead to a booking: 24 months from the last contact. Account profile: until you request deletion. Newsletter consent: until you unsubscribe. Analytics/marketing cookie data: up to 13–24 months. Error logs: 90 days. Cookie consent record: 6 months.

8. Your rights

You may exercise access, rectification, erasure, restriction, portability and objection (Articles 15–22 GDPR). You may withdraw consent at any time (including analytics/marketing, via "Manage cookie preferences" in the footer) and object to direct marketing (Art. 21). Write to info@handsomemakers.com — we reply within 30 days. You may also lodge a complaint with the Italian DPA (Garante per la protezione dei dati personali, gpdp.it).

9. Cookies

See our Cookie Policy. You can change preferences any time from the footer link.

10. Changes

We may update this policy; the "Last update" date reflects the latest version. Material changes affecting consent-based processing will be notified.