Privacy and cookie policy

Website www.nativitasmilano.it · NATIVITAS · Christmas Winter Garden
Piazza Città di Lombardia, Milan · open to the public from 27 November 2026 to 10 January 2027, and until 14 February 2027

Last updated: 15 October 2026 · version 1.6

This page explains what data the NATIVITAS website processes, why, for how long, and what your rights are. It applies to www.nativitasmilano.it and to the addresses that lead there.

1. Who the data controller is

The data controller is TECNOSTRUTTURA S.r.l., which runs NATIVITAS under the One Event Builders brand: Via Crosara 26, 36050 Zermeghedo (VI), Italy · tax code and VAT number IT04123290241 · phone +39 0444 484110. In this policy, «we» means One Event Builders.

NATIVITAS · Christmas Winter Garden is a project by One Event Builders. The SYNTONY chapter, with the sky of wishes, is dedicated to the interactive light artwork by Adriano Lombardo; thoughts written on this website are also processed by One Event Builders.

For questions about this policy, to exercise your rights and for anything else: info@oneventbuilders.com.

2. What data we process and why

2.1 Visiting the website

When you open the website, your browser requests it from the server, as with any website. The server of Aruba, our hosting provider, automatically records:

• your IP address;
• date and time;
• the page or file requested, and the result (for example «found» or «not found»);
• your browser and operating system type;
• the page you came from, if your browser sends it.

Aruba's protection against cyber attacks (anti-DDoS) and its fast cache (HiSpeed Cache) also work in front of the website: they read the same information to protect the website and serve it faster.

• Why: to show you the website, keep it secure, understand a fault or stop an attack.
• Legal basis: our legitimate interest in a website that works and is protected (Article 6(1)(f) of Regulation (EU) 2016/679, the «GDPR»).

We don't use this data to find out who you are. We could only do so to defend the website from an attack, or if an authority requires it.

2.2 The sky of wishes (SYNTONY chapter)

In the SYNTONY chapter you can write a thought, up to 80 characters, and light your star. You can write thoughts until 14 February 2027 inclusive.

What reaches our server

• the text of the thought;
• the moment you wrote it (according to your device) and the moment it arrived;
• whether it was published or discarded and, if discarded, the reason;
• a code instead of your IP address (for example «6a397f…»).

What the code is. The server derives the code from your IP address with a secret key that stays on the server. It saves only the code, never the address, and the address cannot be worked out from the code. The same address always gives the same code: this lets the server link thoughts written from the same connection and apply limits (at most 10 thoughts per hour and 30 per day). Whoever holds the key, however, could recompute the code from an address they already know. That is why we treat it as «pseudonymous» personal data, not as anonymous data.

What does not reach us: your name, email, phone number or location. The form doesn't ask for them.

Who sees it. As soon as it arrives, an automatic filter on our server checks the thought: swear words, insults and blasphemy in several languages, including disguised spellings, as well as links, email addresses and phone numbers. The filter runs entirely on our server, with no external services: the thought is not sent to anyone else to be checked. Nobody approves thoughts by hand.

• If the thought is clean, it lights up straight away in «everyone's sky»: anyone who opens the website can see it, next to the code and without your name.
• If it isn't, it is discarded and is never shown to anyone: only you see it, on your screen. A discarded thought stays saved in the archive, with the reason, and is visible only on the private page of the people who run the website. It is deleted together with all the other thoughts on 16 March 2027.
• The people who run the website, on a private page, can remove a published thought or restore a thought that was discarded by mistake.

Please don't write personal data, yours or anyone else's. The filter recognises links, emails and phone numbers, but not names or personal details: names and surnames, addresses, information about the health or the faith of a person who can be recognised.

The wall in the piazza. Today, thoughts written on the website stay on the website: they don't reach the large SYNTONY wall in the piazza. If they ever do, we will update this policy first.

In your browser. The thought also stays on your device, so you can find your stars on your next visit (section 3).

The end of the sky. From 15 February 2027 the server accepts no new thoughts. On 16 March 2027 everyone's sky is emptied and, that same night, the server automatically deletes all thoughts, the limit counters and the backup copies (section 7).

• Why: to publish your thought, as you ask by pressing «Light it»; to keep insults, links and contact details out of the sky; to protect it from abuse.
• Legal basis: publication is the service you request (Article 6(1)(b) GDPR); the filter, the code, the limits and the backup copies serve our legitimate interest in a sky that is safe and isn't lost to a fault (Article 6(1)(f)).

2.3 The weather in Milan

To make the scene snow (or not) and show the temperature, the website displays the current weather in the piazza. It is fetched by our server, at most every 15 minutes, from MET Norway (the Norwegian Meteorological Institute, a public body), and served to all visitors from its memory. Your browser only asks our server: no weather service sees your IP address. MET Norway only sees the address of Aruba's server.

The weather data comes from MET Norway, under the CC BY 4.0 licence, and is credited next to the weather (api.met.no terms of service).

2.4 Your own questions to the characters (once switched on)

Today the characters in the piazza (Stella, the chef, Father Christmas, Marta) answer only the ready-made questions, with texts we wrote: what you choose goes to no one.

Once your own questions are switched on, you will also be able to type a question of your own. The character is guided by artificial intelligence and says so; it can make mistakes: the official information is the one from One Event Builders.

• What happens. Our server sends the text of your question and the last lines of your conversation with that character to Claude, the artificial intelligence model by Anthropic PBC (United States), which writes the answer. We don't send your name or your IP address.
• Anthropic processes this data on our behalf, as a processor (Article 28 GDPR), under its data processing agreement, which includes the standard contractual clauses approved by the European Commission. According to its commercial terms, Anthropic does not use data sent through its API to train its models. Before switching the service on, we will state here how long Anthropic keeps this data (section 11).
• On our server we keep only a counter for the question limits, linked to a code instead of your IP address: the same kind of code as for the sky of wishes (section 2.2).
• Please don't write personal data in your questions: names, addresses, numbers, health information.
• Why: to answer the question you ask.
• Legal basis: the service you request by writing the question (Article 6(1)(b) GDPR), or our legitimate interest in offering an extra welcome service (Article 6(1)(f)).

2.5 Features that stay on your device

Many parts of the website work only in your browser and send us nothing:

• the souvenir photo: the frame is drawn on your device, and you save the photo yourself;
• «Invite a friend»: it copies a link to the clipboard or opens your phone's share menu; you send the message yourself, with the app you choose;
• «Plan your visit»: your plan is put together on your device; it only leaves it if you choose to send it to NATIVITAS (point 2.8);
• the logo for partners (chapter «For companies and partners»): the file is read in your browser, not sent and not saved; it disappears when you reload the page;
• the gyroscope and motion sensors of your phone, to look around or make it snow by shaking it: on iPhone you turn them on yourself, with a tap; the data stays on the phone;
• the headset for virtual reality: head and hand movements stay in the headset;
• the characters' voice, off at the start: it uses your browser's speech synthesis. Some browsers (for example Chrome with the «Google» voices) produce the voice on the browser maker's servers: in that case it is the browser that sends them the character's sentence, never your data, under its own rules;
• the hunt for the 12 stars: the stars you find and your personal code are created and stay in your browser.

The website does not use your camera, microphone or location, and asks your browser to block them.

2.6 NATIVITAS news (newsletter)

If you like, you can leave us your email to receive NATIVITAS news: the opening, the programme, bookings, seasonal greetings. It is optional: the whole website works without it.

What we process: your email address; the language of the website; the day and time you signed up and confirmed; if you unsubscribe, the day you did so.

Double confirmation. You write your email and tick the consent box. Our website sends you an email with a link: you open it and press «Yes, subscribe me». Only then is your subscription complete and your address added to the list. The link is valid for 7 days: if you don't confirm, you are not added to the list and we don't write to you again.

What stays on our server. A request waiting for confirmation, to subscribe or to delete your data (your email, language, day and time), stays on the server for 7 days at most: when you confirm, or after 7 days if you don't, it is deleted. When you confirm, the server passes your address to Brevo; if Brevo does not respond at that moment, the server keeps it until Brevo receives it (it tries again every night), then deletes it. To limit abuse (for example, no more than one confirmation email every 10 minutes to the same address), it keeps, for one day at most, a code derived from your IP address and one derived from your email, with the time of the requests. So that we can demonstrate that you gave your consent (Article 7(1) GDPR), the server keeps a record of your confirmation: a code derived from your address with a secret key that stays on the server (the code cannot be turned back into your address; starting from your address, on the other hand, we can find your record), the day and time of the request and of the confirmation, the language and the version of the sentence you ticked. No IP address. We keep this record for as long as you are subscribed.

Deleting your data. You can have the record deleted whenever you like: with the link «Remove me from the news and delete my data» (it is also in the news window and in the confirmation email), or by writing to infoeventi@nativitasmilano.it. With the link, you enter your email and we send you a link to confirm, valid for 7 days: you open it and press «Yes, remove me». Deleting the record also means leaving the list: we remove your address from the Brevo list and delete any pending requests. Until Brevo confirms the removal (if it does not respond, the server tries again every night), the server keeps your address, then deletes it. People who unsubscribed only with the link at the bottom of the emails can ask for their record to be deleted in the same way.

How to stop. At the bottom of every email there is a link to unsubscribe, with one click. You can also write to us (section 8).

The service we use. The news is sent from infoeventi@nativitasmilano.it with Brevo, the service of Sendinblue SAS (Paris, France), which keeps the list of subscribers and sends the emails. Brevo processes the data on our behalf, as a processor (Article 28 GDPR), and does not use it for its own purposes. The confirmation email, on the other hand, is sent by our website, like the booking emails.

Opens and clicks. The emails contain a small image and links that tell Brevo whether you open the email and which links you open, with the day and time. We use this only to understand which news is of interest and to avoid writing in vain, never for advertising or to profile you. If you prefer, you can choose not to download images in emails (almost all email programs allow this) or unsubscribe.

• Why: to send you the news you asked for, and to understand which news is of most interest.
• Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time, at no cost; withdrawing it doesn't affect emails already sent.

2.7 Event, ice rink and aperitivo bookings

On the website you can book a place at NATIVITAS events (talks, workshops, presentations) and request a place at paid events; you can also book a session on the ice rink and the aperitivo at the bistro (the Christmas Bistrot & Lounge, in the Cathedral).

• Free events, the ice rink and the aperitivo: your booking is confirmed straight away, while places are available; after that, if the event has one, you join the waiting list.
• Paid events: you send a request. The NATIVITAS team contacts you to confirm it and arrange payment, which takes place outside the website: by bank transfer to our account or through the payment link we send you. The website never asks for or sees your card or bank details.

What we ask for

• first and last name, email;
• phone number: required for paid events (we call you to confirm), optional for free events, the ice rink and the aperitivo;
• the event, date, time (for the ice rink and the aperitivo, the session) and number of guests;
• if you wish, a note (for example “we are coming with a pushchair”);
• confirmation that you have read this privacy notice.

What we add: a booking code (for example “NAT-7K3Q9”), the date and time your request arrives, the language of the website, the status of the booking (confirmed, on the waiting list, request received, awaiting payment, paid, not available, expired, cancelled) and its history (who changed it and when). For paid events: the amount, the payment deadline and the bank transfer reference (the code, “Evento” and the date). For the limits against abuse, as for the sky of wishes, a code instead of your IP address (section 2.2).

No health data. We do not ask about allergies, intolerances, disabilities or other health information, and we ask you not to write them in the notes: the form refuses notes that contain them. If they are needed, the NATIVITAS team will ask you, by phone or email, for that occasion only.

Emails. You receive a receipt by email, with your code and the link to cancel, and then only emails about your booking: the confirmation, the payment request with the bank transfer details, a reminder the day before the payment deadline, the payment confirmation, a place becoming free, a change or cancellation of the event. They are not newsletters: you only join the NATIVITAS news if you choose to (section 2.6). A copy of each booking is emailed to the NATIVITAS team (infoeventi@nativitasmilano.it).

Who sees them. The people at One Event Builders and in the project who manage bookings, each with their own personal access to the restricted page of the website: every change is recorded with the name of the person who made it. Bookings are also copied to a Google spreadsheet in the NATIVITAS account, shared only with named people, which is used for the organisation (for example the guest list at the entrance).

Cancelling. You can cancel yourself, until the event (for the ice rink and the aperitivo, the session) starts, with the link in your email. A paid event that has already been confirmed or paid is cancelled by writing to infoeventi@nativitasmilano.it, because we handle the payment. If you cancel a free event, an ice rink session or an aperitivo session, your place goes to the first person on the waiting list.

Payment. If the payment does not arrive by the deadline stated in the email, the request expires and the place becomes available again. The bank transfer details we receive from the bank (for example the name of the payer) are processed by One Event Builders for its accounting, as for any payment received, and kept for as long as the law requires.

• Why: to manage your booking or request, confirm it, organise the event and the entrance, request and record the payment, and let you know if anything changes; to protect the form from abuse.
• Legal basis: the booking you request and the steps before the contract, for paid events (Art. 6(1)(b) GDPR); accounting and tax obligations for payments (Art. 6(1)(c)); our legitimate interest in the security of the service, for the limits and backup copies (Art. 6(1)(f)).
• If you do not give us the required data, we cannot take your booking.
• Age: you must be at least 18 to book; for children's workshops, a parent or guardian books.

2.8 Messages to NATIVITAS: “Write to us” and “Send your visit plan”

On the website you can write to us (the “Write to us” form on the contacts page) or send us the plan you made in “Plan your visit” (“Send your visit plan to NATIVITAS”).

• What we ask for: your name, email, your phone number if you wish, the message (optional for a visit plan) and confirmation that you have read this privacy notice. A visit plan also includes the day, afternoon or evening, your arrival time if you wish, who you are coming with and your stops. Please don't write health information or other sensitive data unless your question needs it.
• Why: to reply to you and, for a visit plan, to help you organise your visit; to protect the form from abuse.
• Legal basis: your request (Art. 6(1)(b) GDPR); our legitimate interest in the security of the service, for the limits against abuse (Art. 6(1)(f)).
• Who receives them: the NATIVITAS team, by email (infoeventi@nativitasmilano.it, with anna@nativitasmilano.it and letizia@nativitasmilano.it in copy), who reply from their mailboxes. You receive a receipt summarising what you sent.
• The website does not keep them: the message does not stay on the server, only in the emails. For the limits against abuse, the server keeps for one day a code instead of your IP address and your email, with the time (section 2.2).
• How long: in the NATIVITAS team's mailboxes, for as long as needed to reply to you, and in any case no later than 16 March 2027 (section 7).
• If you do not give us the required data (name, email, the privacy notice box), the message is not sent. You can always write to us from your own email too.

2.9 Services switched off today

• Your own questions to the characters: off today. The characters answer only the ready-made questions and send nothing to external services; if your own questions are ever switched on, we will update this page first (section 2.4).
• Visit statistics: off today. If they are switched on, they will use no cookies, will not run for people who ask their browser not to be tracked (Do Not Track, Global Privacy Control), and we will say so here first.
• Corporate event bookings: when they open, the buttons will lead to the pages indicated by One Event Builders, with their own privacy policy.

2.10 Links to other websites

The website links to Google Maps, OpenStreetMap and MET Norway (the weather source), and has links to send an email or make a phone call. If you open them, you enter another website, with its own privacy rules.

The website doesn't embed content from other websites (no maps, videos or social buttons inside the page) and doesn't use Google Fonts: the fonts are on our server. We use Google Search Console to see, in aggregate form, how the website appears in Google searches: it adds nothing to the page and collects no data about visitors.

3. What stays in your browser

To remember your choices, the website uses your browser's local storage («localStorage»). These are not cookies: they stay on your device and are never sent to us or to anyone else. They only make what you chose work; they are not used to recognise or follow you.

This data does not expire on its own: it stays until you delete it. To delete it, in your browser settings choose «Clear site data» (or «Cookies and site data») for nativitasmilano.it. In a private window it disappears when you close it. If other people use your device, whoever comes after you can see your thoughts in your sky: delete them the same way.

4. Cookies

The website does not use profiling, advertising, statistics or third-party cookies. Visitors get no cookies at all.

There is only one technical cookie, and it doesn't concern visitors:

Why there is no cookie banner. Technical cookies, and similar tools needed to provide a service you asked for (such as the local storage in section 3), don't require consent: this policy is enough (Article 122 of the Italian Personal Data Protection Code, Legislative Decree 196/2003; Guidelines on cookies and other tracking tools of the Italian Data Protection Authority, 10 June 2021). A banner is needed when there are non-technical cookies or tools, such as profiling or advertising ones: there are none here.

5. Who receives the data

• Aruba S.p.A. (Ponte San Pietro, Bergamo, Italy), which hosts the website on servers in Italy and protects it, and the @nativitasmilano.it mailboxes where bookings and messages arrive. All the website's emails are also sent from Aruba's server: the receipts and the emails about bookings and messages, and the news confirmation email. It processes data on our behalf, as a processor (Article 28 GDPR).
• The people we appoint to look after the website and the sky of wishes (to remove a thought or restore one discarded by mistake), with written instructions and a duty of confidentiality.
• Sendinblue SAS (Brevo, Paris), only for the news: it keeps the list of subscribers and sends the news, as a processor (section 2.6). Emails about bookings and messages do not go through Brevo.
• Google Ireland Limited (Dublin, Ireland), which provides the NATIVITAS Google account and hosts the bookings spreadsheet (section 2.7).
• The people who manage bookings for One Event Builders and for the project, each with their own personal access, with written instructions and a duty of confidentiality.
• Anyone who visits the website, for published thoughts.
• Anthropic, only once your own questions are switched on (section 2.4).
• Public authorities, when the law requires it.

We don't sell data and we don't use it for advertising.

6. Data outside the European Union

The website, the thoughts and their copies are on servers in Italy. Visitors' data does not leave the European Union.

The emails of people who sign up for the news are kept by Brevo, on servers in the European Union. If one of Brevo's suppliers processes them outside the Union, it does so with the safeguards of the GDPR (for example the European Commission's standard contractual clauses).

The bookings spreadsheet is kept in the NATIVITAS Google account; for users in the European Union the service is provided by Google Ireland Limited. If the data passes to Google LLC, in the United States, or to other Google companies outside the Union, the transfer takes place with the safeguards of the GDPR (the EU-US “Data Privacy Framework” adequacy decision and the European Commission's standard contractual clauses).

The service for your own questions is off today and sends no data outside the Union. If it is ever switched on, the data will go to Anthropic, in the United States, under the European Commission's standard contractual clauses, and we will say so here first.

7. How long we keep data

8. Your rights

You can ask us at any time:

• whether we process data about you, and for a copy (Article 15 GDPR);
• to correct it (Article 16) or delete it (Article 17);
• to restrict its use (Article 18);
• to receive it in a machine-readable format, for the data you gave us (Article 20);
• to stop processing it, when we process it for our legitimate interest (Article 21).

The sky's filter. The filter decides on its own whether a thought is shown in everyone's sky. It is an automated decision, but it has no legal or otherwise significant effects on you (Article 22). If you think it discarded one of your thoughts by mistake, write to us: we will look at it ourselves.

How we find your thoughts. We don't know who you are. To find one of your thoughts (for example to remove it), send us its text and, roughly, the day and time. If you like, also tell us the IP address you wrote it from: we will recompute the code and find all the thoughts from that connection (Article 11 GDPR).

The news. To stop receiving it, just use the link at the bottom of every email. Withdrawing your consent costs nothing and you don't need to explain why (Article 7(3)).

Write to info@oneventbuilders.com. We reply within one month.

Complaints. If you think we are processing your data incorrectly, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it; how to lodge a complaint, in Italian), or with the supervisory authority of the European country where you live or work.

9. Children and young people

NATIVITAS is an event for families. The website doesn't ask for your age or for personal data. In the sky of wishes (and, once they exist, in your own questions) we ask you not to write any, and the filter discards thoughts containing links, emails and phone numbers.

To sign up for the news you must be at least 18 years old.

To book an event, the ice rink or the aperitivo you must be at least 18 years old: children's workshops are booked by a parent or guardian (section 2.7).

If you are under 14, ask a parent before writing a thought or a question. If a parent notices that a child has written personal data, they can write to us to have it removed (section 8).

10. Security

• The website opens over https: the connection is encrypted.
• Thoughts, their backup copies, the settings and the secret key are kept in a private server folder that cannot be opened from outside.
• The server doesn't store your IP address: only the code.
• The private page of the sky of wishes is protected by a password; after 5 attempts in a quarter of an hour it locks, for that address, for a quarter of an hour.

11. Changes

If something changes (for example your own questions or the statistics are switched on), we update this page first, and the date at the top.

Last updated: 15 October 2026 · version 1.6

One Event Builders · TECNOSTRUTTURA S.r.l. · VAT number IT04123290241