Articles 13–14 GDPR (EU Regulation 2016/679)
Privacy Policy
Version 2.0 · Draft pending legal review
1. Data controller
VEGA SRLS, VAT no. 16773321001, REA RM-1674707, share capital €1,000.00 fully paid-up, registered office Via Eduardo de Filippo 178, 00128 Rome, Italy. Certified email (PEC): vegasocietaresponsabilitalimitatasemplificata@legalmail.it. Contact for any privacy request: members@ksociety.world. K Society (https://ksociety.world) is a project of VEGA SRLS.
2. Data we collect
- Application: first and last name, date of birth (to verify you are at least 18), email, phone, occupation, the reason you want to join, your Instagram username (required), optional email of the member who referred you, and your choices on optional updates.
- Membership: card number, membership level (Inner Circle, Ambassador, Member), membership status and its history, date you joined, a personal card link and a QR code. The QR code contains a signed code, not your personal details.
- Events: attendance at member events (event, date and time of entry, staff operator, entry method, any correction).
- Staff accounts (ADMIN/STAFF): name, email, role, a securely hashed password, sign-in times and a log of management actions.
- Technical data: server logs (e.g. IP address, request time) used for security and abuse prevention.
Your Instagram username is required because the public profile helps us get to know applicants during the personal review. We only store the username you provide and a link to it; we do not collect other data from Instagram, do not run automated checks on your profile, and adding K Society to your bio or sharing content is never required.
We do not request identity documents and we do not collect special categories of data. Your date of birth is used to confirm you are at least 18; applications from minors are rejected automatically.
3. Purposes and legal bases
- Reviewing applications (including viewing the public Instagram profile you indicate), managing membership, levels, the digital card and event entry — steps taken at your request and performance of the membership relationship (Art. 6(1)(b)).
- Operational communications: application status, approval, card delivery and re-sending, staff invitations, organisational information about member events you take part in or that concern your membership — Art. 6(1)(b).
- Security, prevention of abuse and duplicate applications, staff activity logs, verification at event entry — legitimate interest (Art. 6(1)(f)).
- Compliance with legal obligations, where applicable (Art. 6(1)(c)).
- Promotional emails announcing new events, initiatives and member benefits (including those offered with partners) — only if you tick the optional consent box (Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code). Without consent you will not receive them; you can withdraw consent at any time by writing to us, and your choice is recorded on your membership profile.
We do not send commercial newsletters, third-party advertising, or carry out marketing profiling.
4. Recipients and service providers
Data is accessed only by authorised K Society staff (ADMIN: full management; STAFF: event check-in with minimal data). We use these providers:
- Emergent — hosting of the website, application server and database.
- Resend — delivery of transactional emails from members@ksociety.world.
- Google Workspace — the members@ksociety.world mailbox used to answer your messages.
- Cloudflare — DNS management for the ksociety.world domain.
- Google Wallet and Apple Wallet — not yet active. If introduced, your card data (name, card number, level, attendance count, QR code) will be shared with the relevant provider only when you choose to add the card to your wallet; this policy will be updated first.
Data is not sold or disclosed to third parties for their own purposes.
5. Transfers outside the EEA
Some providers may process data outside the European Economic Area (for example in the United States). Where this happens, transfers rely on the safeguards offered by each provider under Chapter V GDPR (such as an adequacy decision or Standard Contractual Clauses). You can request details at members@ksociety.world.
6. Retention
| Approved applications / active members | For the duration of the membership |
| Rejected or withdrawn applications | 12 months from the decision, then deleted |
| Suspended memberships | For the duration of the suspension, then as active or revoked |
| Revoked memberships | 24 months from revocation (minimal record to prevent re-admission abuse), then deleted |
| Attendance counter (total number of events attended) | For the duration of the membership |
| Detailed check-in history (event, time, operator, method) | 12 months from each check-in |
| Staff activity and security logs | 12 months |
| Transactional email records (provider) | As retained by the email provider; internal send status for the duration of the membership |
| Expired ADMIN/STAFF invitations | Invitation link invalid after 72 hours; deactivated accounts deleted after 12 months |
7. Your rights
You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest; you may withdraw consent to optional updates at any time without affecting prior processing. Write to members@ksociety.world. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
8. Minimum age
K Society is reserved for adults. Applications from people under 18 are not accepted.
9. Cookies and similar technologies
The public website does not use analytics, advertising or profiling cookies, and fonts are served from our own domain. Only the staff area uses one strictly necessary, secure session cookie after sign-in. No consent banner is therefore required; this section will be updated if this changes.
10. Security
Personal card links and QR codes are random and unpredictable; card links can be regenerated and invalidated. Passwords are stored only in hashed form; staff access is role-based and logged.
11. Changes
We may update this policy; the version above shows the current one.