Privacy notice
Last updated: 2 October 2026. This notice is provided under Regulation (EU) 2016/679 (GDPR) and covers the website creativestudio.galactus.it, dedicated to the sessions with the artists at the Galactus booth at Lucca Comics & Games 2026.
1. Data controller
Galactus Roma S.r.l., Via A. Malladra 14-16, 00157 Rome (RM), Italy, VAT 12383121006, email galactus@galactus.it, certified email galactus.roma@legalmail.it.
2. Data we process
Browsing data: the site is hosted on GitLab Pages (GitLab Inc., United States), whose systems automatically record IP address, browser, requested pages and technical security logs. Language preference: your choice between Italian and English is stored in your browser (localStorage) and never leaves your device: it is a technical tool, for which the law requires no consent (art. 122 of the Italian Privacy Code). This site uses no cookies, analytics or profiling tools, which is why it shows no banner.
3. Ticket purchase
Tickets are bought on a galactus.it site, events section, with payment via PayPal: order data (name, email, payment details) is processed under that site's and PayPal's notices. Tickets are personal: at the booth we check that the name of the person attending matches the order. We keep no copies of ID documents.
4. Purposes and legal bases
Site operation and security: legitimate interest of the controller (art. 6.1.f GDPR). Managing the booked session and the name check at the booth: performance of the contract (art. 6.1.b GDPR). Replies to requests sent to support@galactus.it: pre-contractual measures at your request (art. 6.1.b GDPR). Tax and accounting obligations on orders: legal obligation (art. 6.1.c GDPR). Browsing data is needed to view the site and order data to complete the purchase: without it the session cannot be booked. There is no automated decision-making or profiling.
5. Recipients and transfers
GitLab Inc. (hosting), PayPal (payments), the hosting provider of galactus.it, and the controller's advisers for legal obligations. GitLab Inc. is based in the United States and is certified under the EU-U.S. Data Privacy Framework: the transfer relies on the European Commission adequacy decision of 10 July 2023 (art. 45 GDPR) and, where that does not apply, on standard contractual clauses, as described in GitLab's privacy statement (about.gitlab.com/privacy). Data is never sold or shared with third parties for marketing.
6. Retention
Hosting logs (IP address, time and pages visited): kept by GitLab for 7 days. Order data: for the period required by tax and accounting law. Attendee lists for the booth check: until the end of the festival, then deleted, unless a dispute is pending. Email requests: for the time needed to handle them.
7. Your rights
You can ask for access, rectification, erasure, restriction, portability and object to processing (arts. 15-22 GDPR) by writing to galactus@galactus.it. You have the right to lodge a complaint with the Italian data protection authority (www.garanteprivacy.it).
8. Minors
The site and ticket purchase are meant for adults. Minors may attend the session accompanied by the person who made the purchase.
9. External links
The site links to the artists' Instagram profiles and to the event pages on galactus.it: data you provide on those sites is governed by their own notices.
10. Changes
This notice may be updated: the date at the top shows the current version.