Privacy Policy
This Privacy Policy describes how personal data is processed when users interact with Kanousé S.r.l. (also referred to as “Kanousé”, the “Controller” or “we”) through its contact channels, including kanouse.it, social accounts, messaging services and automated systems for handling commercial enquiries.
This document is drawn up pursuant to Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Privacy Code”), as amended.
1. Data Controller
The Data Controller is:
Kanousé S.r.l.
Registered office: Via Attinie 21, 74122 Taranto (TA), Italy
Tax code and VAT number: 03485010734
REA registration number: TA-261153
Certified email (PEC): kanousesrl@pec.it
For questions about personal data processing and to exercise your rights, contact the Controller at:
- Email: kanouseofficial@gmail.com
- PEC: kanousesrl@pec.it
The Controller is represented by its legal representative in office.
2. Data Protection Officer (DPO)
The Controller has not appointed a Data Protection Officer (DPO), as the conditions requiring appointment under Article 37 GDPR do not apply. The Controller periodically reviews the need to appoint a DPO as its activities evolve.
3. Types of data processed
Kanousé processes the following categories of personal data:
a) Contact and identification data
- Full name
- Email address
- Phone number
- Social media username (e.g. Instagram or Facebook handle)
b) Service enquiry data
- Event date
- Event location
- Type of event (wedding, private event, corporate event, etc.)
- Any musical preferences, technical needs or specific requests provided
c) Communication content
- Messages sent by email, Instagram Direct Message, WhatsApp or the website contact form
- Any attachments sent by the user
d) Browsing data
- IP addresses
- Browser and device type
- Pages visited on kanouse.it
- Time spent on the website
- Technical and analytics cookies (see the relevant section)
Kanousé does not process special categories of personal data under Article 9 GDPR (sensitive data), unless the data subject voluntarily provides them in their communications.
4. Purposes and legal basis of processing
Personal data is processed for the following purposes:
a) Responding to requests for quotes and information (Article 6(1)(b) GDPR)
- Preparing a quote
- Communicating date availability
- Handling interactions before entering into a contract
Legal basis: taking pre-contractual steps at the data subject’s request.
b) Performing the contract (Article 6(1)(b) GDPR)
- Providing the agreed musical service
- Administrative management (invoicing and payments)
- Operational communications concerning the event
Legal basis: performance of the contract.
c) Compliance with legal obligations (Article 6(1)(c) GDPR)
- Tax and accounting requirements
- Retention of accounting documents (10 years under Article 2220 of the Italian Civil Code)
- Any communications to authorities (SIAE, Italian Revenue Agency, etc.)
Legal basis: legal obligation.
d) The Controller’s legitimate interests (Article 6(1)(f) GDPR)
- Defending rights in legal proceedings
- Security of company IT systems
- Aggregate statistical analysis to improve services
Legal basis: legitimate interest, balanced against the data subject’s rights.
e) Direct marketing (Article 6(1)(a) GDPR)
- Sending commercial communications about new Kanousé services or events
- Only with the data subject’s explicit consent, which may be withdrawn at any time
Legal basis: freely given, specific, informed and withdrawable consent.
5. Automated processing using Artificial Intelligence
Kanousé uses automated systems based on Artificial Intelligence technologies to handle incoming enquiries through its communication channels (email, Instagram Direct Message and website form).
5.1 How the system works
When a user sends a message through one of these channels:
- The system receives the message
- An Artificial Intelligence model (Claude, provided by Anthropic Inc.) analyses the message to:
- Understand the type of enquiry (quote, information or other)
- Extract relevant data (event date, location and contact details)
- Suggest a personalised draft reply
- The draft reply undergoes human review before being sent
- The Controller approves, edits or discards the draft before it is sent to the data subject
5.2 Automated decisions
The system does not make automated decisions that produce legal effects or similarly significantly affect the data subject within the meaning of Article 22 GDPR. Every reply sent to a user is first reviewed by a natural person authorised by Kanousé.
5.3 The data subject’s right
Data subjects may request that their communications be handled exclusively by human staff without AI systems. This request can be made at any time by writing to kanouseofficial@gmail.com.
5.4 Technologies used
Kanousé uses the following external providers to operate the automated system:
- Anthropic Inc. (USA): provider of the Claude AI model used for semantic analysis of messages
- Google LLC (USA): Google Workspace, Gmail, Google Drive and Google Apps Script infrastructure
- Meta Platforms Inc. (USA): Instagram and Facebook APIs for handling social media messages
- Telegram FZ-LLC (UAE): internal notification system for authorised staff
Transfers outside the EU are described in section 8.
6. Processing methods
Personal data is processed mainly electronically and, to a limited extent, on paper. The Controller adopts appropriate technical and organisational measures under Articles 25 and 32 GDPR to ensure data security and confidentiality, including:
- Encrypted communications
- Strong authentication systems (strong passwords and two-factor authentication)
- Regular backups
- Access restricted to authorised staff
- Regular software updates
7. Data recipients
Personal data may be disclosed to the following parties, appointed as processors under Article 28 GDPR where applicable:
- Technology service providers: Google LLC, Anthropic Inc., Meta Platforms Inc., Telegram FZ-LLC
- Professional advisers: accountant, employment consultant and legal adviser, where necessary
- Public bodies: Italian Revenue Agency, INPS and SIAE (only as required by law)
- Banks: to handle payments
- Authorised persons: musicians and collaborators involved in delivering the service
Data is not publicly disclosed or sold to third parties for marketing purposes.
8. Transfers outside the EU
Some technology providers used by Kanousé are based outside the European Economic Area. In particular:
| Provider | Country | Purpose | Safeguards applied |
|---|---|---|---|
| Anthropic Inc. | USA | Claude AI model | EU Standard Contractual Clauses (SCCs) |
| Google LLC | USA | Workspace, Apps Script, Drive | EU–US Data Privacy Framework adequacy decision |
| Meta Platforms Inc. | USA | Instagram/Facebook API | EU–US Data Privacy Framework adequacy decision |
| Telegram FZ-LLC | UAE | Internal staff notifications | EU Standard Contractual Clauses (SCCs) |
All transfers comply with Articles 44 et seq. GDPR through appropriate safeguards. Detailed information on each provider’s transfer mechanisms is available on their official websites and may be requested from kanouseofficial@gmail.com.
9. Retention periods
Personal data is retained for the following periods:
| Data type | Retention period |
|---|---|
| Preliminary enquiries that do not lead to a contract | 12 months from the last interaction |
| Customer contract data | 10 years from conclusion of the contract (tax obligations under Article 2220 of the Italian Civil Code) |
| Marketing data | Until consent is withdrawn or a maximum of 24 months after the last interaction |
| Technical logs and browsing data | 12 months |
| Communications handled by the AI system | 90 days in processing systems, unless incorporated into other processing activities |
At the end of the retention period, data is deleted or irreversibly anonymised, unless retention is needed to comply with legal obligations or defend rights in legal proceedings.
10. Data subject rights
Under Articles 15–22 GDPR, data subjects have the following rights:
- Right of access (Article 15): obtain confirmation of processing and a copy of their data
- Right to rectification (Article 16): correct inaccurate or incomplete data
- Right to erasure (“right to be forgotten”, Article 17): request deletion of data
- Right to restriction of processing (Article 18)
- Right to data portability (Article 20)
- Right to object (Article 21): object to processing on legitimate grounds
- Right to withdraw consent (Article 7(3)): at any time, without affecting the lawfulness of processing based on consent before withdrawal
- Right not to be subject to automated decisions (Article 22)
- Right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it)
How to exercise your rights
You can exercise your rights by writing to:
- Email: kanouseofficial@gmail.com
- PEC: kanousesrl@pec.it
The Controller will respond within 30 days of receiving the request, under Article 12(3) GDPR. To specifically request deletion of your data, see the “Data deletion” page.
11. Cookies
The kanouse.it website uses technical cookies necessary for it to function and, with consent, analytics and third-party cookies. For more information, see the Cookie Policy available on the website.
12. Changes to this Privacy Policy
The Controller reserves the right to amend this Privacy Policy at any time to reflect legislative changes or developments in its services. The updated version will always be available on kanouse.it, showing its last updated date.
Any substantial changes will be communicated to data subjects through the available contact channels.
Kanousé S.r.l. — Via Attinie 21, 74122 Taranto (TA), Italy — Tax/VAT number 03485010734