INDEX

1. Data controller
2. The personal data being processed
a. Navigation data
b. Special categories of personal data
c. Data provided voluntarily by the data subject
d. Cookies
3. Purpose of processing
4. Legal basis and mandatory or optional nature of processing
5. Recipients of personal data
6. Transfers of personal data
7. Retention of personal data
8. Rights of the data subject
9. Modifications

Who are we and how do we process your personal data?
Comehome S.r.l., with registered office in Via Malaga 6 – 20143 Milan (MI),
(hereinafter "Comehome") constantly strives to protect the online privacy of its users. This
document has been drawn up in accordance with Article 13 of the EU Regulation 2016/679
(hereinafter: "Regulation") in order to allow you to get to know our privacy policy, to
understand how your personal information is managed when you use our website
https://comehome.fun (hereinafter collectively "Site") and the services offered through our
application (hereinafter collectively "App"), and, where appropriate, to give your express
and informed consent to the processing of your personal data. The information and data
provided by you or otherwise acquired in the context of the use of Comehome's services, –
such as, for example: access to the reserved area of the Site, the possibility of becoming a
HOST or SUPERHOST, – hereinafter referred to as the "Services" – will be subject to
processing in compliance with the provisions of the Regulations and the obligations of
confidentiality which inspire Comehome's activity.
In accordance with the rules of the Regulation, the processing carried out by Comehome
will be based on the principles of lawfulness, correctness, transparency, purpose limitation
and storage, data minimisation, accuracy, integrity and confidentiality.

1. Data controller
The owner of the processing carried out through the Site is Comehome s.r.l. as defined
above, which can be reached at the e-mail address: dpo@comehome.fun.
The Data Controller has appointed a Data Protection Officer ('DPO') who can be reached
at: dpo@comehome.fun.

What personal data does Comehome use and why?

2. The personal data being processed
As a result of browsing the Site and the App, we inform you that Comehome will process
your personal data which may consist of an identifier such as your name, an identification
number, an online identifier or one or more characteristic elements of your physical,

physiological, psychological, economic, cultural or social identity which may make you
identified or identifiable (hereinafter only 'Personal Data').
The Personal Data processed through the Site are as follows:
1. common data (first name, surname, e-mail, location)
2. special data (e.g. special data that may be required in order to provide Comehome's
event organisation service)
Specifically, Comehome will process the following data:

a. Browsing and payment data

The computer systems and software procedures used to operate the Site acquire, during
their normal operation, some Personal Data whose transmission is implicit in the use of
Internet communication protocols. This information is not collected in order to be
associated with identified interested parties, but by its very nature could, through
processing and association with data held by third parties, allow users to be identified. This
category of data includes the IP addresses or domain names of the computers used by
users connecting to the Site, the URI (Uniform Resource Identifier) notation addresses of
the resources requested, the time of the request, the method used to submit the request to
the server, the size of the file obtained in response, the numerical code indicating the
status of the response given by the server (successful, error, etc.) and other parameters
relating to the user's operating system and computer environment. This data is used for
the sole purpose of obtaining anonymous statistical information on the use of the Site and
to check its correct functioning, to identify anomalies and/or abuses, and is deleted
immediately after processing. The data could be used to ascertain responsibility in the
event of hypothetical computer crimes to the detriment of the site or third parties: except
for this possibility, at present the data on web contacts do not persist for more than seven
days. By means of your IP address, in the tab at the top of our Site and within our App, we
can offer you a non-precise localisation of your location based solely on your IP address,
which allows Comehome to inform you of the locations of events in which you can
participate. Third-party services. If you connect, by accessing our Site/App via third-party
services (e.g. Google, Facebook) you are allowing these tools to send us information such
as, for example, registration data, friends list, and profile information that is either the data
controller of this service or as authorised by you through the privacy settings of this
service. If you use payment instruments, we will collect browsing data relating to the date
and time of the transaction, the amounts paid, the email address linked to the account of
the third-party service used, the IBAN, your address, and other details relating to each
transaction.
b. Special categories of personal data
When using certain sections of the Site and the App (for example, the section relating to
events or the section dedicated to HOSTs or SUPERHOSTs), you may be asked to
provide Personal Data falling within the special categories of Personal Data referred to in
art. 9 of the Regulation, namely "[…] data allowing the disclosure of racial or ethnic origin,
political opinions, religious or philosophical beliefs, or trade-union membership, as well as
genetic data, biometric data intended to uniquely identify a natural person, data concerning
health or sex life or sexual orientation. We invite you to communicate such data only
where necessary. Indeed, we would remind you that in the case of the transmission of
special categories of Personal Data, but in the absence of a specific manifestation of
consent in accordance with Article 9(2)(a) of the Regulations to process such data,
Comehome may not be held responsible in any way, nor may it receive any objections

whatsoever, since in this case the processing will be permitted insofar as it concerns data
which has been made manifestly public by the person concerned, in accordance with
Article 9(1)(e) of the Regulations. However, we specify the importance – as mentioned
above – of expressing your explicit consent to the processing of special categories of
Personal Data, should you decide to share such information.
Based on your consent, Comehome may customise, measure and improve our advertising
and marketing and that of our business partners. We may process this information to send
you promotional messages via in-app pop-ups or through newsletters and other
information that may be of interest to you based on your preferences, and social media
advertising through related platforms, to customise, measure, and improve our advertising,
to administer invitation programs, rewards, surveys, competitions, or other promotional
activities or events sponsored or managed by Comehome or its third-party partners, to
analyse characteristics and preferences in order to send you promotional messages from
our business partners.
Comehome will also collect your consent to invite you to relevant events and opportunities,
also with the cooperation of business partners.
With regard to the organisation of specific events concerning some of your interests of a
philosophical, political and cultural nature or in any case in the prodromal phases of the
processing of special data ex art. 9 GDPR, you may provide personal data under specific
request of consent through specific forms constructed by Comehome in order to
adequately inform you, conveying the information in this notice.
c. Data provided voluntarily by the data subject
In the use of some of the Services of the Site and the App, the processing of Personal
Data of third parties sent by you to Comehome may occur, for example, in the drafting of
comments and the issuing of reviews relating to the events held. With regard to these
hypotheses, you act as the autonomous controller of the processing, assuming all the
obligations and responsibilities of the law. In this sense, you grant Comehome the widest
possible indemnity in relation to any dispute, claim, request for compensation for damage
caused by processing, etc. which Comehome may receive from third parties whose
Personal Data has been processed through your use of the functions of the website in
violation of the applicable data protection regulations. In any case, should you provide or in
any other way process Personal Data of third parties in the use of the Site, you guarantee
as of now – assuming all related responsibility – that this particular hypothesis of
processing is based on an appropriate legal basis in accordance with Article 6 of the
Regulations which legitimises the processing of the information in question.
d. Cookies
The site’s Cookie Policy can be found at https://blog.comehome.fun/cookie-policy/.

3. Purpose of processing
The processing we intend to carry out, with your specific consent where necessary, has
the following purposes:
a. enable the provision of the Services you requested also in the private area of the
Site;
b. respond to requests for assistance or information;
c. recontact HOSTs and SUPERHOSTs in order to assist them in the organisation of
events;
d. profiling activities instrumental to the delivery of events;

e. communication of personal data to authorised partners;
f. fulfil any legal, accounting and tax obligations;
g. sending the newsletter

4. Legal basis and obligatory or optional nature of processing
The legal basis for the processing of Personal Data for the purposes set out in section 3
(a-b-c) is Article 6(1)(b) of the Regulation as the processing is necessary for the provision
of the Services or to meet the requests of the data subject. The provision of Personal Data
for these purposes is optional, but failure to provide it would make it impossible to activate
the Services provided by the Site or to respond to requests or help the HOSTs and
SUPERHOSTs in the organisation of events. With specific reference to the purpose 3.c)
and the related possibility of contact through the use of social profiles made freely
available on the Internet referred to in section 2.b, the legal basis of the processing is art.
6(1)(f) of the Regulation, i.e. the legitimate interest of the Data Controller in verifying any
risks regarding the candidate's suitability for the position of HOST and/or SUPERHOST.
The personal data processing activities relating to sections 3(d) and 3(e) are based on
Your consent, the legitimacy basis of which can be found in Article 6.1(a) of the
Regulation. Your consent is collected and given when creating your account on our Site
and App. This profiling processing is necessary in order to provide you with the prospectus
of events relating to your interests and the location in which you intend to use our
Services. With regard to the processing of communication to authorised partners, the
consent you provide in the Account creation phase allows Comehome to transfer your data
to Comehome's business partners for direct marketing purposes.
The purpose referred to in Section 3(f) is a lawful processing of Personal Data within the
meaning of Article 6(1)(c) of the Regulation. Once Personal Data has been provided, the
processing is necessary to comply with a legal obligation to which the Controller is subject.

5. Recipients of personal data
Your Personal Data may be shared, for the purposes set out in section 3, with:
a. parties typically acting as data controllers pursuant to Article 28 of the Regulation,
namely:
i. persons, companies or professional firms providing assistance and
consultancy to Comehome in accounting, administrative, legal, tax,
financial and debt collection matters relating to the provision of the
Services;
ii. commercial partners of Comehome;
iii. parties with whom it is necessary to interact for the provision of the
Services (e.g. hosting providers)
iv. or persons delegated to carry out technical maintenance activities
(including maintenance of network equipment and electronic
communication networks); (collectively 'Recipients'); the list of data
processors may be requested from the Controller by writing to the following
address: dpo@comehome.fun

b. subjects, entities or authorities, autonomous data controllers, to whom it is
mandatory to communicate your Personal Data by virtue of provisions of law or
orders of the authorities;
c. persons authorised by Comehome for the processing of Personal Data in
accordance with Article 29 of the Regulation, which is necessary to carry out

activities strictly related to the provision of the Services, who have committed
themselves to confidentiality or have an appropriate legal obligation of
confidentiality.

6. Transfers of personal data
Some of your Personal Data is NOT shared with recipients outside the European
Economic Area.
How long do we keep your data? How can you exercise your rights?

7. Data Retention
The Personal Data processed for the purposes set out in section 3(a-b-d-e) will be kept for
the time strictly necessary to achieve those purposes in compliance with the principles of
minimisation and limitation of storage pursuant to Articles 5.1.e) of the Regulation. In any
case, the Controller will process Personal Data for the time necessary to fulfil contractual
and legal obligations.
Further information on the data retention period and the criteria used to determine this
period may be requested by writing to the Data Controller at the following address:
dpo@comehome.fun

8. Rights of data subjects
Pursuant to Articles 15 et seq. of the Regulation, you have the right to request at any time,
access to your Personal Data, their rectification or deletion, the restriction of processing in
the cases provided for by Article 18 of the Regulation, to obtain in a structured, commonly
used and machine-readable format the data concerning you, in the cases provided for by
Article 20 of the Regulation. At any time, you may revoke, pursuant to Art. 7 of the
Regulation, the consent you have given; you may lodge a complaint with the competent
supervisory authority (Personal Data Protection Authority) pursuant to Art. 77 of the
Regulation, if you believe that the processing of your data is contrary to the legislation in
force.
You may formulate a request to object to the processing of your data pursuant to Article 21
of the GDPR in which you give evidence of the reasons justifying your objection: the Data
Controller reserves the right to assess your request, which would not be accepted if there
were compelling legitimate grounds for processing that override your interests, rights and
freedoms.
Requests should be addressed in writing to the Controller at the following address:
dpo@comehome.fun
The deletion of your account can be done manually by you:
from the website, by accessing the Profile, Privacy section, you can select Delete.

9. Modifications
This privacy policy is effective from 2 February 2022. Comehome reserves the right to
modify or simply update its content, in part or in full, due to changes in applicable
legislation. Comehome will inform you of these changes as soon as they are introduced
and they will be binding as soon as they are published on the website. Comehome
therefore invites you to visit this section regularly in order to familiarise yourself with the
most recent and up-to-date version of the privacy policy, so that you are always up-to-date
with the data collected and its use by Comehome.