How we handle your data.

1. Data controller

AGAPE srl, Contrada Laghezza, 150 · 70043 Monopoli (BA), Italy, VAT number IT08916540720. Email: info@neurogenesislab.it.

TO BE COMPLETED: state whether a Data Protection Officer (DPO) has been appointed and, if so, provide their contact details.

2. What data we collect

Data you provide. Through the contact form, we collect your name, email address, phone number (optional), the experience you are interested in and the text of your message.

Biofeedback parameters. If you choose an experience that includes them, we record heart rate variability (HRV) parameters and Bio-Well visualisations. These parameters have no diagnostic or medical purpose, do not constitute a diagnosis and do not replace the advice of a licensed healthcare professional. They are processed only with your separate, explicit consent, obtained before the readings are taken.

TO BE COMPLETED: confirm whether biofeedback parameters are retained after the report is provided or deleted at the end of the session, and whether they are linked to a name or pseudonymised. The answer affects the classification of the data and the resulting obligations.

3. Why we process your data and on what legal basis

• Responding to your requests for information and bookings: the legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).
• Providing the experience you have booked: performance of a contract (Article 6(1)(b) GDPR).
• Processing biofeedback parameters and providing your report: solely on the basis of your explicit consent (Article 6(1)(a) GDPR), which can be withdrawn at any time without affecting the experience already completed.

TO BE COMPLETED: if data is used in future for promotions, newsletters or CRM automations envisaged by the commercial strategy (a promotional code after 48 hours, abandoned cart reminders), these will require a dedicated purpose, their own legal basis and separate consent. This notice does not currently cover them.

4. How long we retain your data

TO BE COMPLETED: specify retention periods for each category (contact requests, booking data, biofeedback parameters, tax documents). Data cannot be retained indefinitely.

5. Who may receive your data

Your data is not shared with third parties for marketing purposes and is not stored in healthcare databases or medical records.

TO BE COMPLETED: list the data processors actually used and appointed under Article 28 GDPR: the hosting provider, email provider and, in future, the booking platform and payment provider. If any process data outside the European Economic Area, the applicable safeguard must also be stated (Article 44 onwards).

6. Your rights

You may request access to, rectification or erasure of your data, restriction of processing and data portability at any time. You may also object to processing (Articles 15 to 22 GDPR). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing already carried out.

To exercise these rights, write to info@neurogenesislab.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

7. Cookies and analytics tools

TO BE COMPLETED: declare which cookies and analytics tools are active. The site loads fonts from an external service (Google Fonts): this connection shares the visitor's IP address with a third-party provider and must be disclosed, or the fonts must be hosted locally to avoid that disclosure altogether.

8. Updates

TO BE COMPLETED: add the date of the last update when the final version is published.