General Terms & Conditions

Version 1.0 — In force from 24/04/2026

1. Preamble

Stravagando is an Italian digital platform operated by Inmedia S.r.l., with registered office at Via L'Aquila 22, 65122 Pescara (PE), Italy, VAT no. TBD (hereinafter also "Stravagando", "we" or the "Provider"). The platform allows users to discover extraordinary places throughout the territory (villages, trails, castles, restaurants and other points of interest), to share travel experiences with other users and to take part in a gamified exploration system based on check-ins, levels and badges.

These General Terms of Use (hereinafter the "Terms" or the "GTU") govern access to and use of the Stravagando platform, in its web and mobile components, by any registered natural person (the "User"). The GTU constitute a binding agreement between the User and Stravagando pursuant to the Italian Civil Code and Italian Legislative Decree No. 70/2003 on electronic commerce.

Access to and use of the platform imply full acceptance of these Terms. If the User does not intend to accept them, they are invited not to register and not to use the Service.

1.1 Related Documents

This document does NOT govern:

• purchase transactions for paid experiences offered by commercial Hosts, governed by the separate "Sales Terms and Conditions" and by the "Cancellation Policies" forming an integral part of such Conditions;

• the Stravagando "Referral Program", governed by the separate "Referral Program Terms";

• the obligations of commercial Hosts, governed by the separate "Host Terms";

• the processing of personal data, governed by the "Privacy Policy";

• the use of cookies and similar technologies, governed by the "Cookie Policy";

• the technical operating aspects of the Service, described in the "Service Technical Specifications" which form an integral part of these Terms pursuant to Section 19.1;

• the operational and detailed procedural aspects of the Service, described in the "Operational Guidelines" published on the platform.

Where these Terms refer to such documents, they form an integral part of the contractual relationship for the matters falling within their respective scope.

1.2 Document Hierarchy

In the event of interpretative conflict between documents, the following order of priority shall apply: any applicable Appendices based on the User's residence (where introduced), these General Terms, the Privacy Policy and Cookie Policy, the Service Technical Specifications, the Operational Guidelines.

For matters specifically governed by the Sales Terms, the Host Terms, or the Referral Program Terms, such special documents shall prevail within their respective scope, without prejudice to the mandatory consumer protections provided for by the Italian Consumer Code (Italian Legislative Decree No. 206/2005) and by EU law.

2. Definitions

For the purposes of these Terms, the following definitions apply:

• Service: the set of functionalities made available by Stravagando through the web platform and mobile applications, including the Places, Social/Community, Gamification and onboarding components.

• Service Technical Specifications (or "Specifications"): the technical document complementary to these Terms, which describes operational parameters, thresholds, formulas, quantitative limits and providers used. The Specifications form an integral part of the contractual relationship but follow a simplified update regime as set out in Section 19.

• Places (internal technical name: Atlas): the public section of the platform that presents points of interest (POIs: villages, trails, castles, restaurants and the like) on an interactive map, obtained from open sources (in particular OpenStreetMap), from User suggestions and from editorial content curated by the staff.

• POI (Point of Interest): an individual place or geographical entity catalogued in the Places catalogue, identified by geographical coordinates, descriptive attributes (name, category, address) and thematic categorisation. The term recurs in Sections 7 (Check-in), 11 (Trust Score) and 15 (Intellectual Property).

• Account: the User's personal space, accessible via credentials, from which the User can enjoy reserved functions.

• User: the natural person who accesses the Service and, where registered, holds an Account.

• Public Profile: the Account page visible to other Users or to search engines when the User has activated such visibility.

• Content or UGC (User-Generated Content): any content published by the User on the platform, including reviews, narrative posts, photos, suggestions for new places, edits to existing places, comments, personal notebooks, check-ins.

• Check-in: the geolocated registration carried out by the User in proximity to a place present in the Places catalogue, validated server-side through calculation of the distance from the POI coordinates.

• XP, Level, Achievements (corresponding to the technical entity Achievement in the system), Streak: symbolic elements of the gamification system, described in Section 9.

• Trust Score: a technical indicator (0-100) calculated automatically based on the consistency of a User's check-ins, described in Section 11.

• Moderation: the automated and/or manual activity of verifying the compliance of Content with these Terms.

• Customer (also Guest): the User who, pursuant to the Sales Terms, books or participates in paid experiences offered by Hosts (see Section 3-bis).

• Host: the User who, pursuant to the Host Terms, publishes and offers paid experiences to Customers (see Section 3-bis).

• Referrer: the User who, pursuant to the Referral Program Terms, participates in the referral program and receives benefits therefrom (see Section 3-bis).

3. Access requirements

Use of the Service is reserved to natural persons who jointly meet the following requirements:

• have reached the minimum age of 14 years, in accordance with the provisions of Article 2-quinquies of Italian Legislative Decree No. 196/2003 (Italian Privacy Code, as amended by Italian Legislative Decree No. 101/2018) implementing Article 8 of the GDPR. For residents of other EU/EEA Member States, the age of digital consent provided for by national law applies (generally between 13 and 16 years); the User warrants that they meet the minimum age applicable in their State of residence;

• have the legal capacity required to enter into contractual obligations under the law of their State of residence;

• be residents of a country in the European Union or the European Economic Area. The Service is optimised for that geographical area; access from other jurisdictions may not be supported or may present limited functionality.

Upon registration, the User shall confirm that they meet the age requirements set out above by ticking an appropriate acceptance box (Section 4). Stravagando reserves the right to introduce in the future the request for date of birth or other age verification systems, also in implementation of Article 28 DSA on the protection of minors. False declarations regarding age requirements constitute a violation of the Terms and entitle Stravagando to suspend or cancel the Account, without prejudice to any further legal remedy.

One Account per person. Each natural person may hold only one Account. The creation of multiple Accounts is prohibited, even through different identities, in particular for the purpose of unduly obtaining XP, levels, Achievements, followers or gamification advantages. Violation of this prohibition entails the suspension or cancellation of all connected Accounts, pursuant to Section 13.

3-bis. User's role in the marketplace

The User registered on the platform may operate in distinct roles within the context of the paid experiences marketplace and the accessory programs integrated with the Service:

• Customer (also Guest in international terminology): the User who books or participates in paid experiences offered by Hosts. When operating in this role, the User is subject, in addition to these General Terms for non-transactional matters, to the separate Sales Terms and Conditions;

• Host: the User who publishes and offers paid experiences to Customers. When operating in this role, the User is subject, in addition to these General Terms for non-transactional matters, to the separate Host Terms;

• Referrer of the Referral Program: the User who actively participates in the referral program by sharing their code and receiving benefits for each new User they invite. When operating in this role, the User is subject, in addition to these General Terms, to the separate Referral Program Terms.

These GTU continue to apply to the User in all the above roles for non-transactional matters (Account security, Profile, Social, Gamification, UGC, Places catalogue, moderation, sanctions). The regulation of economic transactions, payments, commissions, refunds and related obligations remains entrusted to the special documents referred to above.

The assumption of a special role does not entail loss or suspension of the User's general capacities, save where such special documents provide for specific obligations or restrictions linked to transactional operations.

4. Registration and Account

To access reserved functions, the User must register by providing the data requested by the registration form, namely: first name, last name, email address and password. The username visible on the platform is generated automatically by the system based on the data provided; the User may subsequently modify it, where such functionality is made available by Stravagando. Registration is free of charge.

Alternatively, the User may register and access the Service through federated authentication (Single Sign-On) via supported third-party identity providers (by way of example: Google, Meta/Facebook). In such case, upon successful authentication with the provider, Stravagando receives the essential identifying data (verified email address, name, any profile picture, unique identifier at the provider) needed to create or link the Account. The User who registers exclusively via SSO does not have a local password at Stravagando; access takes place solely through the chosen provider. Revocation of authorisation at the external provider entails the impossibility of accessing the Account through that channel but does not entail automatic deletion of the data retained by Stravagando.

Upon registration, the User shall confirm, by ticking an appropriate acceptance box, that they meet the age requirements set out in Section 3 and that they accept these Terms and the Privacy Policy. Ticking the relevant boxes constitutes a declaration of knowledge pursuant to Article 46 of Italian Presidential Decree No. 445/2000 for the purposes of Article 8(2) GDPR.

Stravagando reserves the right to introduce, even subsequently, the request for date of birth and/or more advanced age verification systems, for example as a result of regulatory obligations, evolutions of the Service or minors' protection purposes pursuant to Article 28 of Regulation (EU) 2022/2065 (DSA).

4.1 Email address verification

Following registration, Stravagando sends to the indicated email address a message containing a verification link. Stravagando reserves the right to make access to sensitive functionalities of the Service (by way of example: publication of Content, access to the marketplace) subject to prior verification of the email address, in accordance with methods that the platform may introduce in the future. For Users who register via federated authentication, the email is considered verified if the identity provider attests to its verification.

4.2 Account security

The User is responsible for the safekeeping of their credentials (password and/or authorisations granted to SSO providers) and for any activity carried out via the Account. In case of suspected unauthorised access, the User shall promptly notify Stravagando through the channels indicated in Section 28 and proceed to revoke the compromised credentials.

The User may activate two-factor authentication (2FA), based on TOTP authenticator application and recovery codes, pursuant to the security module implemented in the Service. Activation is recommended but not mandatory.

Re-authentication for sensitive operations. In order to protect the User from account takeover attacks and to ensure information security, the execution of certain operations (modification of email, password, visibility, indexing, leaderboard and companion tagging settings) requires confirmation of the current password, even with an active session.

4.3 Programmatic access tokens (API)

Stravagando reserves the right to make available to Users, in the future, the ability to generate personal access tokens for the programmatic use of the Service's APIs. This functionality is not currently active in production. Where introduced, tokens shall be: shown to the User only once at the time of creation and subsequently stored in hashed form by the system; possibly associated with enablement scopes implementing the principle of least privilege; revocable at any time by the User. The terms of use and technical characteristics will be specified in the Service Technical Specifications upon activation.

4.4 Access data retained

For security, audit and abuse-investigation purposes, Stravagando stores in sessions and in the main events (by way of example: login, check-in) the IP address and user-agent string of the browser. Such data are processed pursuant to the Privacy Policy and Article 6(1)(f) GDPR (legitimate interest in IT security).

The data provided must be truthful, complete and up-to-date. The User may modify them at any time from the page dedicated to the Profile (route /{locale}/user/profile).

5. Profile visibility

The User has four independent settings for visibility and privacy, manageable autonomously from the Account's privacy page (route account.privacy, accessible at the localised address /{locale}/account/privacy). Each setting produces distinct effects and coincidence with the others is not to be presumed. Modification of each setting requires confirmation of the current password, pursuant to Section 4.

5.1 Profile visibility (profile_visibility)

By default, the User's Profile is private: the personal page is not publicly accessible. The User may choose to make the Profile public, enabling visibility of the page /users/{username} to other Users and, depending on the further settings, to external search engines.

5.2 Indexing in search engines (allow_search_indexing)

By default, indexing is disabled. Activation of this setting takes effect only in conjunction with a public Profile and upon reaching a minimum threshold of User activity; in such case the public pages of the Profile may be indexed by third-party search engines (Google, Bing and the like). Such choice constitutes specific consent to the publication of Profile information in external search results.

5.3 Appearance in leaderboards (show_in_leaderboards)

By default, the User is included in public leaderboards (weekly, monthly, all-time, regional and national). The User may choose to deactivate this setting to obtain a granular opt-out, independent of Profile visibility. See Section 10 for the description of leaderboards and the technical timing for opt-out propagation.

5.4 Consent to UGC Tagging (allow_ugc_tagging)

By default, the User agrees to be tagged in Content published by other Users with whom they have a mutual-follow relationship, as governed by Section 8-bis (general regime of UGC Tagging, applicable in particular to posts on a Place's Wall) and, for the specific case of companion tagging in geolocated check-ins, by Section 8. The User may deactivate this setting at any time; in such case, attempts of UGC Tagging by other Users are discarded without notification to the protected User and without any impact on the experience of the tagging User.

5.5 Pro-futuro effect of changes

The modification of any of the above settings has effect pro-futuro. Copies already acquired by third-party search engines or by system snapshots (in particular leaderboard snapshots, see Section 10) may be removed only within the technical timeframes necessary, according to the procedures of the respective platforms or the internal update cycle.

6. User-Generated Content (UGC)

6.1 Types of Content

The User may publish various types of Content, including:

• photos (including capture metadata, see paragraph 6.6);

• reviews with rating (from 1 to 5) and text;

• narrative posts published on the wall;

• suggestions for new places to add to the catalogue;

• proposed edits to existing places;

• personal lists (Notebooks), tags, comments, likes;

• direct messages exchanged with other Users or with Stravagando support within dedicated conversations (Section 6.7).

6.2 Licence granted to Stravagando

By publishing Content on the platform, the User grants Stravagando a non-exclusive, royalty-free, worldwide licence, sub-licensable only to Stravagando's technical and promotional partners (by way of example: hosting services, CDN, marketing partners of the Service itself, translation and editorial syndication), limited to the purposes of management, publication, promotion and improvement of the Service, for the duration of the User's registration, with the right of reproduction, technical adaptation (e.g. resizing, transcoding), automatic translation and communication to the public in contexts connected to the Service.

The licence is revocable pro-futuro by deletion of the Content by the User or by request for total deletion of the Account. Revocation does not prejudice:

• uses already granted to sub-licensees prior to revocation, solely for the completion of activities already initiated and for the minimum period necessary;

• retention of technical backup copies and reduced/anonymous copies for aggregate statistical purposes, pursuant to the Privacy Policy.

The User retains full ownership of their Content and may at any time republish it elsewhere or monetise it on other platforms.

6.3 User warranties and responsibility

The User warrants, under their sole responsibility, that each published Content:

• is their own work or is covered by a licence/authorisation that allows publication and the granting of the licence referred to in Section 6.2;

• does not infringe copyright, related rights, trademarks, patents or other intellectual property rights of third parties;

• does not infringe third parties' rights to image, privacy or personal data protection (in particular, the User shall not publish photos of identifiable persons without their consent, save for the exceptions provided for by Article 97 of Italian Law No. 633/1941);

• does not constitute illegal, defamatory, misleading, discriminatory, obscene, violent, hate-inciting or self-harm-inciting content, nor undisclosed advertising content;

• does not promote illegal activities or breach any applicable law.

The User shall indemnify Stravagando from any third-party claims arising from breach of the warranties listed above, under the conditions set out in Section 24.

6.4 Moderation

Stravagando reserves the right, but not the obligation, to moderate published Content. Moderation may entail removal, blackout, request for modification or downgrading of Content. For details on the automated systems used, see Section 12; for the complaint and appeal system, see Sections 12-bis and 13.

6.5 Right of reply and deletion

The User whose Content is the subject of critical citation by other Users may request Stravagando to publish a brief reply, in accordance with methods that the platform may introduce in the future.

The User may delete their Content at any time. Deletion is carried out in soft-delete mode: the Content is immediately made invisible from the public interface but is retained in the database for 30 days for the purposes of any audits, security checks or internal disciplinary proceedings, after which it is definitively removed. The legal basis for such temporary retention is Stravagando's legitimate interest in preventing abuse and defending itself in litigation (Article 6(1)(f) GDPR). The cases of extended retention set out in Section 16.1 (legal hold) remain unaffected.

6.6 Processing of photo metadata (EXIF)

In line with privacy by design (Article 25 GDPR), Stravagando removes EXIF metadata from photographs uploaded by the User upon server-side processing, by re-encoding the image. The following are in particular removed: geolocation data (GPS), capture device model and serial number, original date and time, technical exposure parameters.

Such removal applies both to Profile photos and to photos uploaded as UGC (reviews, posts, contributions to the Places catalogue). Stravagando does not retain copies of the removed EXIF metadata: the operation is irreversible.

The User who wishes to preserve the metadata of one of their photos is invited to retain the original autonomously prior to uploading, since the version retained on the platform will be devoid of such information.

6.7 Private conversations and direct messaging

Stravagando makes available, in connection with the marketplace and the support Service, a direct messaging functionality that allows Users to exchange private communications in the following contexts:

• communications relating to a marketplace booking (between Customer and Host);

• pre-purchase information requests concerning marketplace experiences;

• support provided by Stravagando staff to registered Users;

• support provided by staff to non-registered Users (Section 17-ter).

Messages are visible solely to the participants of the conversation. Stravagando, as the Service provider, may access the contents of conversations exclusively for the purposes of:

• moderation upon report (Section 12-bis);

• investigation of abuse, violations of the Terms, illegal activities (Article 6(1)(f) GDPR);

• compliance with legal obligations and authority orders (Section 16.1).

Messages are treated as UGC and follow the retention and deletion rules set out in the preceding paragraphs. The removal of a message by the sender does not guarantee its deletion at the recipient's end, who may have retained a copy. The User is invited to use direct messaging with the same prudence as any other form of written communication.

7. Geolocated check-ins

The check-in is the User's registration of their presence in proximity to a place present in the Places catalogue. The check-in requires access to the device's GPS and transmission of the coordinates to the server, which validates the distance from the POI through calculation of the geodesic distance (Haversine formula) and assigns a reliability score (see Section 11).

The transmitted coordinates are rounded in system logs in order to limit the level of User tracking, with the precision indicated in the Service Technical Specifications. Such operation constitutes technical pseudo-anonymisation pursuant to Article 4(5) GDPR, not definitive anonymisation.

7.1 Check-in visibility

When carrying out the check-in, the User autonomously chooses the level of visibility thereof from among the following options:

• Only me (default setting): the check-in is visible exclusively to the User and is not shown to other Users nor indexed;

• Friends (mutual-follow): the check-in is visible exclusively to Users with whom the User has a reciprocal follow relationship on the platform;

• Everyone: the check-in is visible to any User registered on the platform and, where the User's Profile is public and indexable (Section 5), may be accessible also from external search engines.

The visibility choice is cumulative with the general Profile visibility settings described in Section 5: in particular, the "Everyone" choice on a single check-in does not make the User's Profile public if it is set as private; conversely, the closure of the Profile does not retroactively affect the visibility of past check-ins set as "Everyone", which will continue to be visible to entitled parties according to the settings in force at the time, save for subsequent modification by the User.

The User may modify the visibility of one of their check-ins at any time after publication. The modification has pro-futuro effect and does not affect copies possibly already acquired by third parties in the preceding technical timeframes.

The check-in contributes to the gamification system (XP, Achievements, Streak) and, where the User has activated the dedicated switch (Section 5.3), to public leaderboards, regardless of the visibility set. The User's appearance in leaderboards displays aggregated data (Level, period XP, username) and does not reveal the detail of single private check-ins.

For check-ins with visibility "Friends" or "Only me", any User tagged as a travel companion (Section 8) receives in any case notification of their involvement and may exercise the right of removal of the tag, for the purposes of safeguarding their image and privacy rights.

7.2 XP attribution

A validly registered check-in constitutes the principal mode of XP accrual in the gamification system described in Section 9. XP attribution is automatic and takes place according to the parameters in force at the time of check-in, which may vary based on:

• the category of the place visited (some POIs may attribute increased XP for editorial or promotional purposes, e.g. places of the week, thematic routes);

• the User's Trust Score (Section 11): check-ins by Users with low Trust Score may generate reduced XP, placed in pending until manual verification, or not generate XP if deemed unreliable;

• any multipliers linked to streaks, Achievements or promotional events on the platform.

Stravagando reserves the right to rectify XP attribution ex post in case of detection of anomalies, fraudulent check-ins, GPS spoofing or other violations of the Terms. The rectification may entail Level reduction, in accordance with Section 9.3.

7.3 Retention and deletion

Check-ins are retained in the User's activity history indefinitely, save for deletion at the User's request or exercise of the GDPR rights set out in Section 16. The deletion of a check-in removes it from the public interface and from the User's personal history, but does not automatically entail the reduction of accrued XP nor the loss of Achievements obtained, in consideration of the historical irrevocability of gamification recognitions (see Section 9.1). Stravagando reserves the right to revoke XP or Achievements exclusively in cases of confirmed abuse or fraud pursuant to Section 7.2.

The User is required to carry out authentic check-ins. Simulation of position via GPS spoofing or analogous techniques constitutes a violation of the Terms and is sanctioned pursuant to Sections 11, 13 and 14.

8. Companion tagging in check-ins

Companion tagging is the applied case of UGC Tagging (Section 8-bis) referring to geolocated check-ins under Section 7. The User may associate their own check-in with another User as a "travel companion".

The conditions of applicability (mutual-follow and prior consent), the notification and tag removal arrangements, the exclusion of liability of Stravagando and the prohibitions on abusive use set out in Section 8-bis apply in full, as far as compatible. The provisions below regulate the specifics of companion tagging in check-ins.

8.1 Maximum number of taggable Users per check-in

Each check-in may associate at most one User as a travel companion. Attempts at multiple associations are rejected by the system.

8.2 Daily anti-abuse limit

To prevent distortive uses of the mechanism for gamification purposes, a daily limit is set on the number of check-ins with companion tagging per User, as indicated in the Service Technical Specifications. Recurring exceeding of the limit, or recursive use of tagging in patterns deemed abusive, constitutes sanctionable conduct under Section 14, without prejudice to Section 8-bis.6.

8.3 Gamification recognitions

Unlike UGC Tags applied to other types of Content (see Section 8-bis.8), companion tagging in check-ins contributes to the gamification system with specific recognitions, attributable both to the tagging User and to the tagged User. Such recognitions include the attribution of XP and the possible unlocking of dedicated Achievements.

The quantitative parameters (XP amount per tagged check-in, unlock thresholds of related Achievements, any daily caps for gamification purposes) are indicated in the Service Technical Specifications and may be updated under the regime set out in Section 19.

The retroactive rectification or revocation of XP and Achievements connected to companion tagging follows the general rules of Section 7.2 and Section 9.3, in particular in cases of confirmed abuse, fraud or GPS spoofing.

8-bis. Tags and mentions of other Users in Content (UGC Tagging)

Stravagando allows the User to associate the reference to other registered Users (hereinafter, "UGC Tags") with certain Content published on the platform. The rules set out below constitute the general regime of UGC Tagging, applicable to all types of Content for which the feature is enabled; for the specific case of companion tagging in geolocated check-ins, the provisions of Section 8 apply additionally.

8-bis.1 Scope of application

UGC Tagging is currently available for the following types of Content:

• check-ins at a Place, with one taggable User per check-in (Section 8);

• posts published on the Wall of a Place, with the possibility of tagging up to a maximum of ten Users per post.

Stravagando reserves the right to extend the UGC Tagging feature in the future to other types of Content, or to limit its scope of application, with reasonable notice to Users in accordance with the procedures referred to in Section 19.

8-bis.2 Conditions of applicability

A UGC Tag may be applied only when both of the following conditions are met:

• mutual-follow relationship between the tagging User and the tagged User (both must follow each other on the platform);

• prior consent of the tagged User, expressed through the setting "Allow others to tag me in content", active by default and modifiable at any time from the Profile settings (see Section 5.4).

Where one of the two conditions is not met, the UGC Tagging attempt is silently ignored by the system: the Content is published without any reference to the non-taggable User and no notification is generated, neither to the tagging User nor to the protected addressee.

8-bis.3 Notification and visibility

The validly tagged User:

• receives an in-app notification and, according to their notification preferences (Section 17), a possible email notification at the time of the effective publication of the Content containing the Tag;

• views the Content in their "Personal Feed" section (route /{locale}/feed), among the received mentions.

8-bis.4 Tag removal

The tagged User has the right to remove their Tag at any time from the Content, without need for justification, through the link present in the notification or directly from the Profile. The removal is immediate and definitive and does not entail the deletion of the Content itself, which remains published without the association to the User who exercised the right. The User who originally applied the Tag may also remove it autonomously.

The User who applied the Tag receives a notification of the removal carried out by the addressee, without indication of motivation. The system retains record of the operation (timestamp and identifier of who removed the Tag) for audit and abuse-prevention purposes, in accordance with the procedures described in the Privacy Policy.

8-bis.5 UGC Tags and Content under moderation

Where the Content to which a UGC Tag is associated is pending publication because placed under review by the moderation system (Sections 6.4, 11 and 12), any tagged Users do not receive any notification until the effective publication of the Content.

Should the Content ultimately be rejected upon moderation, no notification relating to the UGC Tag is transmitted and the association remains devoid of public effects.

8-bis.6 Prohibitions on abusive use

The use of the UGC Tagging feature for purposes of harassment, stalking, spamming, unauthorised marketing, defamation or commercial promotion of one's own products or services is prohibited.

Repeated or abusive use of UGC Tagging — by way of example: the insistent application of Tags to a User who has removed them several times, or the use of Tags for undisclosed advertising purposes — constitutes a violation of these Terms and entitles Stravagando to apply the sanctions referred to in Section 13, without prejudice to the liability provided for in Section 14-bis on advertising transparency and in Section 24 on indemnification.

8-bis.7 Exclusion of liability of Stravagando

Stravagando acts as a neutral hosting service provider in relation to the content of the UGC Tag. The responsibility for the application of the Tag, the truthfulness of the mention and any third-party claims remains exclusively with the tagging User, in accordance with the warranties and indemnification obligations set out in Sections 6.3 and 24.

8-bis.8 Effects on the gamification system

The application of UGC Tags to posts on the Wall of a Place does not entail the attribution of experience points (XP) nor the unlocking of Achievements, neither to the tagging User nor to the tagged User.

For UGC Tags applied to check-ins within the companion tagging feature, the specific discipline of Section 8 and the related gamification recognitions provided for in Section 9 and in the Service Technical Specifications apply instead.

9. Gamification system (XP, Levels, Achievements, Streak)

Stravagando offers a gamified system aimed at encouraging territorial exploration. The system is primarily fed by geolocated check-ins (Section 7) and, in an accessory manner, by other User activities on the platform. The system includes:

• XP (experience points): points accumulated through valid check-ins (principal mode), publication of reviews, posts and photos, completion of Achievements, maintenance of streaks. The XP→Level conversion formula is described in the Service Technical Specifications;

• Levels: progression on a numerical scale calculated based on total XP accumulated, according to the scale indicated in the Specifications;

• Achievements (badges): symbolic recognitions unlocked upon the occurrence of certain conditions (e.g. visit of a certain number of places, exploration of a region, completion of a thematic route). Achievements may be classified into symbolic value bands as indicated in the Specifications;

• Streak: consecutive activity series, with milestone recognitions as indicated in the Specifications;

• Level Perks: benefits associated with reaching certain Levels, predominantly cosmetic in nature or providing early access to beta features. They may include discount codes applicable to the separate marketplace (governed by the Sales Terms), access to editorial programs or other symbolic benefits, according to the categories indicated in the Specifications;

• Year Review: periodic report of the User's activity, generated with the frequency and format indicated in the Specifications.

The attribution of XP for each type of activity is determined by the technical rules in force, published in the Specifications or available in the platform's help section, and may be modified by Stravagando in accordance with paragraph 9.3.

9.1 Symbolic nature

XP, Levels, Achievements, Badges, Streaks and any other gamification element of the platform are exclusively symbolic and gamified in nature. They DO NOT constitute virtual currency, have NO monetary value, are NOT convertible into money or other goods or services, are NOT transferable between Users and are NOT resellable to third parties. The User has no credit claim against Stravagando in relation to such elements.

9.2 Level Perks and discount codes

Certain Levels may grant access to discount codes usable on the paid experiences marketplace. Such codes are governed exclusively by the "Sales Terms and Conditions". The codes have promotional nature, may have expiry, usage limits and specific conditions; they are not transferable and not convertible into money.

9.2-bis Beta (experimental) features

Certain Level Perks may include early access to features under development or testing (beta access). The User who accesses such features acknowledges and accepts that:

• beta features are experimental, provided "as is", and may present malfunctions, errors, data loss or interruptions;

• access may be revoked, modified or terminated by Stravagando at any time, even without notice, for technical, economic or product development reasons;

• beta features may never be promoted to stable features of the Service;

• Stravagando encourages beta Users to provide constructive feedback for product improvement.

Possible participation in beta does not generate contractual rights additional to those deriving from these Terms.

9.3 Right to modify the system

Stravagando reserves the right to modify rules, thresholds, XP calculation formulas, definition of Achievements, streak decay rules and any other parameter of the gamification system. Significant modifications will be communicated with 30 days' notice via email and in-app notification. Non-significant modifications or technical corrections (by way of example: anti-abuse, bug-fix, point rebalancing) may be applied without notice. Retroactive attribution of benefits or zeroing of benefits acquired through abuse remain always possible, motivated and notified to the interested User.

10. Public leaderboards

Stravagando publishes periodic leaderboards of the most active Users on a regional, national and general basis, and for different periods (week, month, all-time). The capacity of each leaderboard and the available periods are indicated in the Service Technical Specifications.

The appearance of a User in the leaderboard is subject to activation of the dedicated switch "show in public leaderboards" in the Profile settings (Section 5.3). Such switch is independent of the general Profile visibility (Section 5.1): the User may therefore have a public Profile but choose not to appear in the leaderboard, or vice versa.

The leaderboard displays username, profile photo (if present), level and period XP. The User may deactivate their leaderboard visibility at any time through the show_in_leaderboards setting (Section 5.3). Leaderboard snapshots are periodically regenerated at the cadence indicated in the Specifications; for technical reasons, the User who opts out may continue to appear in already published snapshots until their next update. Such propagation window is deemed acceptable in consideration of the non-sensitive nature of the data exposed (username, level, period XP).

11. Trust score and check-in verification

Each User holds a Trust Score (0-100) calculated automatically based on the technical consistency of their check-ins (e.g.: distance from the POI, frequency between geographically distant check-ins, patterns compatible with real-world use).

The Trust Score influences:

• the XP attribution for check-ins (Section 7.2): Users with low Trust Score may receive reduced XP or have it placed in pending until manual verification;

• the automatic publication of reviews (auto-approve for Users with high score; manual review for low score);

• the priority in content moderation;

• the possibility to access functionalities reserved for consolidated Users.

11.1 Automated decisions and human intervention

The calculation of the Trust Score and the decisions deriving therefrom constitute automated processing pursuant to Article 22 GDPR. The User has the right to request human intervention, to express their opinion and to contest the decision, by writing to the contacts indicated in Section 28. Stravagando undertakes to provide a reasoned reply within reasonable timeframes and in any case no later than 30 days from the request, save for complex cases requiring further investigation.

12. Automated moderation (AI Systems)

Stravagando uses third-party artificial intelligence systems to analyse pre-publication the Content uploaded by Users:

• an Anthropic language model for the textual classification of reviews, posts, comments and proposals;

• a Google image analysis service for the detection of adult, violent or offensive content in photos.

The specific identity of the models used, the confidence thresholds, the criteria for fast-track access for Users with positive history and the operational spending limits are indicated in the Service Technical Specifications and may be updated in accordance with the regime set out in Section 19.

A fallback to manual review is always provided for borderline cases, for cases in which automated systems are unavailable or for Content pending upon exceeding operational limits.

Each AI system decision is recorded in a dedicated system table (decision, motivational code, results, cost, latency). Such metadata are used for purposes of audit, system improvement, management of any complaints and compliance with the transparency obligations referred to in paragraphs 12.1 and 12.2.

12.1 Transparency

In compliance with Regulation (EU) 2024/1689 (AI Act) and Article 22 GDPR, Stravagando expressly informs that UGC Content is subjected to automated analysis and that the metadata of such analysis (decision, motivational code, confidence threshold, model used) are retained for purposes of audit, system improvement and management of any complaints.

12.2 Right to information

The User whose Content is subject to removal, blackout or modification request receives a communication containing the decision adopted, the motivation and the indication of the right to complaint (Section 12-bis), in compliance with the principles of Article 17 of Regulation (EU) 2022/2065 (Digital Services Act). Stravagando is progressively adapting the format and content of such communication to the specific DSA requirements, including interactions with the EU Commission and the database of statements of reasons.

12.3 Right to human review

The User may request human review of the moderation decision within 14 days of notification. The review is carried out by qualified Stravagando personnel and does not take place through the same automated system that issued the contested decision. Stravagando undertakes to provide a reasoned reply within reasonable timeframes and in any case no later than 30 days from the request, save for complex cases requiring further investigation.

12-bis. Notification of illegal content, complaints and out-of-court resolution (DSA)

In compliance with Regulation (EU) 2022/2065 (Digital Services Act), Stravagando makes available:

12-bis.1 Notice & action mechanism

Any User or third party may report the presence of content deemed illegal or contrary to these Terms through the reporting form (content report) accessible from the interface of the Content itself, pursuant to Article 16 DSA. The report shall indicate:

• a motivation chosen from predefined categories (by way of example: spam, inappropriate content, out of context, harassment, other);

• the reference to the Content reported (automatically populated by the interface);

• the details of the reporter, save for content falling within Articles 3-7 of Directive 2011/93/EU, for which anonymous reporting is admitted;

• the good faith statement of the reporter.

Protection of the reporter's anonymity. The identity of the party reporting Content is not exposed to the reported User at any stage of the procedure, in order to prevent retaliation and to ensure freedom of reporting. The reporter's identity may be revealed exclusively upon request of the competent authority.

Handling workflow. Reports feed a counter on the Content. Upon reaching a threshold (indicated in the Technical Specifications), the Content is automatically placed in precautionary suspension state (blacked out from the public interface) pending review by the staff. The review concludes with one of the following decisions: archiving of the report, removal of the Content, warning to the User, escalation to sanction pursuant to Section 13.

Stravagando provides timely feedback to the reporter on the decision adopted and the relative motivation, pursuant to Article 16(5) DSA.

12-bis.2 Internal complaints

The User who is the addressee of a moderation decision (removal, blackout, suspension, ban) has the right to lodge a free internal complaint within 6 months from notification of the decision, pursuant to Article 20 DSA. The complaint is examined without undue delay by qualified personnel not involved in the initial decision.

12-bis.3 Out-of-court dispute resolution bodies

The User who is not satisfied with the outcome of the internal complaint may turn to an out-of-court dispute resolution body certified pursuant to Article 21 DSA. The list is published by the European Commission.

12-bis.4 Trusted Flagger

Reports from parties recognised as "trusted flaggers" pursuant to Article 22 DSA are handled with priority.

The status of trusted flagger is granted exclusively to parties formally designated by the Digital Services Coordinator of the Member State of establishment (in Italy, AGCOM), based on the requirements provided by Article 22(2) DSA: specific expertise in detecting illegal content, independence from hosting service providers, transparent, accurate and objective activity.

Stravagando may suspend the status of trusted flagger with respect to parties who have submitted a significant number of manifestly unfounded reports, in compliance with Article 22(3) DSA, subject to formal warning and right to be heard. Stravagando publishes annually a report on the use of the trusted flagger mechanism pursuant to Article 22(4) DSA, available in the legal section of the platform.

12-bis.5 Single points of contact

In compliance with the Digital Services Act, Stravagando designates two distinct points of contact:

• Point of contact for authorities (Article 11 DSA): the email address legal@stravagando.com, dedicated to direct electronic communications between Stravagando and the authorities of the Member States, the European Commission and the European Board for Digital Services. Communications in Italian and English are accepted. Requests are handled with timing compatible with the urgent nature of competent authorities' requests;

• Point of contact for service recipients (Article 12 DSA): the email address support@stravagando.com, dedicated to direct communications from Users, as an alternative to the ordinary support channels indicated in Section 28. Communications in Italian and English are accepted.

Stravagando, being established in the European Union (Italy), is not required to designate a specific legal representative pursuant to Article 13 DSA.

13. Account sanctions

In the event of violation of these Terms, Stravagando applies a graduated system of sanctions:

1. Warning: formal violation communication, without operational limitations;

2. Restricted: the Account is placed in read-only mode for a determined period; the User retains access to their data but cannot publish new Content;

3. Suspended: temporary suspension of the Account with a predetermined reactivation date;

4. Banned: permanent block of access to the Account. The User's public Content is immediately blacked out and subsequently subject to the extended retention regime referred to in the last paragraph of this Section, with a view to definitive deletion.

The sanction is notified by email to the registered address, contains the motivation, the reference to the violated provision, the indication of the right to complaint and the deadlines for exercising it.

In the event of ban, the User's Content is hidden from the public interface (soft-delete) but retained for 90 days for the purposes of managing any complaints, internal disciplinary investigations and legal proceedings, save for the cases of extension pursuant to Section 16.1 (legal hold).

13.1 Right to complaint

The User has the right to lodge a complaint within 30 days from notification of the sanction, in accordance with the mechanism described in Section 12-bis.2. The right to apply to the judicial authority remains unaffected.

13.2 Proportionality

The severity of the sanction is proportionate to the seriousness of the violation, recidivism and impact on other Users. For serious violations (by way of example: hate speech, doxxing, exploitation of minors, fraud), Stravagando may directly apply the most severe sanction.

14. Prohibited conduct

By way of example and not exhaustively, it is prohibited to:

• use bots, scripts or automated systems to accumulate XP, likes, followers or to simulate activity;

• create or use multiple Accounts, including for suspicious reciprocal exchanges;

• engage in spam, in violation of the publication operational limits and anti-duplicate systems indicated in the Service Technical Specifications;

• publish content of hate speech, harassment, doxxing, threats;

• engage in unauthorised scraping of data from the Places catalogue, Profiles or other sections of the platform in violation of the imposed technical limitations (robots.txt, rate-limit, non-public API);

• carry out false check-ins via GPS spoofing or other position simulation techniques: such attempts entail lowering of the Trust Score and sanctions;

• use the Service for unauthorised commercial purposes, in particular to promote one's own commercial activities via UGC (example: writing positive reviews about one's own business while pretending to be an ordinary user, or using the Profile for advertising);

• upload malware, malicious code or attempt unauthorised intrusion/penetration testing;

• infringe third parties' copyright, trademark or patent rights;

• impersonate other parties, including public figures;

• publish sexually explicit material or material involving exploitation of minors (promptly reported to the competent authorities);

• circumvent the technical limitations of the Service or applied sanctions.

The list is not exhaustive. Stravagando reserves the right to assess on a case-by-case basis any conduct contrary to the purposes of the Service.

14-bis. Advertising transparency and sponsored content

14-bis.1 Identification of advertising content

In compliance with Articles 26 and 28 of Regulation (EU) 2022/2065 (DSA) and with Italian Legislative Decree No. 145/2007 (misleading and unlawful comparative advertising), Stravagando undertakes to identify in a clear, concise, unambiguous and real-time manner, through standardised labels or visual badges, any content of advertising, sponsored or promotional character present on the platform. The following are in particular qualifiable as such:

• sponsored listings by Hosts (experiences in sponsored or featured position) in the integrated marketplace (see Article 3.10 of the Sales Terms);

• sponsored editorial content produced in partnership with tourism destinations, commercial brands, public or private entities;

• promotional newsletters produced in collaboration with sponsors or commercial partners (see Section 17-bis);

• posts or reviews by Users produced in the context of affiliation agreements, commercial partnerships, exchange of products/services or declared sponsorships, mandatorily identified with a dedicated label (see paragraph 14-bis.4).

14-bis.2 Advertising based on sensitive data

In compliance with Article 26(3) DSA, Stravagando does not use for advertising purposes personal data falling within the special categories referred to in Article 9 GDPR (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, sex life or sexual orientation).

14-bis.3 Advertising aimed at minors

In compliance with Article 28 DSA, Stravagando does not display targeted advertising based on profiling, as referred to in Article 4(4) GDPR, to Users who are presumed with reasonable certainty to be minors. The technical and organisational measures adopted to this end are described in the Service Technical Specifications and include, among others, the exclusion of advertising profiling signals for Accounts that have declared an age below 18 years or for which behavioural indicators consistent with minority status are present.

14-bis.4 User obligations on own sponsored content

The User who publishes UGC Content in the context of affiliation, sponsorship, commercial partnership or product/service exchange agreements with commercial Hosts, tourism brands, entities or third parties is required to:

• explicitly declare the promotional nature of the Content, through adequate indication (by way of example: #adv, #sponsored, "[Advertising content]", "[Commercial collaboration]");

• not conceal the promotional nature through forms of misleading advertising or native advertising that is not identifiable as such;

• comply with the indications of the competent authorities (Italian Communications Regulatory Authority — AGCOM, Italian Competition Authority — AGCM, Italian Institute of Advertising Self-Regulation — IAP) on transparency in the relationships between content creators and sponsoring brands.

Violation of these obligations may result in removal of the Content, application of the sanctions referred to in Section 13 and — where configurable as an unfair commercial practice — reporting to the competent authorities.

14-bis.5 Advertising repository (VLOP qualification)

Should Stravagando in the future acquire the status of "very large online platform" (VLOP) or "very large online search engine" (VLOSE) pursuant to Chapter III, Section 5 of the DSA, a public advertising repository will be activated pursuant to Article 39 DSA, accessible through a searchable and reliable interface. At the current stage such qualification does not subsist and the obligation is not applicable, without prejudice to Stravagando's right to voluntarily adopt analogous transparency standards.

15. Intellectual property

15.1 Stravagando's rights

The "Stravagando" trademark, the logo, the interface design, the source code, the aggregated database of places and contributions (limited to structure, organisation and editorial enrichments), the editorial content curated by the staff and all software components of the platform are the exclusive property of Inmedia S.r.l. or its licensors. Any reproduction, modification, distribution or commercial use without express written authorisation is prohibited.

15.2 OpenStreetMap data

A significant portion of the data in the Places catalogue is obtained from OpenStreetMap, distributed under Open Database License (ODbL) v1.0. Stravagando complies with the ODbL licence obligations applicable to its use of the data, including in particular:

• clear display of the attribution "© OpenStreetMap contributors" on every page presenting OSM data;

• compliance with the qualification criteria of its use (Produced Work / Derivative Database) pursuant to Section 4 of the ODbL licence.

Users who reuse Places catalogue data are required to comply autonomously with the applicable ODbL licence.

15.3 Citations and editorial fair use

Any citations of third-party content within posts or editorial articles respect the limits of editorial fair use and of Article 70 of Italian Law No. 633 of 22 April 1941 (Copyright). Users are required to similar respect in their own publications.

16. Personal data and privacy

The processing of personal data is governed by the Privacy Policy, forming an integral part of these Terms. In summary:

• Stravagando processes geolocation data (lat/lng, rounded in logs for pseudo-anonymisation purposes, see Section 7) for the functioning of check-ins;

• Uploaded photos are subject to server-side EXIF metadata stripping, to limit the unintentional dissemination of coordinates or other technical data;

• Data is retained indefinitely save for express deletion or exercise of GDPR rights;

• The User exercises the rights provided for by Articles 15-22 GDPR (access, rectification, erasure, restriction, objection, portability, human intervention on automated decisions) through the Account's privacy page (route account.privacy), from which it is in particular possible to request export of one's data (route account.gdpr.export), or by writing to the Data Protection Officer at legal@stravagando.com. The portability export pursuant to Article 20 GDPR does not include Content subject to legal hold (Section 16.1); inclusion of such Content is possible only upon formal request of the competent authority;

• The right to erasure (Article 17 GDPR) entails the total deletion of the Account and the User's Content, without prejudice to the retention obligations provided for by law (e.g. tax obligations in case of marketplace purchases) and without prejudice to the retention in anonymised form of aggregate data for statistical purposes, where technically irreversible;

• The Data Controller is Inmedia S.r.l.; the DPO is reachable at legal@stravagando.com.

16.0 Transparency on third-party providers (data processors)

For the functioning of the Service, Stravagando makes use of third-party providers qualifiable as data processors pursuant to Article 28 GDPR, or as joint controllers or autonomous controllers in specific cases, in particular for:

• automated moderation of textual and photographic content (Section 12);

• transport of transactional, service and marketing email communications (Sections 17 and 17-bis);

• delivery of web and mobile push notifications;

• processing of payments relating to the marketplace, entrusted to Stripe Payments Europe Ltd as autonomous data controller for the purposes of payment execution, anti-fraud and financial compliance, in accordance with the Sales Terms;

• importation of open cartographic data for the Places catalogue;

• federated authentication (SSO) via third-party identity providers (see Section 4): in this context the providers may operate as autonomous controllers for the data they manage on their own infrastructure, while Stravagando is the controller for the data received and subsequently processed in its system;

• analytics and web traffic measurement, activated exclusively upon User consent expressed through the cookie banner and managed according to the Consent Mode v2 model (see Section 18).

The updated list of providers, the type of data transferred to them, the legal basis for the transfer, any extra-EU localisation and the safeguards adopted (standard contractual clauses, Commission adequacy decision where applicable, Article 46 GDPR) are detailed in the Privacy Policy and, for technical parameters, in the Service Technical Specifications.

16.1 Extended retention for legal obligations and legal hold

In derogation from the ordinary retention periods provided for in these Terms (in particular, but not limited to, Sections 6.5, 13 and 20), Stravagando reserves the right to extend the retention of specific data or Content beyond the standard term, limited to what and for the time strictly necessary, upon the occurrence of one of the following circumstances:

• formal request from the judicial authority, judicial police or other competent authority (by way of example: production orders, evidentiary seizures, preservation orders pursuant to Article 254-bis of the Italian Code of Criminal Procedure, requests pursuant to the Budapest Convention on Cybercrime, orders of the Italian Data Protection Authority);

• internal disciplinary proceedings or DSA complaint in progress, referred to in Sections 12-bis and 13, until their definition;

• legal dispute, judicial or extrajudicial, pending or reasonably foreseeable, concerning the data or Content in question, for the exercise or defence of a right in court (Article 17(3)(e) GDPR);

• specific legal obligation imposing retention (by way of example: tax obligations pursuant to Article 2220 of the Italian Civil Code for data relating to marketplace transactions; anti-money-laundering obligations pursuant to Italian Legislative Decree No. 231/2007 and Regulation (EU) 2024/1624; tax reporting obligations pursuant to Directive (EU) 2021/514 (DAC7) and Italian Legislative Decree No. 32/2023; obligations to retain telematic traffic data pursuant to Italian Legislative Decree No. 196/2003).

In all these cases:

• retention is limited to the data and Content specifically relevant to the purpose justifying the extension, and does not extend to the User's entire information assets;

• data retained under legal hold is accessible exclusively to authorised personnel and to the recipients of the legitimate request, and does not fall within the ordinary visibility of the platform;

• the duration is that strictly necessary to achieve the purpose; once the cause has ceased, the data is deleted without further delay;

• where not prohibited by the requesting authority or by legal rules (for example, for investigative secrecy pursuant to Article 329 of the Italian Code of Criminal Procedure), Stravagando informs the interested User of the extension and the relative motivation, compatibly with investigative needs.

The existence of a legal hold procedure does not in itself suspend or limit the User's rights under Articles 15-22 GDPR, without prejudice to the exceptions provided for by Article 23 GDPR and applicable legislation (investigative secrecy, justice requirements, etc.).

17. Service notifications and communications

This Section governs the service communications addressed to the User in connection with the provision of the Service and the performance of the contract (for example: updates on check-ins, social interactions, gamification, Account security, modifications to the Terms). Their legal basis is contractual performance pursuant to Article 6(1)(b) GDPR or Stravagando's legitimate interest pursuant to Article 6(1)(f) GDPR. For direct marketing communications, see Section 17-bis.

Stravagando may send the User service notifications via:

• email (to the registered address);

• web push notifications (where the User has granted browser consent);

• mobile push notifications (where the User has enabled push notifications on future native iOS and Android applications);

• in-app notifications consultable within the platform.

The technical providers used for each channel are indicated in the Service Technical Specifications.

The User may activate/deactivate their consent for each notification category in the Account settings. In particular, the categories are divided into:

• service categories (by way of example: social notifications, gamification, informational marketplace activity): deactivation is always possible;

• marketing-utility categories linked to the contractual relationship but of promotional nature (by way of example: pre-experience reminders for bookings made, invitations to review after the experience, general promotional communications): sending is subject to opt-in User consent, granular for each category, and withdrawal of consent is always possible;

• essential categories (by way of example: modifications to the Terms, Account suspension, security alerts, marketplace receipts, legal communications, Account deletion confirmation): non-deactivable as necessary for the performance of the contract and for Stravagando's compliance with its obligations.

For the direct marketing newsletter and general promotional communications also addressed to non-Users, see Section 17-bis.

17-bis. Newsletter and direct marketing communications

This Section governs the promotional and direct marketing communications sent by Stravagando to the User (for example: periodic newsletter on new catalogue places, editorial articles, Atlas news, marketplace initiatives).

17-bis.1 Distinction from service communications

Marketing communications are distinguished from service communications (Section 17) by purpose, legal basis and consent regime. In particular:

• service communications have their legal basis in contractual performance (Article 6(1)(b) GDPR) or legitimate interest (Article 6(1)(f) GDPR) and are not fully deactivable insofar as they are essential to the Service;

• marketing communications have their legal basis in the data subject's express consent (Article 6(1)(a) GDPR and Article 130 of Italian Legislative Decree No. 196/2003) and can be deactivated at any time by the data subject without prejudice to use of the Service.

17-bis.2 Subscription and double opt-in

Newsletter subscription takes place through express and active manifestation of consent by the data subject (by way of example: filling in a dedicated form on the site, ticking a non-pre-selected optional box at marketplace checkout, subscription through editorial articles).

The subscription follows the double opt-in model: following the subscription request, the data subject receives a confirmation email containing a validation link. Only after activation of such link does the subscription become effective and the data subject can receive marketing communications. Unconfirmed requests lapse.

The subscription may take place independently of holding a Stravagando Account: the newsletter is offered also to parties not registered on the platform. Where the subscriber holds an Account, the subscription status is consultable from the Account's privacy page (Section 5).

For proof of consent pursuant to Article 7 GDPR, Stravagando records at the time of subscription: email address, any name, preferred language, source of subscription, IP address, browser user-agent, timestamp of acceptance of the privacy notice.

17-bis.3 Unsubscription

The data subject may withdraw at any time their consent and unsubscribe from the newsletter, without need for justification and free of charge, through:

• the unsubscribe link present in the footer of every marketing email (recommended method);

• the one-click unsubscribe mechanism provided for by industry deliverability standards (RFC 8058), typically available directly from the email provider's interface;

• request sent to the Provider or to the Data Protection Officer at the contacts in Section 28.

Withdrawal of consent does not prejudice the lawfulness of processing carried out prior to the withdrawal itself (Article 7(3) GDPR) and does not affect the service communications referred to in Section 17.

17-bis.4 Retention of unsubscription data

Following unsubscription, Stravagando retains the record of the unsubscription (in particular the email address in a form sufficient for unique identification and the withdrawal metadata) as suppression list for purposes of:

• ensuring the data subject's respect of the choice not to be contacted further over time, avoiding accidental re-subscriptions and new sendings;

• documenting the unsubscription in case of complaints or investigations.

The legal basis for such retention is the legitimate interest in suppression pursuant to Article 6(1)(f) GDPR, as well as compliance with Article 7(3) GDPR itself (obligation to respect consent withdrawal). Inclusion in the suppression list is less invasive, from the data subject's protection perspective, than full deletion of the data, as it specifically prevents unwanted contact.

The data subject is nevertheless entitled to request deletion also of the suppression record, acknowledging the consequences (any future re-subscription by the same data subject will no longer be recognised as such by the system).

17-bis.5 Providers and transfers

The sending of marketing and service communications is carried out through a third-party email provider, qualified as data processor pursuant to Article 28 GDPR and indicated in the Service Technical Specifications. For the safeguards applied to extra-EU transfers, see Section 16.0 and the Privacy Policy.

17-ter. Assistance to non-registered visitors (guest help)

Stravagando makes available a pre-registration support channel allowing any visitor to contact the Service without need for an Account. The request takes place via a public form in which the visitor provides a valid email address and their query. Stravagando sends to the indicated address an access token allowing the visitor to consult the replies and continue the conversation, without need for permanent credentials.

The data collected in this manner is processed in accordance with the Privacy Policy. Guest help conversations are subject to automatic closure for inactivity after a determined period (indicated in the Technical Specifications), after which the data is retained according to the retention rules applied to UGC Content and to the legal hold cases referred to in Section 16.1.

18. Cookies, local storage and analytics

The use of cookies and similar technologies is governed by the Cookie Policy, in compliance with the Italian Data Protection Authority Order of 10 June 2021 ("Cookie Guidelines") and with Directive 2002/58/EC (ePrivacy). The User's consent is recorded in append-and-update mode, with complete history preserved, and includes timestamp, IP address, user-agent and accepted or revoked purposes, in compliance with the accountability principle set out in Article 5(2) GDPR. The User may modify or revoke their consent at any time from the dedicated page. Technical details on the consent recording arrangements are indicated in the Service Technical Specifications.

18.1 Browser local storage (PWA and Service Worker)

The Service is also designed as a Progressive Web App (PWA) installable on the User's device and includes a Service Worker that uses native browser APIs (Cache API, IndexedDB, localStorage) for the purposes of:

• caching of static resources for offline functioning and performance;

• local storage of user preferences (language, theme, layout) and application state;

• support for installable functionalities and push notifications (where enabled by the User).

Such storage takes place exclusively on the User's device, does not transfer data to Stravagando directly and does not constitute processing of personal data by the Controller insofar as it remains confined to the local browser. The User may clear such storage at any time from their browser settings.

18.2 Analytics and traffic measurement

Stravagando uses web analytics tools to measure traffic, conversions and use of the Service, indicated in the Technical Specifications and in the Cookie Policy.

In compliance with the rulings of the Italian Data Protection Authority and with consolidated European practice, analytics tools are activated exclusively upon express User consent given through the cookie banner, according to the Consent Mode v2 model: in the absence of consent, the tools remain in a denied state and do not transmit identifying data to third parties.

19. Modification of the Terms

Stravagando may modify these Terms for:

• regulatory updates;

• introduction of new functionalities;

• improvements to the Service;

• security reasons.

Substantial modifications are communicated to the User with 30 days' notice via email and in-app notification, indicating the effective date.

Continued use of the Service after the effective date constitutes acceptance of the new versions. The User has the right to terminate the relationship free of charge before the effective date, retaining the right to the full portability of their data and Content pursuant to Article 20 GDPR.

Modifications of a purely technical, lexical or corrective nature (typos, reformulations that do not affect the User's rights) may be applied without notice, giving evidence thereof in the version history.

19.1 Update regime of the Service Technical Specifications

The Service Technical Specifications, described in Section 2 and integral part of the contractual relationship, are of operational and configurable nature. Their modifications are communicated to the User with reduced notice of 7 days via email and/or in-app notification, indicating the changes and the effective date.

Such simplified regime applies exclusively to modifications that do not affect the principles and rights stated in these Terms. Any modification of the Specifications that, by its scope, affects the User's substantive rights (by way of example: reduction of essential functionalities; substantial worsening of service levels; introduction of limitations modifying the economic or operational balance of the relationship) is treated as modification of these General Terms and follows the ordinary 30 days' notice referred to in the preceding paragraph, with the right to free termination and data portability pursuant to Article 20 GDPR.

In case of interpretative conflict between the Specifications and these Terms, the Terms shall prevail.

20. User's withdrawal

The User may close their Account at any time, without notice and without need for justification, exercising the right to erasure under Article 17 GDPR through the self-service functionality available in the Account's privacy page (route account.gdpr.delete). The procedure provides a confirmation page with information on the consequences of deletion and an explicit User confirmation, in order to prevent accidental deletions.

Following the deletion request:

• the Account is immediately deactivated and no longer publicly accessible;

• the personal identifying data of the Account and the User's Content are subject to soft-delete and retained for a determined period (normally 90 days from the request), after which they are definitively deleted. Such period is justified by the need to manage any complaints, abuse investigations and legal compliance obligations, in line with the retention rules applied to sanctioned Users referred to in Section 13;

• the cases of extended retention referred to in Section 16.1 (legal hold), including tax obligations pursuant to Article 2220 of the Italian Civil Code for data relating to transactions on the separate marketplace, remain unaffected;

• the anonymous/aggregate retention of data for statistical purposes, where technically irreversible, pursuant to the Privacy Policy, remains unaffected;

• accrued XP, levels, Achievements are deleted without right to indemnity, in line with their symbolic nature (Section 9.1).

The closure of the Account does NOT give right to refunds on any purchases already made on the marketplace, governed by the separate Sales Terms.

Consumer Users retain the unaffected right of withdrawal provided for by Articles 52 et seq. of Italian Legislative Decree No. 206/2005 (Italian Consumer Code) for any paid services, as specifically governed by the relevant Sales Terms.

21. Withdrawal and suspension by Stravagando

Stravagando may suspend or terminate the contractual relationship with the User:

• in case of violation of these Terms, in accordance with the gradation set out in Section 13;

• in case of particularly prolonged inactivity of the Account, according to methods and timing that the platform may introduce in the future, subject to prior notice via email with notice of no less than 30 days;

• for cessation of the Service (total or partial): in such case Stravagando communicates the cessation with 90 days' notice, making available data export pursuant to Article 20 GDPR.

22. Limitation of liability

The Service is provided "as is" and "as available".

Within the limits permitted by law, and save for cases of wilful misconduct and gross negligence and the mandatory consumer protection guarantees provided by Italian Legislative Decree No. 206/2005 and applicable legislation, Stravagando does not warrant:

• the accuracy, completeness or timeliness of data relating to the places presented in the catalogue, in particular those derived from open sources such as OpenStreetMap;

• continuity of the Service without interruptions: technical interruptions for maintenance, updates or unforeseen events are acceptable;

• perfect compatibility of the Service with every device, browser or network configuration;

• the absence of errors, bugs or vulnerabilities.

Stravagando is not liable for indirect, consequential damages, loss of profits, loss of chance or reputational damages not attributable to its own gross negligence or wilful misconduct.

22.1 Quantitative limit of liability

Within the limits permitted by law, and save for cases of wilful misconduct, gross negligence, personal injury and violation of mandatory consumer rights, Stravagando's aggregate liability to the User, on any ground and with reference to all events connected to the relationship governed by these General Terms, shall not exceed € 100 (one hundred euros).

Such threshold refers exclusively to the relationship governed by these General Terms, which is of non-onerous nature for the User in non-transactional components (Account, Social, Gamification, UGC, Places catalogue). For transactional aspects of the marketplace, the different regime provided by the Sales Terms (Article 14.2) applies, which provides specific limits (€ 500 for purchasing Customer with reference to the Total Amount of the Booking concerned, € 100 for non-purchasing User).

For Users resident in the United States of America, Appendix B of the Sales Terms additionally applies, governing AAA arbitration, class action waiver (with opt-out right within 30 days from first acceptance) and other specific safeguards.

In any event, liability for personal injury, for breach of essential contractual obligations and for other situations in which the law does not allow exclusion or limitation of liability towards the consumer remains unaffected.

23. Risk disclosure on visits

The places suggested by the platform include natural environments, trails, cliffs, mountains, historic buildings, remote or hardly accessible areas.

The User who decides to visit them does so under their own autonomous responsibility, after having adequately assessed:

• their psycho-physical conditions and technical capabilities;

• the meteorological and environmental conditions;

• the adequate equipment;

• any access limitations (private property, protected areas, prohibitions);

• the applicable local regulations.

Stravagando provides information for divulgative purposes and does not replace professional guides, institutional sources (e.g. CAI, civil protection authorities) or expert consulting. Stravagando is not liable for accidents, injuries or damages occurred during visits to places published in the catalogue or suggested by other Users, save for cases of its own gross negligence or wilful misconduct in the editorial content directly curated.

24. Indemnification

The User undertakes to indemnify Stravagando, within the limits permitted by law and limited to cases of wilful misconduct or gross negligence of the User itself, from any third-party claim, including reasonable legal expenses, deriving from:

• Content uploaded by the User in violation of copyrights, image rights, privacy or other third-party rights;

• illegal or unauthorised use of the Service;

• violation of these Terms.

Stravagando will promptly inform the User of the existence of such claims and will cooperate reasonably in their handling.

25. Force majeure

Neither party is liable for non-performance due to force majeure causes, understood as extraordinary and unforeseeable events outside their reasonable control: natural disasters, armed conflicts, terrorist acts, pandemics, general strikes, public authority acts, prolonged interruptions of critical infrastructures (electricity grid, internet backbone connectivity), massive cyber attacks.

For the duration of the event, obligations are suspended. If the force majeure cause continues for more than 90 days, either party may withdraw without notice.

26. Jurisdiction and dispute resolution

In case of dispute, the parties undertake to preliminarily attempt an amicable resolution. The User may contact Stravagando through the contacts in Section 28; Stravagando undertakes to respond within 30 days.

The possibility of resorting to alternative dispute resolution bodies (ADR), including the European ODR platform (https://ec.europa.eu/consumers/odr) pursuant to Regulation (EU) No. 524/2013, as well as to mandatory mediation pursuant to Italian Legislative Decree No. 28/2010 for the matters therein provided, remains unaffected.

For disputes not resolved amicably, the competent jurisdiction is the Court of Pescara. However, pursuant to Regulation (EU) No. 1215/2012 (Brussels I-bis), Articles 17-19, the consumer resident in the EU/EEA may always sue before the court of their State of residence, and be sued exclusively before such court.

The consumer's right to participate in collective representative actions pursuant to Italian Legislative Decree No. 28/2023 (transposing EU Directive 2020/1828) also remains unaffected.

27. Applicable law

These Terms are governed by Italian law. Pursuant to Regulation (EU) No. 593/2008 (Rome I), Article 6, the mandatory consumer protection provisions provided by the law of the State of residence of the consumer resident in the EU/EEA remain in any case applicable, where more favourable.

28. Contacts and references

Service Provider: Inmedia S.r.l.

Registered office: Via L'Aquila 22, 65122 Pescara (PE), Italy

VAT No.: TBD

Certified email (PEC): inmediasrl@pec.it

General support email: support@stravagando.com

Legal email: legal@stravagando.com

Data Protection Officer: legal@stravagando.com (dedicated address that the Provider may communicate by updating the Privacy Policy)

DSA single point of contact for authorities: legal@stravagando.com (Italian, English)

DSA single point of contact for users: support@stravagando.com (Italian, English)

Main regulatory references

EU legislation

• Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR)

• Regulation (EU) 2018/1807 on the free flow of non-personal data

• Regulation (EU) 2022/2065 — Digital Services Act (DSA)

• Regulation (EU) 2024/1689 — Artificial Intelligence Act (AI Act)

• Regulation (EU) 2019/1150 — Platform-to-Business Transparency Regulation (P2B)

• Regulation (EU) No. 524/2013 — Consumer ODR

• Regulation (EU) No. 1215/2012 — Brussels I-bis

• Regulation (EU) No. 593/2008 — Rome I

• Regulation (EU) No. 910/2014 — eIDAS

• Regulation (EU) 2024/1624 — AML (Anti-Money-Laundering)

• Directive (EU) 2019/770 — Contracts for the supply of digital content and digital services

• Directive (EU) 2019/771 — Sale of consumer goods

• Directive (EU) 2019/2161 — Omnibus (modernisation of consumer protection)

• Directive (EU) 2020/1828 — Representative consumer actions

• Directive (EU) 2021/514 — DAC7 (tax obligations of digital platforms)

• Directive 2002/58/EC — ePrivacy

• Directive 2000/31/EC — Electronic Commerce

• Directive 2011/93/EU — Combating sexual abuse and sexual exploitation of minors

Italian national legislation

• Italian Legislative Decree No. 196/2003 as amended by Italian Legislative Decree No. 101/2018 (Italian Privacy Code)

• Italian Legislative Decree No. 70/2003 (Electronic Commerce)

• Italian Legislative Decree No. 82/2005 (Digital Administration Code — CAD)

• Italian Legislative Decree No. 206/2005 (Italian Consumer Code)

• Italian Legislative Decree No. 231/2007 (Anti-Money-Laundering and combating financing of terrorism)

• Italian Legislative Decree No. 145/2007 (Misleading and unlawful comparative advertising)

• Italian Legislative Decree No. 28/2010 (Civil and commercial mediation)

• Italian Legislative Decree No. 173/2021 (Transposing EU Directive 2019/770)

• Italian Legislative Decree No. 170/2021 (Transposing EU Directive 2019/771)

• Italian Legislative Decree No. 26/2023 (Transposing Omnibus Directive)

• Italian Legislative Decree No. 28/2023 (Transposing Directive 2020/1828 on representative actions)

• Italian Legislative Decree No. 32/2023 (Transposing DAC7 Directive)

• Italian Law No. 633 of 22 April 1941 (Copyright)

• Italian Law No. 191/2023 (CIN — National Identification Code for tourist accommodation)

• Italian Civil Code (in particular Articles 1176, 1229, 1341, 1411-1413, 1681, 2002, 2220)

• Italian Code of Criminal Procedure (Article 254-bis preservation order; Article 329 investigative secrecy)

• Italian Presidential Decree No. 445/2000 (Administrative documentation)

Regulatory orders

• Order of the Italian Data Protection Authority of 10 June 2021 (Cookie Guidelines)

• AGCOM orders on digital services and trusted flaggers

• AGCM orders on unfair commercial practices

• IAP Code of Self-Regulation of Commercial Communication

29. Features under development

These Terms refer, in several places, to features of the Service that the Platform may introduce, activate or develop in the future but which, at the current stage, are not operational in production. The inclusion of such references serves a pre-contractual transparency function towards the User, but does not constitute a commitment or contractual obligation of Stravagando to actually activate the single feature.

The main features mentioned as potential future developments are:

• Username modification (Sec. 4): possibility for the User to modify their username displayed on the platform, possibly with frequency limits and uniqueness rules;

• Email verification as gating (Sec. 4.1): subordination of access to sensitive functionalities (by way of example: Content publication, marketplace access) to prior verification of the email address;

• Advanced age verification systems (Sec. 3 and 4): request for date of birth or adoption of more robust age-verification systems, also in implementation of Article 28 DSA on the protection of minors;

• Personal API tokens (Sec. 4.3): possibility for the User to generate personal programmatic access tokens with enablement scopes, according to the terms of use indicated in the Technical Specifications upon activation;

• Formalised right of reply on UGC (Sec. 6.5): structured mechanism allowing the User who is the subject of critical citation to publish a brief reply;

• Account closure for prolonged inactivity (Sec. 21): automatic deactivation mechanism for Accounts showing exceptionally prolonged inactivity, subject to prior email notice of no less than 30 days;

• Monetary cashback programs, accumulable points or user wallet (see Article 8.8 of the Sales Terms): loyalty systems that attribute benefits of monetary nature or convertible into goods/services, distinct from the purely symbolic Level Perks referred to in Section 9.2;

• VLOP advertising repository (Sec. 14-bis.5): publication of the advertising repository pursuant to Article 39 DSA, applicable only in case of future qualification as a very large online platform (VLOP);

• Formal extension of the Service outside the EU/EEA area (Sec. 3): opening of the social and gamification Service to Users resident in other countries, in particular the USA, with relevant local regulatory adjustments (DMCA, COPPA, CCPA/CPRA, FTC Endorsement Guides);

• Beta features (Sec. 9.2-bis): early access to experimental features granted as a Level Perk, subject to all the uncertainties and revocability typical of experimentation.

The actual activation of each feature will be communicated to the User through the channels referred to in Section 17, with possible update of these Terms or the Service Technical Specifications according to the regime referred to in Section 19.

The above list is not exhaustive: Stravagando may develop and activate further features not mentioned in these Terms, within the limits of its product evolution right and respecting the User's rights as set out in these Terms.

In case of conflict between the Italian version and translations in other languages (EN/FR/DE/ES), the Italian version shall prevail, save for the mandatory consumer protection provisions referred to in Article 6 of Regulation (EU) No. 593/2008.