General Terms & Conditions

Version 1.0 — In force as of 24/04/2026

1. Introduction

Stravagando is a digital platform operated by Horizon Servizi Integrati S.r.l.s., with registered office at Viale Giovanni Bovio, 103/1 65124 Pescara (PE), Italy, VAT No. 02445190685 (hereinafter also "Stravagando", "we" or the "Operator"). The platform allows users to discover extraordinary places of the territory (villages, trails, castles, restaurants and other points of interest), to share travel experiences with other users and to take part in a gamified exploration system based on check-ins, levels, badges and user challenges.

These General Terms and Conditions (hereinafter the "Terms") govern access to and use of the Stravagando platform, in its web and mobile components, by any registered natural person (the "User"). The Terms constitute a binding agreement between the User and Stravagando pursuant to the Italian Civil Code and to Italian Legislative Decree 70/2003 on electronic commerce.

Access to and use of the platform imply full acceptance of these Terms. If the User does not intend to accept them, they are invited not to register and not to use the Service.

1.1 Related documents

This document does NOT govern:

• the transactions for the purchase of paid experiences offered by commercial Hosts, governed by the separate "General Terms and Conditions of Sale" and by the "Cancellation Policies" that form an integral part of those Conditions;

• Stravagando's "Referral Program", governed by the separate "Referral Program Terms";

• the obligations of commercial Hosts, governed by the separate "Host Terms";

• the processing of personal data, governed by the "Privacy Policy";

• the use of cookies and similar technologies, governed by the "Cookie Policy";

• the technical operational aspects of the Service, described by the "Technical Specifications of the Service", which form an integral part of these Terms pursuant to Section 19.1;

• the detailed operational and procedural aspects of the Service, described by the "Operational Guidelines" published on the platform.

Where the text refers to such documents, they form an integral part of the contractual relationship as far as relevant.

1.2 Hierarchy of documents

In the event of an interpretative conflict between documents, the following prevail in this order: any applicable Appendices based on the User's residence (where introduced), these General Terms, the Privacy Policy and the Cookie Policy, the Technical Specifications of the Service, the Operational Guidelines.

For matters specifically governed by the Terms of Sale, the Host Terms or the Referral Program Terms, such special documents prevail within their own scope, without prejudice to the mandatory protections provided in favour of the consumer by the Italian Consumer Code (Legislative Decree 206/2005) and by EU legislation.

2. Definitions

For the purposes of these Terms, the following terms have the meaning indicated:

• Service: the set of functionalities made available by Stravagando through the web platform and the mobile applications, including the Places, Social/Community, Gamification and onboarding components.

• Technical Specifications of the Service (or "Specifications"): the technical document supplementing these Terms, which describes operational parameters, thresholds, formulas, quantitative limits and providers used. The Specifications form an integral part of the contractual relationship but follow a simplified update regime under Section 19.

• Places (internal technical name: Atlas): the public section of the platform that presents points of interest (POIs: villages, trails, castles, restaurants and the like) on an interactive map, obtained from open sources (in particular OpenStreetMap), from Users' suggestions and from editorial content curated by the staff.

• POI (Point of Interest): a single place or geographic entity recorded in the Places catalogue, identified by geographic coordinates, descriptive attributes (name, category, address) and thematic categorisation. The term appears in Sections 7 (Check-ins), 11 (Trust score) and 15 (Intellectual property).

• Account: the registered User's personal space, accessible by credentials, from which they may use the reserved functions.

• User: the natural person who accesses the Service and, where registered, holds an Account.

• Public Profile: the Account page visible to other Users or to search engines when the User has activated the relevant visibility.

• Content or UGC (User-Generated Content): any content published by the User on the platform, including reviews, narrative posts, photos, suggestions of new places, modifications to existing places, comments, personal notebooks, check-ins.

• Check-in: the geolocated registration made by the User in the vicinity of a place present in the Places catalogue, validated server-side by calculating the distance from the POI's coordinates.

• XP, Level, Achievements (corresponding to the technical Achievement entity in the system), Streak: symbolic elements of the gamification system, described in Section 9.

• Trust Score: technical indicator (0-100) calculated automatically on the basis of the consistency of a User's check-ins, described in Section 11.

• Moderation: the automated and/or manual activity of verifying the compliance of Content with these Terms.

• Customer (also Guest): the User who, under the Terms of Sale, books or takes part in paid experiences offered by Hosts (see Section 3-bis).

• Host: the User who, under the Host Terms, publishes and offers paid experiences to Customers (see Section 3-bis).

• Referrer: the User who, under the Referral Program Terms, takes part in the referral program and receives benefits therefrom (see Section 3-bis).

3. Access requirements

Use of the Service is reserved to natural persons who jointly meet the following requirements:

• have reached the minimum age of 14 years, in compliance with Art. 2-quinquies of Legislative Decree 196/2003 (Italian Privacy Code, as amended by Legislative Decree 101/2018) implementing Art. 8 GDPR. For residents of other Member States of the European Union or of the European Economic Area, the age of digital consent provided for by national law applies (generally between 13 and 16 years); the User warrants that they meet the minimum age applicable in their State of residence;

• have the legal capacity necessary to enter into contractual commitments under the law of their State of residence;

• are resident in a country of the European Union or of the European Economic Area. The Service is optimised for that geographic area; access from other jurisdictions may not be supported or may present limited functionalities.

Upon registration, the User is required to confirm that they meet the age requirements indicated above by means of a specific acceptance checkbox (Section 4). Stravagando reserves the right to introduce in the future the request for the date of birth or other age-verification systems, including in implementation of Art. 28 DSA on the protection of minors. A false declaration regarding the age requirements constitutes a breach of the Terms and entitles Stravagando to suspend or delete the Account, without prejudice to any further legal remedy.

Single account per person. Each natural person may hold only one Account. The creation of multiple Accounts, including through different identities, is prohibited, in particular for the purpose of unduly obtaining XP, levels, Achievements, followers or gamification advantages. The breach of this prohibition entails the suspension or deletion of all linked Accounts, pursuant to Section 13.

3-bis. User capacity in the marketplace

The User registered on the platform may operate in distinct capacities in the context of the marketplace of paid experiences and of the accessory programs integrated into the Service:

• Customer (also Guest in international terminology): the User who books or takes part in paid experiences offered by Hosts. When operating in such capacity, the User is subject, in addition to these General Terms for non-transactional matters, to the separate General Terms and Conditions of Sale;

• Host: the User who publishes and offers paid experiences to Customers. When operating in such capacity, the User is subject, in addition to these General Terms for non-transactional matters, to the separate Host Terms;

• Referrer of the Referral Program: the User who actively takes part in the referral program by spreading their own code and receiving benefits for each new User they invite. When operating in such capacity, the User is subject, in addition to these General Terms, to the separate Referral Program Terms.

These GTU continue to apply to the User in all the capacities described above for non-transactional matters (Account security, Profile, Social, Gamification, UGC Content, Places catalogue, moderation, sanctions). The regulation of economic transactions, payments, fees, refunds and related obligations remains entrusted to the special documents referred to above.

The assumption of a special capacity does not entail the loss or suspension of the User's general faculties, except where such special documents provide for specific obligations or restrictions connected to transactional operations.

4. Registration and Account

To access the reserved functions, the User must register by providing the data requested by the registration form, namely: first name, last name, email address and password. The username visible on the platform is generated automatically by the system on the basis of the data provided; the User may subsequently modify it, where such functionality is made available by Stravagando. Registration is free of charge.

Alternatively, the User may register and access the Service by means of federated authentication (Single Sign-On) through supported third-party identity providers (by way of example: Google, Meta/Facebook). In such case, following authentication with the provider, Stravagando receives the essential identifying data (verified email address, name, any profile photo, unique identifier with the provider) necessary for the creation or linking of the Account. A User who registers exclusively via SSO does not have a local password with Stravagando; access takes place solely through the chosen provider. The revocation of the authorisation with the external provider entails the impossibility of accessing the Account through that channel, but does not result in the automatic deletion of the data retained by Stravagando.

Upon registration, the User is required to confirm, by means of a specific acceptance checkbox, that they meet the age requirements referred to in Section 3 and that they accept these Terms and the Privacy Policy. Ticking the relevant boxes constitutes a declaration of knowledge pursuant to Art. 46 of Presidential Decree 445/2000 for the purposes of Art. 8(2) GDPR.

Stravagando reserves the right to introduce, also subsequently, the request for the date of birth and/or more advanced age-verification systems, for example as a consequence of regulatory obligations, of developments of the Service or for the purpose of protecting minors pursuant to Art. 28 of Regulation (EU) 2022/2065 (DSA).

4.1 Verification of the email address

Following registration, Stravagando sends to the indicated email address a message containing a verification link. Stravagando reserves the right to make access to sensitive functionalities of the Service (by way of example: publication of Content, access to the marketplace) subject to the prior verification of the email address, in accordance with procedures that the platform may introduce in the future. For Users who register through federated authentication, the email is deemed verified if the identity provider attests its verification.

4.2 Account security

The User is responsible for the safekeeping of their credentials (password and/or authorisations granted to the SSO providers) and for any activity carried out through the Account. In the event of suspected unauthorised access, the User must promptly notify Stravagando through the channels indicated in Section 28 and proceed to revoke the compromised credentials.

The User may activate two-factor authentication (2FA), based on a TOTP authenticator application and recovery codes, pursuant to the security module implemented in the Service. Activation is recommended but not mandatory.

Re-authentication for sensitive operations. In order to protect the User from account takeover attacks and ensure the security of information, the execution of certain operations (modification of email, password, visibility settings, indexing, leaderboards and companion tagging) requires confirmation of the current password, even where a session is active.

4.3 Programmatic access tokens (API)

Stravagando reserves the right to make available to Users, in the future, the possibility of generating personal access tokens for the programmatic use of the Service's API. This functionality is not currently active in production. Where introduced, the tokens will be: shown to the User only once at the time of creation and subsequently retained in hashed form by the system; possibly associated with enabling scopes to implement the principle of least privilege; revocable at any time by the User. The conditions of use and the technical characteristics will be specified in the Technical Specifications of the Service at the time of activation.

4.4 Retained access data

For security, audit and abuse-detection purposes, Stravagando retains in the sessions and in the main events (by way of example: login, check-in) the IP address and the browser user-agent string. Such data are processed pursuant to the Privacy Policy and to Art. 6(1)(f) GDPR (legitimate interest in IT security).

The data provided must be truthful, complete and up to date. The User may modify them at any time from the page dedicated to the Profile (route /{locale}/user/profile).

5. Profile visibility

The User has four independent settings for visibility and privacy, which may be managed autonomously from the Account privacy page (route account.privacy, accessible at the localised address /{locale}/account/privacy). Each setting produces distinct effects and coincidence with the others is not presumed. The modification of each setting requires confirmation of the current password, pursuant to Section 4.

5.1 Profile visibility (profile_visibility)

By default, the User's Profile is public: the personal page /users/{username} is accessible to other Users and, depending on the further settings, to external search engines. This default setting is disclosed to the User during onboarding and serves the purposes of social discovery, territory exploration and gamification that constitute the very nature of the Platform. The User may choose to make the Profile private at any time, by means of opt-out from the Account privacy page (Settings → Privacy), disabling the public accessibility of the personal page. For minor Users, the more restrictive default settings referred to in paragraph 5.6 below apply.

5.2 Search-engine indexing (allow_search_indexing)

By default, indexing is enabled. This setting produces effects only in conjunction with a public Profile and upon the User reaching a minimum activity threshold; in such case, the public pages of the Profile may be indexed by third-party search engines (Google, Bing and the like). The User may disable indexing at any time by means of opt-out from the Account privacy page. For minor Users, the more restrictive default settings referred to in paragraph 5.6 below apply.

5.3 Appearance in leaderboards (show_in_leaderboards)

By default, the User is included in the public leaderboards (weekly, monthly, all-time, regional and national). The User may choose to deactivate this setting to obtain a granular opt-out, independent of Profile visibility. Reference is made to Section 10 for the description of the leaderboards and for the technical timing of the propagation of the opt-out.

5.4 Consent to UGC Tagging ("Allow others to tag me in content")

By default, the User accepts that they may be tagged in Content published by other Users with whom they have a mutual-follow relationship, as governed by Section 8-bis (general regime of UGC Tagging, applicable in particular to posts on the Wall of a Place) and, for the specific case of companion tagging in geolocated check-ins, by Section 8. The User also has a distinct setting to control the visibility on their own Profile of the content in which they are tagged. The User may disable the possibility of being tagged at any time; in such case, attempts at UGC Tagging by other Users are discarded without notification to the protected User and without any impact on the experience of the tagging User.

5.5 Forward-looking effect of changes

The modification of any of the above settings has forward-looking effect. The copies already acquired by third-party search engines or by system snapshots (in particular the leaderboard snapshots, see Section 10) may be removed only within the necessary technical times, according to the procedures of the respective platforms or according to the internal update cycle.

5.6 Default settings for minor Users

The public default settings referred to in paragraphs 5.1, 5.2 and 5.4 apply only to Users of legal age. For minor Users (under-18), more restrictive and protective default settings apply, consistently with the principle of data protection by design and by default pursuant to Art. 25 GDPR, with the Privacy Notice (Section 12.6) and with Art. 28 of Regulation (EU) 2022/2065 (Digital Services Act): in particular, the minor's Profile is set as private, indexing is disabled and no profiling-based advertising is presented to such Users. The minor or the person exercising parental responsibility may nonetheless manage said settings within the limits permitted by the applicable legislation.

6. User-Generated Content (UGC)

6.1 Types of Content

The User may publish various types of Content, including:

• photos (including with capture metadata, see paragraph 6.6);

• reviews with a score (rating from 1 to 5) and text;

• narrative posts published on the wall;

• suggestions of new places to add to the catalogue;

• proposals to modify existing places;

• personal lists (Notebooks), tags, comments, likes;

• direct messages exchanged with other Users or with Stravagando's support within dedicated conversations (Section 6.7).

6.2 Licence granted to Stravagando

By publishing Content on the platform, the User grants Stravagando a non-exclusive, royalty-free, worldwide licence, sublicensable solely to Stravagando's technical and promotional partners (by way of example: hosting services, CDN, marketing partners of the Service itself, translation and editorial syndication), limited to the purpose of managing, publishing, promoting and improving the Service, for the duration of the User's registration, with the right of reproduction, technical adaptation (e.g. resizing, transcoding), automatic translation and communication to the public in the contexts connected with the Service.

The licence is revocable on a forward-looking basis by deletion of the Content by the User or by request for total deletion of the Account. The revocation does not affect:

• the uses already granted to sublicensees before the revocation, solely for the completion of activities already commenced and for the minimum period necessary;

• the retention of technical backup copies and of reduced/anonymous copies for aggregate statistical purposes, pursuant to the Privacy Policy.

The User retains full ownership of their Content and may at any time republish it elsewhere or monetise it on other platforms.

6.3 User warranties and responsibility

The User warrants, under their sole responsibility, that each Content published:

• is their own work or is covered by a licence/authorisation that allows its publication and the granting of the licence in Section 6.2;

• does not infringe copyright, related rights, trademarks, patents or other intellectual property rights of third parties;

• does not infringe the right to image, privacy or protection of personal data of third parties (in particular, the User must not publish photos of identifiable persons without their consent, save for the exceptions provided for by Art. 97 of Law 633/1941);

• does not constitute illegal, defamatory, misleading, discriminatory, obscene, violent content, content inciting hatred or self-harm, nor undisclosed advertising content;

• does not promote unlawful activities nor infringe any applicable rule.

The User indemnifies Stravagando from any third-party claim arising from the breach of the warranties listed above, under the conditions indicated in Section 24.

6.4 Moderation

Stravagando reserves the right, but not the obligation, to moderate the Content published. Moderation may entail the removal, obscuration, request for modification or downranking of the Content. For details on the automated systems used, reference is made to Section 12; for the complaints and appeals system, reference is made to Sections 12-bis and 13.

6.5 Right of reply and deletion

The User whose Content is the subject of critical citation by other Users may request Stravagando to publish a short reply, in accordance with procedures that the platform may introduce in the future.

The User may delete their Content at any time. Deletion is carried out in soft-delete mode: the Content is immediately made non-visible from the public interface, but is retained in the database for 30 days for the purposes of any audits, security checks or internal disciplinary proceedings, after which it is definitively removed. The legal basis for such temporary retention is Stravagando's legitimate interest in the prevention of abuse and in defence in litigation (Art. 6(1)(f) GDPR). The cases of extension of retention governed by Section 16.1 (legal hold) remain unaffected.

6.6 Processing of photo metadata (EXIF)

To protect privacy by design (Art. 25 GDPR), Stravagando removes the EXIF metadata from the photos uploaded by the User at the time of their server-side processing, by re-encoding the image. In particular, the following are removed: geolocation (GPS) data, model and serial number of the capture device, original date and time, technical exposure parameters.

Such removal applies both to Profile photos and to photos uploaded as UGC (reviews, posts, contributions to the Places catalogue). Stravagando does not retain copies of the removed EXIF metadata: the operation is irreversible.

A User who wishes to preserve the metadata of their photo is invited to autonomously keep the original before uploading, since the version retained on the platform will be without such information.

6.7 Private conversations and direct messaging

Stravagando makes available, in connection with the marketplace and with the support Service, a direct messaging functionality that allows Users to exchange private communications in the following contexts:

• communications relating to a marketplace booking (between Customer and Host);

• pre-purchase information requests on marketplace experiences;

• assistance provided by Stravagando's support to registered Users;

• assistance provided by support to unregistered Users (Section 17-ter).

The messages are visible solely to the participants of the conversation. Stravagando, as provider of the Service, may access the contents of the conversations solely for the purposes of:

• moderation upon report (Section 12-bis);

• detection of abuse, breaches of the Terms, unlawful activities (Art. 6(1)(f) GDPR);

• fulfilment of legal obligations and orders of the authority (Section 16.1).

The messages are treated as UGC and follow the retention and deletion rules referred to in the preceding paragraphs. The removal of the message by the sender does not guarantee its deletion at the recipient, who may have kept a copy. The User is invited to use direct messaging with the same prudence as any other form of written communication.

7. Geolocated check-ins

The check-in is the registration, by the User, of their presence in the vicinity of a place present in the Places catalogue. The check-in requires access to the device's GPS and the transmission of the coordinates to the server, which validates the distance from the POI by calculating the geodesic distance (Haversine formula) and assigns a reliability score (see Section 11).

The transmitted coordinates are rounded in the system logs in order to limit the level of tracking of the User, to the precision indicated in the Technical Specifications of the Service. Such operation constitutes technical pseudo-anonymisation pursuant to Art. 4(5) GDPR, not definitive anonymisation.

7.1 Check-in visibility

At the time of carrying out the check-in, the User autonomously chooses the level of visibility of the same among the following options:

• Only me: the check-in is visible solely to the User and is not shown to other Users nor indexed;

• Friends (mutual-follow): the check-in is visible solely to the Users with whom the User has a mutual-follow relationship on the platform;

• Everyone (default setting): the check-in is visible to any User registered on the platform and, where the User's Profile is public and indexable (Section 5), may also be accessible by external search engines. The User may restrict the visibility of the individual check-in to "Friends" or "Only me" at the time of publication or subsequently.

The visibility choice is added to the general Profile visibility settings described in Section 5: in particular, the "Everyone" choice on the individual check-in does not make the User's Profile public if it is set as private; conversely, the closure of the Profile does not retroact on the visibility of the individual past check-ins set as "Everyone", which will continue to be visible to those entitled according to the settings in force at the time, save for subsequent modification by the User.

The User may modify the visibility of their check-in at any time after its publication. The modification has forward-looking effect and does not affect the copies possibly already acquired by third parties in the preceding technical times.

The check-in contributes to the gamification system (XP, Achievements, Streak) and, where the User has activated the dedicated switch (Section 5.3), to the public leaderboards, regardless of the visibility set. The User's appearance in leaderboards shows aggregate data (Level, XP for the period, username) and does not reveal the detail of the individual private check-ins.

In check-ins with "Friends" or "Only me" visibility, any User tagged as a travel companion (Section 8) in any case receives the notification of their involvement and may exercise the right to remove the tag, for the purpose of protecting their own right to image and privacy.

7.2 Attribution of XP

The validly registered check-in constitutes the main means of accumulating XP in the gamification system described in Section 9. The attribution of XP is automatic and takes place according to the parameters in force at the time of the check-in, which may vary depending on:

• the category of the place visited (some POIs may attribute increased XP for editorial or promotional purposes, e.g. places of the week, thematic routes);

• the User's Trust Score (Section 11): check-ins carried out by Users with a low Trust Score may generate reduced XP, placed in pending until manual verification, or may not generate XP if deemed unreliable;

• any multipliers linked to streaks, Achievements or promotional events of the platform.

Stravagando reserves the right to rectify the attribution of XP ex post in the event of detection of anomalies, fraudulent check-ins, GPS spoofing or other breaches of the Terms. The rectification may entail the reduction of the Level, as provided for in Section 9.3.

7.3 Retention and deletion

The check-ins are retained in the history of the User's activity for an indefinite time, save for deletion upon the User's request or exercise of the GDPR rights referred to in Section 16. The deletion of a check-in removes it from the public interface and from the User's personal history, but does not automatically entail the reduction of the accumulated XP nor the loss of the Achievements obtained, in consideration of the historical irrevocability of the gamification recognitions (see Section 9.1). Stravagando reserves the right to revoke XP or Achievements solely in cases of detection of abuse or fraud pursuant to Section 7.2.

The User is required to carry out authentic check-ins. The simulation of the position through GPS spoofing or similar techniques constitutes a breach of the Terms and is sanctioned pursuant to Sections 11, 13 and 14.

8. Companion tagging in check-ins

Companion tagging is the applicative case of UGC Tagging (Section 8-bis) referring to the geolocated check-ins under Section 7. The User may associate with their own check-in another User in the capacity of "travel companion".

The conditions of applicability (mutual-follow and prior consent), the methods of notification and removal of the Tag, the exclusion of liability of Stravagando and the prohibitions of abusive use governed by Section 8-bis apply in full, insofar as compatible. These provisions govern the specificities proper to companion tagging in check-ins.

8.1 Maximum number of Users taggable per check-in

Each check-in may associate up to ten (10) Users in the capacity of travel companions. All Users so associated are marked as companions of the check-in. Any attempts at association beyond such limit are rejected by the system.

8.2 Daily anti-abuse limit

To prevent distorting uses of the mechanism for gamification purposes, a daily limit is established on the number of check-ins with companion tagging per User, indicated in the Technical Specifications of the Service. The recurrent exceeding of the limit, or the recursive use of tagging in patterns deemed abusive, constitutes conduct that may be sanctioned pursuant to Section 14, without prejudice to the provisions of Section 8-bis.6.

8.3 Gamification recognitions

Unlike UGC Tags applied to other types of Content (cf. Section 8-bis.8), companion tagging in check-ins contributes to the gamification system with specific recognitions, according to the following regime:

• XP (experience points): the XP connected to the companion check-in is attributed solely to the tagging User (the author of the check-in), within a daily cap indicated in the Technical Specifications of the Service. The Users tagged as companions do not receive XP for their involvement;

• Dedicated companion Achievements: both the tagging User and the tagged Users progress towards the dedicated companion Achievements, the progress of which is determined by the count of the tags (independently of XP) and is unlocked upon reaching the thresholds indicated in the Technical Specifications of the Service.

The quantitative parameters (amount of XP per check-in with tag, daily cap, unlocking thresholds of the related companion Achievements) are indicated in the Technical Specifications of the Service and may be updated according to the regime under Section 19.

The retroactive rectification or revocation of XP and Achievements connected to companion tagging follows the general rules of Section 7.2 and Section 9.3, in particular in cases of detection of abuse, fraud or GPS spoofing.

8-bis. Tags and mentions of other Users in Content (UGC Tagging)

Stravagando allows the User to associate with certain Content published on the platform the reference to other registered Users (hereinafter, the "UGC Tags"). The rules indicated below constitute the general regime of UGC Tagging, applicable to all types of Content for which the functionality is enabled; for the specific case of companion tagging in geolocated check-ins, the provisions of Section 8 apply in addition.

8-bis.1 Scope of application

UGC Tagging is currently available for the following types of Content:

• the check-ins carried out at a Place, with the possibility of tagging up to a maximum of ten Users per check-in (Section 8);

• the posts published on the Wall of a Place, with the possibility of tagging up to a maximum of ten Users per post.

Stravagando reserves the right to extend in the future the UGC Tagging functionality to other types of Content, or to limit its scope of application, with reasonable notice to Users in accordance with Section 19.

8-bis.2 Conditions of applicability

A UGC Tag may be applied solely when both of the following conditions jointly apply:

• reciprocity of the follow relationship between the tagging User and the tagged User (both must mutually follow each other on the platform);

• prior consent of the tagged User, expressed through the "Allow others to tag me in content" setting, active by default and modifiable at any time from the Profile settings (cf. Section 5.4).

Where one of the two conditions is not met, the UGC Tagging attempt is silently ignored by the system: the Content is published without any reference to the non-taggable User and no notification is generated, either to the tagger or to the protected recipient.

8-bis.3 Notification and visibility

The validly tagged User:

• receives an in-app notification and, according to their notification preferences (Section 17), a possible email notification at the time of the actual publication of the Content containing the Tag;

• views the Content in their "Personal feed" section (route /{locale}/feed), among the mentions received.

8-bis.4 Removal of the Tag

The tagged User has the right to remove their Tag at any time from the Content, without need for justification, through the link present in the notification or directly from the Profile. The removal is immediate and definitive and does not entail the deletion of the Content itself, which remains published without the association to the User who exercised the right. The User who originally applied the Tag may also remove it autonomously.

The User who had applied the Tag receives a notification of the removal carried out by the recipient, without indication of justification. The system retains a record of the operation (timestamp and identifier of who removed the Tag) for audit and abuse-prevention purposes, in accordance with the procedures described in the Privacy Notice.

8-bis.5 UGC Tags and Content under moderation

Where the Content with which a UGC Tag is associated is awaiting publication because placed under review by the moderation system (Sections 6.4, 11 and 12), the possibly tagged Users do not receive any notification until the time of the actual publication of the Content.

Where the Content is ultimately rejected as a result of moderation, no notification relating to the UGC Tag is transmitted and the association remains without public effects.

8-bis.6 Prohibitions of abusive use

The use of the UGC Tagging functionality for the purpose of harassment, persecution, spamming, unauthorised marketing, defamation or commercial promotion of one's own products or services is prohibited.

The repeated or abusive use of UGC Tagging — by way of example: the insistent application of Tags to a User who has removed them several times, or the use of the Tag for the purpose of undisclosed advertising — constitutes a breach of these Terms and entitles Stravagando to apply the sanctions under Section 13, without prejudice to the liability provided for by Section 14-bis on advertising transparency and by Section 24 on indemnification.

8-bis.7 Exclusion of liability of Stravagando

Stravagando acts as a neutral hosting service provider with respect to the content of the UGC Tag. The responsibility for the application of the Tag, for the truthfulness of the mention and for any third-party claims remains exclusively with the tagging User, according to the warranties and indemnification obligations provided for in Sections 6.3 and 24.

8-bis.8 Effects on the gamification system

The application of UGC Tags to posts on the Wall of a Place does not entail the attribution of experience points (XP) nor the unlocking of Achievements, neither for the tagging User nor for the tagged User.

For UGC Tags applied to check-ins within the companion tagging functionality, the specific regime of Section 8 applies instead: the related gamification recognitions comprise the attribution of XP to the tagging User only (within the daily cap) and the progression towards the dedicated companion Achievements for both Users (tagger and tagged), as provided for by Section 9 and by the Technical Specifications of the Service.

9. Gamification System (XP, Levels, Achievements, Streak)

Stravagando offers a gamified system aimed at encouraging the exploration of the territory. The system is fed mainly by geolocated check-ins (Section 7) and, on an accessory basis, by other activities of the User on the platform. The system includes:

• XP (experience): points accumulated through valid check-ins (main mode), publication of reviews, posts and photos, completion of Achievements, maintenance of streaks. The XP→Level conversion formula is described in the Technical Specifications of the Service;

• Levels: progression on a numerical scale calculated on the basis of the total XP accumulated, according to the scale indicated in the Specifications;

• Achievements (badges): symbolic recognitions unlocked upon the occurrence of certain conditions (e.g. visiting a certain number of places, exploring a region, completing a thematic route). The Achievements may be classified into bands of symbolic value as indicated in the Specifications;

• Streak: consecutive series of activity, with recognitions at milestones as indicated in the Specifications;

• Level Perks: advantages associated with reaching certain Levels, of a predominantly cosmetic nature or of early access to beta functionalities. They may include discount codes applicable to the separate marketplace (governed by the Terms of Sale), access to editorial programs or other symbolic advantages, according to the types indicated in the Specifications;

• Year Review: periodic statement of the User's activity, generated with the frequency and format indicated in the Specifications.

The attribution of XP for each type of activity is determined by the technical rules in force, published in the Specifications or consultable in the help section of the platform, and may be modified by Stravagando as provided for in paragraph 9.3.

9.1 Symbolic nature

XP, Levels, Achievements, Badges, Streaks and any other gamified element of the platform are of an exclusively symbolic and recreational nature. They do NOT constitute virtual currency, do NOT have monetary value, are NOT convertible into money or into other goods or services, are NOT transferable between Users and are NOT resaleable to third parties. The User has no claim of credit against Stravagando in relation to such elements.

9.2 Level Perks and discount codes

Some Levels may give access to discount codes usable on the marketplace of paid experiences. Such codes are governed exclusively by the "General Terms and Conditions of Sale". The codes are promotional in nature, may have an expiry date, usage limits and specific conditions; they are not transferable and not convertible into money.

In addition to codes tied to reaching a Level, Stravagando may offer loyalty discounts that can be unlocked upon meeting combined conditions tied to the User’s activity — by way of example, a combination of the Level reached and the number of marketplace experiences actually attended with a check-in validated by the Host. Such discounts are promotional in nature and are governed, as to accrual, use, expiry and discontinuation, exclusively by the «Terms and Conditions of Sale». The principles set out in paragraph 9.1 (symbolic nature) and the right of modification under paragraph 9.3 remain unaffected.

9.2-bis Beta (experimental) functionalities

Some Level Perks may include early access to functionalities under development or testing (beta access). The User who accesses such functionalities acknowledges and accepts that:

• the beta functionalities are experimental, provided "as is", and may present malfunctions, errors, loss of data or interruptions;

• access may be revoked, modified or terminated by Stravagando at any time, even without notice, for technical, economic or product-development reasons;

• the beta functionalities may never be promoted to stable functionalities of the Service;

• Stravagando encourages beta Users to provide constructive feedback for the improvement of the product.

Any participation in the beta does not generate additional contractual rights compared to those deriving from these Terms.

9.3 Right to modify the system

Stravagando reserves the right to modify rules, thresholds, XP calculation formulas, definition of Achievements, streak-expiry rules and any other parameter of the gamification system. Significant changes will be communicated with 30 days' notice by email and in-app notification. Non-significant changes or technical corrections (by way of example: anti-abuse, bug-fixes, specific rebalancing) may be applied without notice. The retroactive attribution of advantages or the cancellation of advantages acquired through abuse are always possible, justified and notified to the User concerned.

9.4 Challenges

Stravagando offers a social, game-like feature called "Challenges", which allows Users to propose and take part in exploration objectives built on the check-in system (Section 7) — for example, reaching a given number of valid check-ins within a period, or visiting a specific set of places, including with constraints by category or geographic area. Challenges may take an individual form (one-versus-one) or a group form (one-versus-many), have public or private visibility, and allow open participation or participation subject to the creator's approval.

Symbolic nature. The outcome of a Challenge results solely in a leaderboard placement and, where applicable, the award of a cosmetic trophy or badge. Challenges do not grant XP and do not award prizes of any economic value: the principles set out in paragraph 9.1 (symbolic, non-monetary, non-transferable nature) apply to them in full.

Exclusion from prize-competition rules. Since the only recognitions provided are purely symbolic and have no economic value, Challenges do not constitute prize competitions or prize operations within the meaning of Italian Presidential Decree No. 430 of 26 October 2001, nor any gaming or betting activity.

User-generated content and moderation. The title, description and other content defined by the User who creates a Challenge constitute User-Generated Content (Section 6) and are subject to moderation (Section 12). A Challenge remains pending and does not become active until moderation has been successfully completed; Challenges that breach these Terms may be rejected, suspended or removed.

Fair play. Check-ins that count towards a Challenge's progress are subject to the rules of Section 7 and the prohibitions of Section 14, including the prohibition on geolocation falsification (GPS spoofing) and automation. Abusive conduct results in disqualification from the Challenge, cancellation of the results obtained and the possible application of the sanctions under Section 13.

Modification and cancellation. Stravagando may introduce, modify, suspend or discontinue the Challenges feature and its parameters (formats, objectives, durations, trophy-award rules) as provided in paragraph 9.3, and may cancel individual Challenges or their outcomes in the event of abuse, malfunction or breach of these Terms.

10. Public leaderboards

Stravagando publishes periodic rankings of the most active Users on a regional, national and general basis, and for different periods (week, month, all-time). The capacity of each ranking and the available periods are indicated in the Technical Specifications of the Service.

The appearance of a User in leaderboards is subject to the activation of the dedicated switch "show in public rankings" in the Profile settings (Section 5.3). Such switch is independent of the general visibility of the Profile (Section 5.1): the User may therefore have a public Profile but choose not to appear in the ranking, or vice versa.

The leaderboard shows username, profile photo (if present), level and XP for the period. The User may deactivate their visibility in the ranking at any time through the show_in_leaderboards setting (Section 5.3). The ranking snapshots are regenerated periodically according to the frequency indicated in the Specifications; for technical reasons, the User who opts out may continue to appear in the already-published snapshots until their subsequent update. Such propagation window is deemed acceptable in consideration of the non-sensitive nature of the data exposed (username, level, XP for the period).

11. Trust score and check-in verification

Each User has a Trust Score (0-100) calculated automatically on the basis of the technical consistency of their check-ins (e.g.: distance from the POI, frequency between geographically distant check-ins, patterns compatible with real use).

The Trust Score influences:

• the attribution of XP for check-ins (Section 7.2): Users with a low score may receive reduced XP or XP placed in pending until manual verification;

• the automatic publication of reviews (auto-approve for Users with a high score; manual review for a low score);

• the priority in content moderation;

• the possibility of accessing functionalities reserved to consolidated Users.

11.1 Automated decisions and human intervention

The calculation of the Trust Score and the decisions deriving therefrom constitute automated processing pursuant to Art. 22 GDPR. The User has the right to request human intervention, to express their opinion and to contest the decision, by writing to the contacts indicated in Section 28. Stravagando undertakes to provide a reasoned response within reasonable times and in any event no longer than 30 days from the request, save for complex cases requiring supplementary investigation.

12. Automated moderation (AI Systems)

Stravagando uses third-party artificial intelligence systems to analyse in advance the Content uploaded by Users:

• a language model from Anthropic for the textual classification of reviews, posts, comments and proposals;

• an image-analysis service from Google for the detection of adult, violent or offensive content in photos.

The specific identity of the models used, the confidence thresholds, the criteria for accessing the fast-track for Users with a positive history and the operational spending limits are indicated in the Technical Specifications of the Service and may be updated according to the regime under Section 19.

A fallback to manual review is always provided for borderline cases, for cases in which the automated systems are not available or for Content pending upon the exceeding of the operational limits.

Each decision of the AI system is recorded in a dedicated system table (decision, justification code, results, cost, latency). Such metadata are used for the purposes of audit, improvement of the system, management of any complaints and fulfilment of the transparency obligations under paragraphs 12.1 and 12.2.

12.1 Transparency

In compliance with Regulation (EU) 2024/1689 (AI Act) and with Art. 22 GDPR, Stravagando explicitly informs that UGC Content is subject to automated analysis and that the metadata of such analysis (decision, justification code, confidence threshold, model used) are retained for the purposes of audit, improvement of the system and management of any complaints.

12.2 Right to information

The User whose Content is the subject of removal, obscuration or request for modification receives a communication containing the decision adopted, the justification and the indication of the right to complain (Section 12-bis), in compliance with the principles of Art. 17 of Regulation (EU) 2022/2065 (Digital Services Act). Stravagando is progressively adapting the format and contents of such communication to the specific requirements of the DSA, including the interactions with the EU Commission and the database of statements of reasons.

12.3 Right to human review

The User may request human review of the moderation decision within 14 days of the notification. The review is carried out by qualified Stravagando staff and does not take place through the same automated system that issued the contested decision. Stravagando undertakes to provide a reasoned response within reasonable times and in any event no longer than 30 days from the request, save for complex cases requiring supplementary investigation.

12-bis. Notification of illegal content, complaints and out-of-court resolution (DSA)

In compliance with Regulation (EU) 2022/2065 (Digital Services Act), Stravagando makes available:

12-bis.1 Reporting mechanism (notice & action)

Any User or third party may report the presence of content deemed illegal or contrary to these Terms through the reporting form (content report) accessible from the interface of the Content itself, pursuant to Art. 16 DSA. The report must indicate:

• a justification chosen among the predefined categories (by way of example: spam, inappropriate content, out of context, harassment, other);

• the reference to the Content reported (automatically populated by the interface);

• the details of the reporter, save for content attributable to Arts. 3-7 of Directive 2011/93/EU, for which anonymous reporting is permitted;

• the declaration of good faith of the reporter.

Protection of the reporter's anonymity. The identity of the person who reports a Content is not exposed to the reported User at any stage of the procedure, in order to prevent retaliation and to guarantee freedom of reporting. The reporter's identity may be revealed solely upon request of the competent authority.

Management workflow. The reports feed a counter on the Content. Upon reaching a threshold (indicated in the Technical Specifications), the Content is automatically placed in a state of precautionary suspension (obscured from the public interface) pending review by the staff. The review concludes with one of the following decisions: dismissal of the report, removal of the Content, warning to the User, escalation to a sanction pursuant to Section 13.

Stravagando promptly responds to the reporter with the decision adopted and the relevant justification, pursuant to Art. 16(5) DSA.

12-bis.2 Internal complaints

The User who is the recipient of a moderation decision (removal, obscuration, suspension, ban) has the right to lodge a free internal complaint within 6 months of the notification of the decision, pursuant to Art. 20 DSA. The complaint is examined without undue delay by qualified staff not involved in the initial decision.

12-bis.3 Out-of-court dispute resolution bodies

The User who is not satisfied with the outcome of the internal complaint may turn to an out-of-court dispute resolution body certified pursuant to Art. 21 DSA. The list is published by the European Commission.

12-bis.4 Trusted Flagger

Reports coming from entities recognised as "trusted flaggers" pursuant to Art. 22 DSA are handled on a priority basis.

The status of trusted flagger is recognised solely to entities formally designated by the Digital Services Coordinator of the Member State of establishment (in Italy, AGCOM), on the basis of the requirements provided for by Art. 22(2) DSA: specific expertise in the identification of illegal content, independence from hosting service providers, transparent, accurate and objective activity.

Stravagando may suspend the status of trusted flagger with respect to entities that have submitted a significant number of manifestly unfounded reports, in compliance with Art. 22(3) DSA, after a formal warning and the right to be heard. Stravagando publishes annually a report on the use of the trusted flagger mechanism pursuant to Art. 22(4) DSA, available in the legal section of the platform.

12-bis.5 Single points of contact

In compliance with the Digital Services Act, Stravagando designates two distinct points of contact:

• Point of contact for the authorities (Art. 11 DSA): the email address support@stravagando.com, dedicated to direct electronic communications between Stravagando and the authorities of the Member States, the European Commission and the European Board for Digital Services. Communications are accepted in Italian and English. The requests are handled with timing compatible with the urgent nature of the requests of the competent authorities;

• Point of contact for the recipients of the service (Art. 12 DSA): the email address support@stravagando.com, dedicated to direct communications of Users, as an alternative to the ordinary support channels indicated in Section 28. Communications are accepted in Italian and English.

Stravagando, being established in the European Union (Italy), is not required to designate a specific legal representative pursuant to Art. 13 DSA.

13. Account sanctions

In the event of a breach of these Terms, Stravagando applies a system of gradually more severe sanctions:

1. Warning: formal communication of breach, without operational limitations;

2. Restricted: the Account is placed in read-only mode for a determined period; the User retains access to their data but cannot publish new Content;

3. Suspended: temporary suspension of the Account with a preset reactivation date;

4. Banned: permanent block of access to the Account. The User's public Content is immediately obscured and subsequently subjected to the extended retention regime referred to in the last paragraph of this Section, in view of definitive deletion.

The sanction is notified by email to the registered address, contains the justification, the reference to the breached provision, the indication of the right to complain and of the terms for exercising it.

In the event of a ban, the User's Content is hidden from the public interface (soft-delete) but retained for 90 days for the purpose of managing any complaints, internal disciplinary investigations and legal proceedings, save for the cases of extension referred to in Section 16.1 (legal hold).

13.1 Right to complain

The User has the right to lodge a complaint within 30 days of the notification of the sanction, according to the mechanism described in Section 12-bis.2. The right to turn to the judicial authority remains unaffected.

13.2 Proportionality

The severity of the sanction is proportionate to the extent of the breach, to the recidivism and to the impact on the other Users. For serious breaches (by way of example: hate speech, doxxing, exploitation of minors, fraud), Stravagando may directly apply the most severe sanction.

14. Prohibited conduct

By way of example and not exhaustively, it is prohibited to:

• use bots, scripts or automated systems to accumulate XP, likes, followers or to simulate activity;

• create or use multiple Accounts, including for suspicious reciprocal exchanges;

• carry out spam, in breach of the operational publication limits and of the anti-duplicate systems indicated in the Technical Specifications of the Service;

• publish content of hate speech, harassment, doxxing, threats;

• carry out unauthorised scraping of the data of the Places catalogue, of the Profiles or of other sections of the platform in breach of the technical limitations imposed (robots.txt, rate-limit, non-public API);

• carry out false check-ins through GPS spoofing or other position-simulation techniques: such attempts entail the lowering of the Trust Score and sanctions;

• use the Service for unauthorised commercial purposes, in particular to promote one's own commercial activities through UGC (example: writing positive reviews about one's own business while posing as an ordinary user, or using the Profile for advertising);

• upload malware, malicious code or carry out unauthorised intrusion/penetration-testing attempts;

• infringe the copyright, trademark or patent rights of third parties;

• impersonate other persons, including public ones;

• publish sexually explicit material or child-exploitation material (promptly reported to the competent authorities);

• circumvent the technical limitations of the Service or the sanctions applied.

The list is not exhaustive. Stravagando reserves the right to assess on a case-by-case basis any conduct contrary to the purposes of the Service.

14-bis. Advertising transparency and sponsored content

14-bis.1 Identification of advertising content

In compliance with Arts. 26 and 28 of Regulation (EU) 2022/2065 (DSA) and with Legislative Decree 145/2007 (misleading and unlawful comparative advertising), Stravagando undertakes to identify in a clear, concise, unambiguous and real-time manner, through standardised labels or visual badges, any content of an advertising, sponsored or promotional nature present on the platform. The following, among others, qualify as such:

• sponsored listings by Hosts (experiences in a sponsored or featured position) in the integrated marketplace (cf. Art. 3.10 Terms of Sale);

• sponsored editorial content produced in partnership with tourist destinations, commercial brands, public or private entities;

• promotional newsletters produced in collaboration with sponsors or commercial partners (cf. Section 17-bis);

• posts or reviews of Users produced in the context of affiliation agreements, commercial partnerships, exchange of products/services or declared sponsorships, to be mandatorily identified with a dedicated label (cf. paragraph 14-bis.4).

14-bis.2 Advertising based on sensitive data

In compliance with Art. 26(3) DSA, Stravagando does not use for advertising purposes the personal data falling within the special categories referred to in Art. 9 GDPR (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, sex life or sexual orientation).

14-bis.3 Advertising directed at minors

In compliance with Art. 28 DSA, Stravagando does not present targeted advertising based on profiling, referred to in Art. 4(4) GDPR, to Users who are presumed with reasonable certainty to be minors. The technical and organisational measures adopted for this purpose are described in the Technical Specifications of the Service and include, among other things, the exclusion of advertising profiling signals for Accounts that have declared an age of under 18 years or for which there are behavioural indicators consistent with minor age.

14-bis.4 User obligations on their own sponsored content

The User who publishes UGC Content in the context of affiliation, sponsorship, commercial partnership or exchange of products/services with commercial Hosts, tourism brands, entities or third parties is required to:

• explicitly declare the promotional nature of the Content, by means of an adequate indication (by way of example: #adv, #sponsored, "[Advertising content]", "[Commercial collaboration]");

• not conceal the promotional nature through forms of misleading advertising or native advertising not identifiable as such;

• comply with the indications of the competent authorities (Communications Regulatory Authority — AGCOM, Competition and Market Authority — AGCM, Advertising Self-Regulation Institute — IAP) on transparency in the relations between content creators and brand sponsors.

The breach of these obligations may entail the removal of the Content, the application of the sanctions under Section 13 and — where it can be configured as an unfair commercial practice — the report to the competent authorities.

14-bis.5 Advertising repository (VLOP status)

Where Stravagando should in the future acquire the status of "very large online platform" (VLOP) or "very large online search engine" (VLOSE) pursuant to Chapter III, Section 5 of the DSA, a public advertising repository will be activated pursuant to Art. 39 DSA, accessible through a searchable and reliable interface. At present, such status does not exist and the obligation is not applicable, without prejudice to Stravagando's right to voluntarily adopt analogous transparency standards.

15. Intellectual property

15.1 Rights of Stravagando

The "Stravagando" trademark, the logo, the interface design, the source code, the aggregated database of places and contributions (limited to the structure, organisation and editorial enrichments), the editorial content curated by the staff and all the software components of the platform are the exclusive property of Horizon Servizi Integrati S.r.l.s. or of its licensors. Any reproduction, modification, distribution or commercial use without express written authorisation is prohibited.

15.2 OpenStreetMap data

A significant part of the data of the Places catalogue is obtained from OpenStreetMap, distributed under the Open Database License (ODbL) v1.0. Stravagando complies with the obligations of the ODbL licence applicable to its use of the data, including in particular:

• the clear display of the attribution "© OpenStreetMap contributors" on every page that presents OSM data;

• compliance with the criteria for qualifying its use (Produced Work / Derivative Database) pursuant to Section 4 of the ODbL licence.

The User who reuses data of the Places catalogue is required to autonomously comply with the applicable ODbL licence.

15.3 Citations and editorial fair use

Any citations of third-party content within posts or editorial articles respect the limits of editorial fair use and of Art. 70 of Law No. 633 of 22 April 1941 (Copyright). The User is required to comply analogously in their own publications.

16. Personal data and privacy

The processing of personal data is governed by the Privacy Policy, an integral part of these Terms. In summary:

• Stravagando processes geolocation data (lat/lng, rounded in the logs for pseudo-anonymisation purposes, see Section 7) for the operation of the check-in;

• The uploaded photos are subject to server-side EXIF metadata stripping, to limit the involuntary disclosure of coordinates or other technical data;

• The data are retained for an indefinite time save for explicit deletion or exercise of the GDPR rights;

• The User exercises the rights provided for by Arts. 15-22 GDPR (access, rectification, erasure, restriction, objection, portability, human intervention on automated decisions) through the Account privacy page (route account.privacy), from which it is in particular possible to request the export of one's own data (route account.gdpr.export), or by writing to the Data Protection Officer at the address support@stravagando.com. The portability export pursuant to Art. 20 GDPR does not include the Content possibly subject to legal hold (Section 16.1); the inclusion of such Content is possible only upon formal request of the competent authority;

• The right to be forgotten (Art. 17 GDPR) entails the total deletion of the Account and of the User's Content, save for the retention obligations provided for by law (e.g. tax obligations in the event of purchases on the marketplace) and save for the retention in anonymised form of aggregate data for statistical purposes, where technically irreversible;

• The data controller is Horizon Servizi Integrati S.r.l.s.; the DPO is reachable at the address support@stravagando.com.

16.0 Transparency on third-party providers (processors)

For the operation of the Service, Stravagando makes use of third-party providers qualifiable as processors pursuant to Art. 28 GDPR, or as joint controllers or independent controllers in specific cases, in particular for:

• automated moderation of textual and photographic content (Section 12);

• transport of transactional, service and marketing email communications (Sections 17 and 17-bis);

• delivery of web and mobile push notifications;

• processing of payments relating to the marketplace, entrusted to Stripe Payments Europe Ltd as independent controller for the purposes of payment execution, anti-fraud and financial compliance, as governed by the Terms of Sale;

• import of open cartographic data for the Places catalogue;

• federated authentication (SSO) through third-party identity providers (see Section 4): in such context the providers may operate as independent controllers for the data they manage on their own infrastructures, while Stravagando is the controller for the data received and subsequently processed in its own system;

• analytics and web traffic measurement, activated solely after the User's consent expressed through the cookie banner and managed according to the Consent Mode v2 model (see Section 18).

The updated list of providers, the type of data transferred to them, the legal basis of the transfer, any non-EU localisation and the safeguards adopted (standard contractual clauses, EU Commission adequacy decision where applicable, Art. 46 GDPR) are indicated in detail in the Privacy Policy and, for the technical parameters, in the Technical Specifications of the Service.

16.1 Extended retention for legal obligations and legal hold

By way of derogation from the ordinary retention terms provided for in these Terms (in particular, but not only, in Sections 6.5, 13 and 20), Stravagando reserves the right to extend the retention of specific data or Content beyond the standard term, limited to what and for the time strictly necessary, upon the occurrence of one of the following circumstances:

• formal request of the judicial authority, of the judicial police or of another competent authority (by way of example: production orders, evidentiary seizures, preservation orders under Art. 254-bis of the Italian Code of Criminal Procedure, requests under the Budapest Convention on cybercrime, measures of the Data Protection Authority);

• ongoing internal disciplinary proceeding or DSA complaint, referred to in Sections 12-bis and 13, until its definition;

• pending or reasonably foreseeable legal, judicial or extrajudicial dispute concerning the data or Content in question, for the establishment or defence of a right in court (Art. 17(3)(e) GDPR);

• specific legal obligation requiring retention (by way of example: tax obligations under Art. 2220 of the Italian Civil Code for data relating to marketplace transactions; anti-money-laundering obligations under Legislative Decree 231/2007 and Regulation (EU) 2024/1624; tax reporting obligations under Directive (EU) 2021/514 (DAC7) and Legislative Decree 32/2023; obligations to retain electronic traffic data under Legislative Decree 196/2003).

In all these cases:

• the retention is limited to the data and Content specifically relevant to the purpose justifying the extension, and does not extend to the entire informational patrimony of the User;

• the data retained under legal hold are accessible solely to authorised personnel and to the recipients of the legitimate request, and do not fall within the ordinary visibility of the platform;

• the duration is that strictly necessary to achieve the purpose; once the cause has ceased, the data are deleted without further delay;

• where not prohibited by the requesting authority or by legal provisions (for example, for investigative secrecy under Art. 329 of the Italian Code of Criminal Procedure), Stravagando informs the User concerned of the extension that has taken place and of the relevant justification, compatibly with investigative requirements.

The existence of a legal hold procedure does not in itself suspend or limit the User's rights under Arts. 15-22 GDPR, save for the exceptions provided for by Art. 23 GDPR and by the applicable legislation (investigative secrecy, requirements of justice, etc.).

17. Notifications and service communications

This Section governs the service communications addressed to the User in connection with the provision of the Service and the performance of the contract (for example: updates on check-ins, social interactions, gamification, Account security, changes to the Terms). Their legal basis is contractual performance pursuant to Art. 6(1)(b) GDPR or the legitimate interest of Stravagando pursuant to Art. 6(1)(f) GDPR. For direct marketing communications, reference is made to Section 17-bis.

Stravagando may send the User service notifications through:

• email (to the registered address);

• web push notifications (where the User has given consent to the browser);

• mobile push notifications (where the User has enabled push on future native iOS and Android applications);

• in-app notifications consultable within the platform.

The technical providers used for each channel are indicated in the Technical Specifications of the Service.

The User may activate/deactivate their consent for each category of notification in the Account settings. In particular, the categories are divided into:

• service categories (by way of example: social, gamification, informational marketplace activity notifications): deactivation is always possible;

• marketing-utility categories linked to the contractual relationship but of a promotional nature (by way of example: pre-experience reminders for bookings made, invitations to review after the experience, general promotional communications): sending is subject to the User's opt-in consent, granular for each category, and the withdrawal of consent is always possible;

• essential categories (by way of example: changes to the Terms, Account suspension, security alerts, marketplace receipts, legal communications, Account deletion confirmation): not deactivable as they are necessary for the performance of the contract and for the fulfilment of Stravagando's obligations.

For the direct marketing newsletter and the general promotional communications also addressed to non-Users, reference is made to Section 17-bis.

17-bis. Newsletter and direct marketing communications

This Section governs the promotional and direct marketing communications sent by Stravagando to the User (for example: periodic newsletter on new places in the catalogue, editorial articles, Atlas news, marketplace initiatives).

17-bis.1 Distinction from service communications

Marketing communications are distinguished from service communications (Section 17) by purpose, legal basis and consent regime. In particular:

• service communications have a legal basis in the performance of the contract (Art. 6(1)(b) GDPR) or in the legitimate interest (Art. 6(1)(f) GDPR) and are not entirely deactivable insofar as they are essential to the Service;

• marketing communications have a legal basis in the explicit consent of the data subject (Art. 6(1)(a) GDPR and Art. 130 of Legislative Decree 196/2003) and may be deactivated at any time by the data subject without prejudice to the use of the Service.

17-bis.2 Subscription and double opt-in

Subscription to the newsletter takes place by means of explicit and active expression of consent by the data subject (by way of example: completion of a dedicated form on the site, ticking of a non-pre-selected optional box during purchase on the marketplace, subscription through editorial articles).

The subscription follows the double opt-in model: following the subscription request, the data subject receives a confirmation email containing a validation link. Only after the activation of such link does the subscription become effective and the data subject may receive marketing communications. Unconfirmed requests lapse.

Subscription may take place independently of the holding of a Stravagando Account: the newsletter is also offered to persons not registered on the platform. Where the subscriber holds an Account, the status of the subscription is consultable from the Account privacy page (Section 5).

For the purpose of proving consent under Art. 7 GDPR, Stravagando records at the time of subscription: email address, any name, preferred language, source of the subscription, IP address, browser user-agent, timestamp of the acceptance of the privacy notice.

17-bis.3 Unsubscription

The data subject may withdraw consent at any time and unsubscribe from the newsletter, without need for justification and free of charge, through:

• the unsubscribe link present at the foot of every marketing email (recommended method);

• the one-click unsubscribe mechanism provided for by the industry standards for deliverability (RFC 8058), typically available directly from the interface of the email provider;

• the request sent to the Controller or to the Data Protection Officer at the contacts in Section 28.

The withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal itself (Art. 7(3) GDPR) and does not affect the service communications under Section 17.

17-bis.4 Retention of unsubscription data

Following unsubscription, Stravagando retains the record of the unsubscription that has taken place (in particular the email address in a form sufficient for unique identification and the withdrawal metadata) as a suppression list for the purposes of:

• guaranteeing the data subject respect for the choice not to be contacted again over time, avoiding accidental re-subscriptions and new sendings;

• documenting the unsubscription that has taken place in the event of complaints or investigations.

The legal basis of such retention is the legitimate interest in suppression pursuant to Art. 6(1)(f) GDPR, as well as the fulfilment of Art. 7(3) GDPR itself (obligation to respect the withdrawal of consent). Inclusion in the suppression list is less invasive, from the point of view of the protection of the data subject, than the total deletion of the data, since it precisely prevents the unwanted contact.

The data subject nonetheless has the right to request the deletion also of the suppression record, taking note of the consequences (any future re-subscription by the same data subject will no longer be recognised as such by the system).

17-bis.5 Providers and transfers

The sending of marketing and service communications is carried out through a third-party email provider, qualified as a processor pursuant to Art. 28 GDPR and indicated in the Technical Specifications of the Service. For the safeguards applied to non-EU transfers, reference is made to Section 16.0 and to the Privacy Policy.

17-ter. Assistance to unregistered visitors (guest help)

Stravagando makes available a pre-registration support channel that allows any visitor to contact the Service without the need for an Account. The request takes place through a public form in which the visitor provides a valid email address and their query. Stravagando sends to the indicated address an access token that allows the visitor to consult the replies and to continue the conversation, without the need for permanent credentials.

The data collected in this mode are processed pursuant to the Privacy Policy. The guest help conversations are subject to automatic closure for inactivity after a determined period (indicated in the Technical Specifications), at the end of which the data are retained according to the retention rules applied to UGC Content and to the legal-hold cases referred to in Section 16.1.

18. Cookies, local storage and analytics

The use of cookies and similar technologies is governed by the Cookie Policy, in compliance with the Decision of the Data Protection Authority of 10 June 2021 ("Cookie Guidelines") and with Directive 2002/58/EC (ePrivacy). The User's consent is recorded in append-and-update mode, with the complete history preserved, and includes timestamp, IP address, user-agent and purposes accepted or withdrawn, in compliance with the accountability principle under Art. 5(2) GDPR. The User may modify or withdraw their consent at any time from the dedicated page. The technical details relating to the methods of recording consent are indicated in the Technical Specifications of the Service.

18.1 Browser local storage (PWA and Service Worker)

The Service is also designed as a Progressive Web App (PWA) installable on the User's device and includes a Service Worker that uses the browser's native APIs (Cache API, IndexedDB, localStorage) for the purposes of:

• caching of static resources for offline operation and for performance;

• local storage of user preferences (language, theme, layout) and of application state;

• support for installable functionalities and for push notifications (where enabled by the User).

Such storage takes place exclusively on the User's device, does not transfer data to Stravagando directly and does not constitute processing of personal data by the Controller insofar as it remains confined to the local browser. The User may empty such storage at any time from the settings of their browser.

18.2 Analytics and traffic measurement

Stravagando uses web analytics tools to measure traffic, conversions and use of the Service, indicated in the Technical Specifications and in the Cookie Policy.

In compliance with the rulings of the Data Protection Authority and with consolidated European practice, the analytics tools are activated solely after the explicit consent of the User given through the cookie banner, according to the Consent Mode v2 model: in the absence of consent, the tools remain in a denied state and do not transmit identifying data to third parties.

19. Modification of the Terms

Stravagando may modify these Terms for:

• regulatory updates;

• introduction of new functionalities;

• improvements of the Service;

• security reasons.

Substantial changes are communicated to the User with 30 days' notice by email and in-app notification, indicating the date of entry into force.

The continuation of the use of the Service after entry into force constitutes acceptance of the new versions. The User has the right to terminate the relationship free of charge before entry into force, retaining the right to the full portability of their data and Content pursuant to Art. 20 GDPR.

Changes of a purely technical, lexical or corrective nature (typos, reformulations that do not affect the User's rights) may be applied without notice, giving evidence thereof in the version history.

19.1 Update regime of the Technical Specifications of the Service

The Technical Specifications of the Service, described in Section 2 and an integral part of the contractual relationship, are of an operational and configurable nature. The relevant changes are communicated to the User with reduced notice of 7 days by email and/or in-app notification, indicating the changes and the date of entry into force.

Such simplified regime applies solely to changes that do not affect the principles and rights set out in these Terms. Any change to the Specifications that, by its scope, affects the substantial rights of the User (by way of example: reduction of essential functionalities; substantial worsening of service levels; introduction of limitations that modify the economic or operational balance of the relationship) is treated as a modification of these General Terms and follows the ordinary notice of 30 days referred to in the preceding paragraph, with the right to terminate free of charge and to data portability pursuant to Art. 20 GDPR.

In the event of an interpretative conflict between the Specifications and these Terms, the Terms prevail.

20. Withdrawal by the User

The User may close their Account at any time, without notice and without need for justification, exercising the right to erasure under Art. 17 GDPR through the self-service functionality available on the Account privacy page (route account.gdpr.delete). The procedure provides for a confirmation page with information on the consequences of the deletion and an explicit confirmation by the User, in order to prevent accidental deletions.

Following the deletion request:

• the Account is immediately deactivated and no longer publicly accessible;

• the identifying personal data of the Account and the User's Content are subjected to soft-delete and retained for a determined period (as a rule 30 days from the request), after which they are definitively deleted. Such period is justified by the need to manage any complaints, abuse investigations and fulfilment of legal obligations, as well as to prevent accidental deletions. Such 30-day term, relating to the deletion of the Account on the User's initiative, is distinct and autonomous from the different retention term of 90 days applicable to the Content of banned Users referred to in Section 13, which remains governed by the provisions set out therein;

• the cases of extension of retention referred to in Section 16.1 (legal hold) remain unaffected, including the tax obligations under Art. 2220 of the Italian Civil Code for the data relating to transactions on the separate marketplace;

• the anonymous/aggregate retention of data for statistical purposes is reserved, where technically irreversible, pursuant to the Privacy Policy;

• the XP, levels, Achievements accrued are deleted without right to indemnification, consistently with their symbolic nature (Section 9.1).

The closure of the Account does NOT give the right to refunds on any purchases already made on the marketplace, governed by the separate Terms of Sale.

The consumer User retains unaffected the right of withdrawal provided for by Arts. 52 et seq. of Legislative Decree 206/2005 (Consumer Code) for any paid services, as specifically governed by the relevant Terms of Sale.

21. Withdrawal and suspension by Stravagando

Stravagando may suspend or terminate the contractual relationship with the User:

• in the event of a breach of these Terms, according to the gradualness of Section 13;

• in the event of particularly prolonged inactivity of the Account, in accordance with methods and times that the platform may introduce in the future, after notice by email with no less than 30 days' notice;

• for cessation of the Service (total or partial): in such case Stravagando communicates the cessation with 90 days' notice, making available the export of data pursuant to Art. 20 GDPR.

22. Limitation of liability

The Service is provided "as is" and "as available".

Within the limits permitted by law, and save for the cases of wilful misconduct and gross negligence as well as the mandatory guarantees provided in protection of the consumer by Legislative Decree 206/2005 and by the applicable legislation, Stravagando does not guarantee:

• the accuracy, completeness or currency of the data relating to the places presented in the catalogue, in particular those deriving from open sources such as OpenStreetMap;

• the uninterrupted continuity of the Service: technical interruptions for maintenance, updates or unforeseen events are acceptable;

• the perfect compatibility of the Service with every device, browser or network configuration;

• the absence of errors, bugs or vulnerabilities.

Stravagando is not liable for indirect, consequential damages, loss of profit, loss of chance or reputational damages not attributable to its own gross negligence or wilful misconduct.

22.1 Quantitative limit of liability

Within the limits permitted by law, and save for the cases of wilful misconduct, gross negligence, personal injury and breach of mandatory consumer rights, the overall liability of Stravagando towards the User, on any ground and with reference to all events connected with the relationship governed by these General Terms, may not exceed the amount of € 100 (one hundred euros).

Such threshold refers exclusively to the relationship governed by these General Terms, which is of a non-onerous nature for the User in the non-transactional components (Account, Social, Gamification, UGC, Places catalogue). For the transactional aspects of the marketplace, the different regime provided for by the Terms of Sale applies (Art. 14.2), which provides for specific limits (€ 500 per purchasing Customer with reference to the Total Amount of the Booking concerned, € 100 per non-purchasing User).

In any event, liability for personal injury, for breaches of essential obligations of the contract and for the other cases in which the law does not allow the exclusion or limitation of liability towards the consumer remains unaffected.

23. Information on the risks of visits

The places suggested by the platform include natural environments, trails, cliffs, mountains, historic buildings, remote or hardly accessible areas.

The User who decides to visit them does so under their own autonomous responsibility, after having adequately assessed:

• their own psycho-physical conditions and technical abilities;

• the weather and environmental conditions;

• the appropriate equipment;

• any access limitations (private property, protected areas, prohibitions);

• the applicable local legislation.

Stravagando provides information for informational purposes and does not replace professional guides, institutional sources (e.g. CAI, civil protection authorities) or expert advice. Stravagando is not liable for accidents, injuries or damages occurring during visits to places published in the catalogue or suggested by other Users, save for the cases of its own gross negligence or wilful misconduct in the editorial content directly curated.

24. Indemnification

The User undertakes to hold Stravagando harmless, within the limits permitted by law and limited to the cases of wilful misconduct or gross negligence of the User themselves, from any third-party claim, including reasonable legal expenses, arising from:

• Content uploaded by the User in breach of copyright, image rights, privacy or other rights of third parties;

• illegal or unauthorised use of the Service;

• breach of these Terms.

Stravagando will promptly notify the User of the existence of such claims and will reasonably cooperate in their management.

25. Force majeure

Neither party is liable for breaches due to causes of force majeure, understood as extraordinary and unforeseeable events outside its reasonable control: natural disasters, armed conflicts, acts of terrorism, pandemics, general strikes, acts of the public authority, prolonged interruptions of critical infrastructures (electricity grid, internet backbone connectivity), massive cyber-attacks.

For the period of duration of the event, the obligations are suspended. If the cause of force majeure persists for more than 90 days, either party may withdraw without notice.

26. Competent court and dispute resolution

In the event of a dispute, the parties undertake to first attempt an amicable resolution. The User may turn to Stravagando through the contacts in Section 28; Stravagando undertakes to respond within 30 days.

The possibility of resorting to the out-of-court dispute resolution (ADR) bodies remains unaffected, including the European ODR platform (https://ec.europa.eu/consumers/odr) pursuant to Regulation (EU) 524/2013, as well as mandatory mediation pursuant to Legislative Decree 28/2010 for the matters provided for therein.

For disputes not resolved amicably, the competent court is the Court of Pescara. However, pursuant to Regulation (EU) 1215/2012 (Brussels I bis), Arts. 17-19, the consumer resident in the EU/EEA may always act before the court of their own State of residence, and be sued solely before such court.

The right of the consumer to take part in collective representative actions pursuant to Legislative Decree 28/2023 (transposition of Directive (EU) 2020/1828) also remains unaffected.

27. Applicable law

These Terms are governed by Italian law. Pursuant to Regulation (EU) 593/2008 (Rome I), Art. 6, the mandatory consumer-protection provisions provided for by the law of their own State of residence, where more favourable, remain in any event applicable to the consumer resident in the EU/EEA.

28. Contacts and references

Operator of the Service: Horizon Servizi Integrati S.r.l.s.

Registered office: Viale Giovanni Bovio, 103/1 65124 Pescara (PE), Italy

VAT No.: 02445190685

PEC: horizonserviziintegrati@pec.it

General support email: support@stravagando.com

Legal email: support@stravagando.com

Data Protection Officer: support@stravagando.com (dedicated address that the Operator may communicate by updating the Privacy Policy)

DSA single point of contact for authorities: support@stravagando.com (Italian, English)

DSA single point of contact for users: support@stravagando.com (Italian, English)

Main regulatory references

EU legislation

• Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR)

• Regulation (EU) 2018/1807 on the free flow of non-personal data

• Regulation (EU) 2022/2065 — Digital Services Act (DSA)

• Regulation (EU) 2024/1689 — Artificial Intelligence Act (AI Act)

• Regulation (EU) 2019/1150 — Platform-to-Business Transparency Regulation (P2B)

• Regulation (EU) 524/2013 — consumer ODR

• Regulation (EU) 1215/2012 — Brussels I-bis

• Regulation (EU) 593/2008 — Rome I

• Regulation (EU) 910/2014 — eIDAS

• Regulation (EU) 2024/1624 — AML (Anti-Money Laundering)

• Directive (EU) 2019/770 — Contracts for the supply of digital content and services

• Directive (EU) 2019/771 — Sale of consumer goods

• Directive (EU) 2019/2161 — Omnibus (modernisation of consumer protection)

• Directive (EU) 2020/1828 — Consumer representative actions

• Directive (EU) 2021/514 — DAC7 (taxation of digital platforms)

• Directive 2002/58/EC — ePrivacy

• Directive 2000/31/EC — Electronic commerce

• Directive 2011/93/EU — Combating the sexual abuse and exploitation of minors

Italian national legislation

• Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (Italian Privacy Code)

• Legislative Decree 70/2003 (Electronic commerce)

• Legislative Decree 82/2005 (Digital Administration Code — CAD)

• Legislative Decree 206/2005 (Italian Consumer Code)

• Legislative Decree 231/2007 (Anti-money-laundering and countering the financing of terrorism)

• Legislative Decree 145/2007 (Misleading and unlawful comparative advertising)

• Legislative Decree 28/2010 (Civil and commercial mediation)

• Legislative Decree 173/2021 (Transposition of Directive (EU) 2019/770)

• Legislative Decree 170/2021 (Transposition of Directive (EU) 2019/771)

• Legislative Decree 26/2023 (Transposition of the Omnibus Directive)

• Legislative Decree 28/2023 (Transposition of Directive 2020/1828 representative actions)

• Legislative Decree 32/2023 (Transposition of the DAC7 Directive)

• Law No. 633 of 22 April 1941 (Copyright)

• Law 191/2023 (CIN — National Identification Code for tourist accommodation)

• Italian Civil Code (in particular Arts. 1176, 1229, 1341, 1411-1413, 1681, 2002, 2220)

• Italian Code of Criminal Procedure (Art. 254-bis preservation order; Art. 329 investigative secrecy)

• Presidential Decree 445/2000 (Administrative documentation)

Regulatory measures

• Decision of the Data Protection Authority of 10 June 2021 (Cookie Guidelines)

• AGCOM measures on digital services and trusted flaggers

• AGCM measures on unfair commercial practices

• Self-Regulation Code of Commercial Communication (IAP)

29. Evolving functionalities

These Terms refer, in several points, to functionalities of the Service that the Platform may introduce, activate or develop in the future but which, at present, are not operational in production. The inclusion of such references has the function of pre-contractual transparency towards the User, but does not constitute a commitment or contractual obligation of Stravagando to actually activate the individual functionality.

The main functionalities mentioned as potential future developments are:

• Username modification (Sec. 4): possibility for the User to modify their username visible on the platform, possibly with frequency limits and uniqueness rules;

• Email verification as gating (Sec. 4.1): subjecting access to sensitive functionalities (by way of example: publication of Content, access to the marketplace) to the prior verification of the email address;

• Advanced age-verification systems (Sec. 3 and 4): request for the date of birth or adoption of more robust age-verification systems, including in implementation of Art. 28 DSA on the protection of minors;

• Personal API tokens (Sec. 4.3): possibility for the User to generate personal programmatic-access tokens with enabling scopes, according to the conditions of use indicated in the Technical Specifications at the time of activation;

• Formalised right of reply on UGC (Sec. 6.5): structured mechanism that allows the User who is the subject of critical citation to publish a short reply;

• Account closure for prolonged inactivity (Sec. 21): automatic mechanism of deactivation of Accounts that present exceptionally prolonged inactivity, after no less than 30 days' notice by email;

• Monetary cashback programs, accruable points or user wallet (cf. Art. 8.8 Terms of Sale): loyalty systems that attribute benefits of a monetary nature or convertible into goods/services, distinct from the purely symbolic Level Perks referred to in Section 9.2;

• VLOP advertising repository (Sec. 14-bis.5): publication of the advertising repository pursuant to Art. 39 DSA, applicable only in the event of future qualification as a very large online platform (VLOP);

• Beta functionalities (Sec. 9.2-bis): early access to experimental functionalities granted as a Level Perk, subject to all the uncertainties and revocability typical of experiments.

The actual activation of each functionality will be communicated to the User through the channels referred to in Section 17, with any update of these Terms or of the Technical Specifications of the Service according to the regime under Section 19.

The above list is not exhaustive: Stravagando may develop and activate further functionalities not mentioned in these Terms, within the limits of its right to product evolution and in compliance with the User's rights under these Terms.

In the event of a conflict between the Italian version and the translations into other languages (EN/FR/DE/ES), the Italian version prevails, save for the mandatory consumer-protection provisions referred to in Art. 6 of Regulation (EU) 593/2008.