Color Fest 11–12–13 August 2027

Last updated: 7 October 2026 · Version 1

This cookie policy explains which cookies and similar technologies the colourfest.it website uses, including the linked information pages, for what purposes, and how you can manage your preferences. It should be read in conjunction with the privacy policy.

1. Data controller

What Are Clouds APS, organiser of the Color Fest, Via dei Brutii 97, 88046 Lamezia Terme (CZ), Tax Code 92029190797, VAT No. 03309120792. Email: scrivi@colorfest.it

2. What are cookies and similar technologies?

Cookies are small text files that a website stores in your device’s browser and reads back during subsequent visits. Similar technologies, such as the browser’s localStorage and sessionStorage, or tracking pixels, store or read information in a similar way. On this page, we use the term “cookie” to refer to all of them.

Cookies can be in the first part, installed directly from this website, or from third parties, set by third parties via content or services featured on the pages. They may remain active until the browser is closed (session cookies) or for a specified period (persistent cookies).

3. When your consent is required

In accordance with Article 122 of the Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018), Regulation (EU) 2016/679 (GDPR) and the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority on 10 June 2021:

Technical cookies, which are essential for the website, the shopping basket and the payment process to function, or for providing a service you have requested, do not require your consent;
All other cookies and tracking tools are only activated once you have given your free, specific and informed consent, which you may refuse or withdraw at any time without this affecting your ability to browse the website or make a purchase;
Scrolling down the page or simply continuing to browse does not constitute consent.

Until you give your consent, the scripts for services that require it will not be loaded and embedded content will remain blocked: a notification will appear in their place, with a button to enable them.

We also communicate your choices to Google (Consent Mode v2), Meta and Microsoft via their respective consent signals: in the absence of consent, these services are set to “denied” and cannot use cookies for analytics or advertising.

Global Privacy Control. If your browser sends the GPC signal, we treat this as a refusal of marketing services: they remain disabled even if you select «Accept all», and you can only enable them by selecting them yourself, one by one, in your preferences.

4. Cookies and services used

Strictly necessary

These are necessary for the website, the shopping basket and the payment process to function, and to remember your cookie preferences. They do not require consent and cannot be disabled.

Legal basis: Article 122(1) of the Data Protection Act: consent is not required because these are essential for providing the requested service.

Name	Type	Duration	Purpose
`cfc_consent`	Cookies	6 months	Save your cookie preferences and the random consent identifier.
`woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*`	Cookies	end of session or 2 days	Shopping basket and purchase of tickets, camping and merchandise.
`__stripe_mid, __stripe_sid`	Cookies	up to 1 year	Prevention of card payment fraud, managed by Stripe.
`trp_language`	Cookies	30 days	Remember the language you have chosen for the website.
`wc_facebook_signals_state`	Cookies	6 months	Please note that the Meta pixel may be activated, depending on your choice regarding marketing cookies.
`wordpress_logged_in_, wordpress_sec_, wordpress_test_cookie, cerber_*`	Cookies	end of session or 14 days	Access to and security of the restricted area; authorised staff only.
`Cookie with a random name (for example, qaCQZXuB_)`	Cookies	1 day	Protection of the website and forms against spam and bots (WP Cerber).
`PHPSESSID`	Cookies	end of session	A technical session on the server whilst browsing.
`wp-settings-, wp-settings-time-`	Cookies	1 year	Preferences for the members’ area – for authorised staff only.
`Elementor`	localStorage	until it is deleted	Remember whether you have already closed a pop-up on this website.
`cf_vid, cf_analytics_optout`	localStorage	until it is deleted	First-party aggregated statistics on the festival’s information pages: internal measurement, anonymised IP addresses, no cross-referencing with other data and no disclosure to third parties.
`cf_sid`	sessionStorage	end of session	Groups pages viewed during the same session for first-party aggregate statistics.
`cfc-session`	sessionStorage	end of session	Avoid counting the same visit twice in the anonymous consent statistics.

Features

They enable additional features provided by third parties, such as anti-spam protection for forms.

Legal basis: Consent (Article 6(1)(a) of the GDPR and Article 122 of the Privacy Code).

Google reCAPTCHA

Supplier: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Purpose: Protection of registration and contact forms against spam and automated messages.

Name	Duration	Purpose
`_GRECAPTCHA`	6 months	Risk analysis to distinguish between individuals and automated programmes.

Data transfer: Possible transfer to the United States, covered by the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework).

Supplier’s information: https://policies.google.com/privacy?hl=it

With regard to the collection and transmission of data via embedded third-party services, the data controller of this website and the service provider may be regarded as joint data controllers. Any subsequent processing is carried out by the service provider as an independent data controller, in accordance with its own privacy policy.

Third-party content

They display content hosted by other services, such as videos, maps and podcasts. These providers may set cookies, including profiling cookies, and receive your IP address.

Legal basis: Consent (Article 6(1)(a) of the GDPR and Article 122 of the Privacy Code).

YouTube

Supplier: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Purpose: Playback of videos embedded on the pages. YouTube may also contact Google’s advertising domains (doubleclick.net).

Name	Duration	Purpose
`YSC`	end of session	Identifies the video viewing session.
`VISITOR_INFO1_LIVE`	6 months	It estimates the available bandwidth and remembers the player’s preferences; it can also be used for advertising purposes.
`VISITOR_PRIVACY_METADATA`	6 months	Stores the user’s consent status on the YouTube domain.
`__Secure-YNID, __Secure-ROLLOUT_TOKEN`	6 months	How the YouTube player works and safety.

Data transfer: Possible transfer to the United States, covered by the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework).

Supplier’s information: https://policies.google.com/privacy?hl=it

Google Maps

Supplier: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Purpose: View interactive maps showing the location of the festival site, car parks and facilities.

Name	Duration	Purpose
`NID and other Google cookies (google.com domain)`	up to 6 months	They remember your preferences and browsing information; they may also be used for advertising purposes, in accordance with Google’s privacy policy.

Data transfer: Possible transfer to the United States, covered by the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework).

Supplier’s information: https://policies.google.com/privacy?hl=it

Spotify

Supplier: Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden

Purpose: Listen to tracks, playlists and podcasts embedded on the pages.

Name	Duration	Purpose
`sp_t, sp_landing (domain spotify.com)`	up to 1 year	They identify the browser and the playback session in the Spotify player.

Data transfer: Data may be transferred to the United States, in accordance with the safeguards set out in the provider’s privacy policy.

Supplier’s information: https://www.spotify.com/it/legal/privacy-policy/

Statistics

They help us understand how the website is used and where purchases come from, by tracking visits and interactions.

Legal basis: Consent (Article 6(1)(a) of the GDPR and Article 122 of the Privacy Code).

Google Analytics 4

Supplier: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Purpose: Aggregated statistics on website usage and the effectiveness of the festival’s communication campaigns.

Name	Duration	Purpose
`_ga`	2 years	It identifies visitors anonymously.
`_ga_`	2 years	It maintains the session state.

Data transfer: Possible transfer to the United States, covered by the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework).

Supplier’s information: https://policies.google.com/privacy?hl=it

Source of purchases (WooCommerce)

Supplier: What are APS Clouds? First-party cookies managed by WooCommerce

Purpose: Track which website, campaign or social media platform each customer in your shop comes from, to measure the effectiveness of your marketing.

Name	Duration	Purpose
`sbjs_migrations, sbjs_current_add, sbjs_first_add, sbjs_current, sbjs_first, sbjs_udata`	a few seconds	Source of the visit: search engine, organic traffic, landing page.
`sbjs_session`	30 minutes	Number of page views during the session.

Data transfer: No data is transferred to third parties: the data remains on the website and is linked solely to orders placed via the online shop.

Marketing

They are used to show you adverts tailored to your interests, to send you relevant communications and to measure their effectiveness, including on other websites and social media platforms.

Legal basis: Consent (Article 6(1)(a) of the GDPR and Article 122 of the Privacy Code).

Google Ads

Supplier: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Purpose: Conversion tracking and personalised advertising (remarketing) for Google Ads campaigns linked to Google Analytics.

Name	Duration	Purpose
`_gcl_au`	3 months	Link ad clicks to conversions.
`IDE, test_cookie (domain: doubleclick.net)`	up to 13 months	Targeted advertising and conversion tracking.

Data transfer: Possible transfer to the United States, covered by the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework).

Supplier’s information: https://policies.google.com/privacy?hl=it

Meta Pixel

Supplier: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland

Purpose: Measuring Facebook and Instagram campaigns and personalised advertising.

Name	Duration	Purpose
`_fbp`	3 months	Identify the browser for Meta’s adverts.
`_fbc`	3 months	It stores the identifier for a click on a Meta advert.
`cf_fbclid (localStorage)`	7 days	Store the identifier for a click on a Meta advert to link it to the purchase of tickets on Ticketmaster.
`fr (facebook.com domain)`	3 months	Targeted advertising and measurement.

Data transfer: Possible transfer to the United States, covered by the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework).

Supplier’s information: https://www.facebook.com/privacy/policy/

Brevo

Supplier: Sendinblue SAS (Brevo), 106 Boulevard Haussmann, 75008 Paris, France

Purpose: Link website visits to newsletter subscribers to send them relevant communications and measure their effectiveness.

Name	Duration	Purpose
`sib_cuid`	6 months	Visitor ID for Brevo tracking.

Data transfer: Data processed within the European Union, in accordance with the supplier’s privacy policy.

Supplier’s information: https://www.brevo.com/it/legal/privacypolicy/

5. How to manage and withdraw consent

On first access A banner will appear: you can accept all cookies, reject them, or choose by category and by individual service using «Customise». By closing the banner using the X, you will continue browsing using technical cookies only.
At any time You can change or withdraw your preferences using the «Cookie Preferences» button, which is always located at the bottom left of every page, or using the button below. Withdrawal applies from now onwards: first-party cookies from the services you have opted out of will be deleted from your browser and the page will reload.
Duration of the choice: We will remember your choice for 6 months, after which we will ask you again. We will only ask you again sooner if there are significant changes to the services or purposes set out on this page, or if you clear your browser’s cookies.

Your consent status is displayed here when JavaScript is enabled in your browser.

6. Consent register and anonymous statistics

In order to provide evidence of the choices made, as required by Article 7(1) of the GDPR, for each choice we record: a random consent identifier, which is also stored in a cookie cfc_consent; date and time; version of this policy; categories and services accepted or rejected; presence of the GPC signal; page on which the choice was made; anonymised IP address, with the last part set to zero; browser type.

We do not use this data to identify you or to profile you. It is accessible only to the website administrators and is automatically deleted after 24 months. Legal basis: compliance with the obligation to demonstrate consent (Article 6(1)(c) and Article 7(1) of the GDPR).

We also count, in aggregate form only and without any identifying information, how many visits the website receives and how many times the banner is displayed, in order to check that the consent management system is working correctly. To avoid counting the same visit twice, we use a flag in the browser’s sessionStorage, which is deleted when the tab is closed.

7. Managing cookies via your browser

As well as via the preferences panel, you can block or delete cookies via your browser settings. If you also block technical cookies, some features of the website, such as the shopping basket and the checkout, may not work, and the banner will reappear every time you visit.

8. Your rights

You may exercise the rights set out in Articles 15 to 22 of the GDPR at any time: access, rectification, erasure, restriction, data portability and objection. You may withdraw your consent at any time, without this affecting the lawfulness of processing based on consent given prior to withdrawal (Article 7(3) of the GDPR). To exercise your rights, please write to scrivi@colorfest.it. You also have the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).

For other processing of personal data, such as purchases in the shop, entries to competitions and enquiries submitted via forms, please see the privacy policy.