COOKIE POLICY

This Cookie Policy forms an integral part of the Privacy Policy of www.midi-makers.com. It is issued pursuant to Art. 13 of EU Regulation 2016/679 (GDPR) and Art. 122 of Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and in accordance with the Guidelines on Cookies and Other Tracking Tools issued by the Italian Data Protection Authority (Garante) on 10 June 2021. It explains what cookies are, which ones this Site uses, the legal basis for each, and how you can manage or withdraw your preferences at any time. This Policy applies to the Site in its current form — an informational landing page for the myMIDI platform, currently in Beta. The Site includes a Beta Program sign-up form through which name, email address and an optional message are collected; the processing of that data is governed by the Privacy Policy, to which this Cookie Policy refers. The Site does not at this stage process purchases, payments, or user accounts. When the full platform goes live, this Policy will be updated and waitlist members will be notified in advance.

1. What are cookies?

   Cookies are small text files placed on your device when you visit a website. They allow the site to recognise your device on return visits, retain certain settings, and collect information about how you interact with its pages. Cookies do not execute programs or carry viruses. They can be first-party, when set directly by the website you are visiting, or third-party, when set by external domains such as analytics or social media providers. Depending on their nature and purpose, some cookies are essential for the site to function; others require your prior, freely given, specific, informed, and unambiguous consent before being placed on your device, as required by Art. 7 GDPR and Art. 122 of the Italian Privacy Code.
2. Data Controller
   Pursuant to Art. 13(1)(a) GDPR, the Data Controller for all personal data processed through the cookies used on this Site is MIDI-MAKERS S.R.L., with registered office at Via Tiengo 15, 82100 Benevento (BN), Italy, VAT number IT01874190620. For any question about the processing of your data or to exercise your rights, you can contact us at amministrazione@midi-makers.com. No Data Protection Officer has been appointed; the conditions making such appointment mandatory under Art. 37 GDPR are not currently met, as the controller does not carry out large- scale systematic processing of special categories of data nor large-scale systematic monitoring of individuals. This assessment has been documented internally in accordance with the accountability principle under Art. 5(2) GDPR. Should a DPO be designated in the future, their contact details will be published here without delay, as required by Art. 13(1)(b) GDPR.
3. Cookies Used on This Site
   This section covers only cookies and similar technologies placed on your device. It is distinct from the server-level browsing data (IP address, access timestamps, etc.) described in the Privacy Policy, which is collected independently of any cookie and governed by that document. The retention periods stated below apply exclusively to cookies.
   ‍
   Strictly necessary cookies. Strictly necessary cookies are indispensable to the basic operation of the Site. They enable core functions such as page navigation and security. Because they are technically essential, they are placed automatically on your device and do not require your consent pursuant to Art. 122(1) of the Italian Privacy Code, which exempts from the consent requirement those cookies whose sole purpose is to carry out a transmission over an  electronic communications network, or that are strictly necessary to provide an information society service explicitly requested by the user. On this Site, this category includes session cookies, which maintain the continuity of your browsing session and are deleted automatically when you close your browser, and preference cookies, which store basic display settings such as your chosen language and remain active for up to 12 months. The legal basis for this processing is technical necessity pursuant to Art. 122(1) of the Italian Privacy Code and Art. 6(1)(f) GDPR (legitimate interest of the controller in ensuring basic site functionality). Art. 6(1)(b) GDPR will additionally apply once a contractual relationship with users is established upon launch of the full platform.
   
   Google Analytics 4 — third-party analytics cookies. This Site uses Google Analytics 4 (GA4), a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC acts as a Data Processor appointed by MIDI-MAKERS S.R.L. pursuant to Art. 28 GDPR under a Data Processing Agreement formally accepted by the controller via the Google Analytics Admin Console. GA4 collects information about how users interact with the Site — including pages visited, session duration, and navigation patterns — and provides this data in aggregate form to support improvements to the Site's performance and content. GA4 applies data minimisation at the point of collection and does not log full IP addresses. The cookies placed by GA4 include _ga, which assigns a unique identifier to distinguish users and persists for up to 2 months; _gid, which serves a similar purpose over a shorter window of 24 hours; and _ga_gt, used to maintain session state and persisting for up to 2 months. These retention periods reflect the configuration set by the controller in the GA4 data retention settings, consistent with the data minimisation principle under Art. 5(1)(e) GDPR and the informational-only nature of the Site in its current phase.
   These cookies are transferred to Google LLC servers located in the United States. Pursuant to Art. 13(1)(f) GDPR, this transfer is carried out on the basis of the adequacy decision adopted by the European Commission on 10 July 2023 under the EU–US Data Privacy Framework (Decision 2023/1795/EU), which establishes that the United States ensures an adequate level of protection for personal data transferred from the EU to certified US organisations. Google LLC is certified under this framework. Where the EU–US Data Privacy Framework is not applicable or ceases to be in force, transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission via Decision 2021/914/EU, supplemented where necessary by additional technical safeguards in accordance with EDPB Recommendations 01/2020. The legal basis for placing these cookies is your consent pursuant to Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code, collected via the cookie banner before any GA4 cookie is set. Consent is specific to this processing activity and is freely revocable at any time, without prejudice to the lawfulness of any processing carried out before withdrawal, as provided by Art. 7(3) GDPR. You can also opt out of GA4 tracking across all websites by installing the browser add-on available at tools.google.com/dlpage/gaoptout.
   
   Social sharing buttons — Facebook and Instagram. The buttons linking to Facebook and Instagram present on this Site are implemented as plain hyperlinks. No script, pixel, or embed from Meta Platforms, Inc. is loaded when the page opens. No data is therefore transmitted to Meta's servers as a result of visiting the Site. Any transfer of data to Meta occurs only if you actively click one of those links and navigate to the respective platform, at which point Meta's own terms and privacy policy exclusively govern the interaction. Should we ever integrate Meta Pixel or any social plugin that loads automatically on page load, this Policy will be updated before any such integration is deployed and your prior consent will be requested in accordance with Art. 7 GDPR and Art. 122 of the Italian Privacy Code.
   
   Cookies we do not use. For the avoidance of doubt and in the interest of full transparency required by Art. 5(1)(a) GDPR: this Site does not currently use profiling cookies, retargeting cookies, advertising cookies, or any cookie whose purpose is to build a profile of your browsing behaviour in order to serve you personalised content or advertising. Should this change, this  Policy will be updated and your explicit consent will be requested before any such cookie is placed.
4. Managing Your Consent
   The Italian Data Protection Authority's Guidelines of 10 June 2021 — adopted in implementation of Art. 122 of the Italian Privacy Code, which transposes Directive 2002/58/EC (ePrivacy Directive) — require that all cookies other than technically necessary ones may only be placed after you have given your prior, free, specific, informed, and unambiguous consent, consistent with the requirements of Art. 7 GDPR. Pre-ticked boxes, silence, or continued browsing do not constitute valid consent, as confirmed by Recital 32 GDPR.
   
   When you first visit this Site, a cookie banner will allow you to accept all non-essential cookies, reject all non-essential cookies, or customise your preferences by category. In accordance with the Garante's Guidelines of 10 June 2021, the “Reject All” option is presented with the same visual prominence — identical size, colour and position — as the “Accept All” option, ensuring that refusal is as easy to exercise as consent. You can change or withdraw your choices at any time by clicking the “Manage Cookie Preferences” link available in the footer of every page. As provided by Art. 7(3) GDPR, withdrawing consent does not affect the lawfulness of any processing carried out on the basis of consent before withdrawal.
   
   You may also manage and delete cookies directly through your browser settings. In Google Chrome, go to Settings, then Privacy and security, then Cookies and other site data. In Mozilla Firefox, go to Settings, then Privacy and Security, then Cookies and Site Data. In Safari, go to Preferences, then Privacy, then Manage Website Data. In Microsoft Edge, go to Settings, then Cookies and site permissions. Please be aware that disabling strictly necessary cookies will affect the Site's core functionality.
5. Your Rights
   Pursuant to Arts. 15 to 22 GDPR, you have the following rights with respect to the personal data collected through the cookies used on this Site. You have the right under Art. 15 to obtain confirmation of whether personal data concerning you is being processed and, if so, to access that data and the information listed in that article. You have the right under Art. 16 to obtain rectification of any inaccurate personal data concerning you without undue delay. You have the right under Art. 17 to obtain erasure of your personal data without undue delay where one of the grounds specified in that article applies, including where you withdraw consent and there is no other legal basis for the processing. You have the right under Art. 18 to obtain restriction of processing in the circumstances specified in that article. You have the right under Art. 20 to receive personal data concerning you in a structured, commonly used, and machine-readable format and to transmit it to another controller, where the processing is based on consent and is carried out by automated means. You have the right under Art. 21 to object at any time to the processing of personal data concerning you where that processing is based on Art. 6(1)(f) GDPR; upon such objection, the controller shall no longer process the data unless it demonstrates compelling legitimate grounds that override your interests, rights, and freedoms. Where processing is based on your consent, you have the right under Art. 7(3) GDPR to withdraw that consent at any time.
   To exercise any of these rights, write to us at amministrazione@midi-makers.com. Pursuant to Art. 12(3) GDPR, we will respond without undue delay and in any event within one month of receiving your request. Where requests are complex or numerous, this period may be extended by a further two months; we will inform you of any extension within the first month, explaining the reasons for the delay. All communications and actions taken in response to your rights requests are provided free of charge under Art. 12(5) GDPR.
6. Right to Lodge a Complaint
   Pursuant to Art. 13(2)(d) GDPR, you have the right to lodge a complaint with the competent supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR. In Italy, the competent authority is the Garante per la Protezione dei Dati Personali, reachable at www.garanteprivacy.it, garante@gpdp.it, and garante@pec.gpdp.it, with offices at Piazza Venezia 11, 00187 Roma, Italy. This right is without prejudice to any other administrative or judicial remedy available to you under EU or national law, including the right to bring proceedings before a court pursuant to Art. 79 GDPR.
7. Updates to This Policy
   We may update this Cookie Policy at any time to reflect changes in the cookies we use, applicable law, or our operations. When we do, we will revise the date at the top of this page. For material changes, we will notify waitlist members by email at least 14 days before the changes take effect, consistent with our Privacy Policy. We encourage you to review this page periodically. Continued use of the Site after the effective date of any update constitutes acknowledgement of the revised policy.