Privacy & Cookie Policy

Last updated: September 2026

Privacy Policy

Watermelon srl SB (hereinafter, "Watermelon") provides users of the Watermelon website (hereinafter, the "Site", accessible at watermelon.it, including the application and submission forms described on this page) with the following information, in compliance with Article 13 of Regulation (EU) 2016/679 (the "General Data Protection Regulation", hereinafter "G.D.P.R.") and subsequent national implementing legislation (hereinafter referred to, together with the G.D.P.R., as the "Applicable Privacy Regulation"). While browsing the Site, information relating to users is in fact collected, which constitutes personal data under the Applicable Privacy Regulation.

This notice is provided exclusively for the Site referred to above, and not for any other sites that may be reached via links present on it.

Data controller

The controller for the processing of personal data is Watermelon srl SB, with registered office at Via Damiani 47, 23017 Morbegno (SO), Italy; info@watermelon.it; +39 0342 1856126.

Types of data processed

The data processed by Watermelon when the user uses the Site are specified below. The user assumes responsibility for any personal data of third parties entered or published on the Site, and guarantees that they have the right to communicate or disseminate such data — thereby releasing Watermelon from any liability towards said third parties.

Personal data automatically acquired when visiting the Site

Browsing data. Watermelon automatically collects data about the device (PC, tablet, mobile phone or other mobile device) and connection used by the user, including, for example, the IP address, the date and time of access, information on hardware and software, information on events concerning the device, unique identifiers, crash data, and the pages viewed by the user before or after using the Site.
Site usage data. Watermelon collects information on how the user has used the Site, including, for example, the pages of the Site or other content viewed, and searches performed.

Personal data provided directly by the user

Email address verification. To fill in one of the forms described below, the user must first verify ownership of their email address by entering a 6-digit code received by email. This step collects the user's email address and is necessary to prevent fraudulent submissions or submissions made in the name of third parties.
Casting application. If the user submits an application via the "Casting" form, Watermelon collects: first name, last name, gender, date of birth, phone number, full address (street, city, province, postal code, country), role(s) of interest, licenses and skills, hair and eye colour, physical data (weight, height, shoe size, clothing size), languages spoken, prior experience in the fashion/entertainment/film/TV industry, photographs, an optional self-tape video, links to a showreel, personal website and social profiles (LinkedIn, Facebook, Instagram), as well as any further personal data freely entered in the text field. This data is necessary to evaluate the application; if the user does not wish to provide it, they will not be able to submit the application.
Recruitment application ("Work with us"). If the user submits an application via the "Work with us" form, Watermelon collects: first name, last name, gender, date of birth, phone number, full address (street, city, province, postal code, country), skills, languages spoken, curriculum vitae/portfolio (including any personal data of the applicant and/or third parties contained therein), personal website and social profiles (LinkedIn, Vimeo, Behance, Facebook, Instagram), as well as any further personal data freely entered in the text field. This data is necessary to evaluate the application; if the user does not wish to provide it, they will not be able to submit the application.
Location submission. If the user submits a location via the relevant form, Watermelon collects: title and description of the place, type/style/territory/services, address and, where indicated or detected, the geographic position (GPS coordinates entered manually on the map or read automatically from the EXIF tag of the uploaded photographs, if present), photographs of the place, name of the organisation/company, and the first name, last name, phone number and email of the contact person. This data is necessary to evaluate the submission; if the user does not wish to provide it, they will not be able to submit it.
Optional data. Requests for information by email. If the user, in order to request information, explicitly and voluntarily sends an email to the Watermelon addresses indicated on the Site, Watermelon acquires the email address and any personal data of the user (and/or third parties) included in the text of the electronic communication.

Personal data collected through cookies

Watermelon uses cookies to collect data about your browsing. For further information on the use of cookies, the user may consult the Site's cookie policy (at the bottom of this page).

Purposes of processing

To contribute to the functioning of the Site; to provide the user with the services that Watermelon offers through the Site; to protect the vital interests of the user; to comply with applicable regulations or to pursue other public-interest needs. The user's data is in fact processed:

to operate, measure, improve and keep secure the Site and the services provided through it;
to prevent and detect security breaches and potentially prohibited or illegal activities.

To pursue Watermelon's legitimate interests in a manner such that these interests do not override the user's fundamental rights and freedoms. The user's data is in fact processed:

to identify and resolve issues encountered by the user while using the Site (for example, blocked or malfunctioning pages).

These processing activities protect Watermelon's interest in keeping the Site functioning and efficient. They also do not infringe upon the user's fundamental rights and freedoms, as they are predictable processing activities common to every website. Furthermore, such processing also benefits the user, by allowing the Site to continue functioning.

Processing methods

The user's personal data is processed using IT or telematic tools, exclusively for the purposes for which it was collected (see above), and stored for a specific period according to the criteria set out in this privacy policy (see below). Personal data may be accessed and processed by Watermelon staff, duly instructed on the precautions to be taken as required by the Applicable Privacy Regulation.

Data retention period

The specific retention periods for the user's personal data are documented in Watermelon's record of processing activities (implemented pursuant to Article 30 of the G.D.P.R.).

The user's personal data is retained (according to the criteria set out in recital 39 and Article 5(1)(e) of the G.D.P.R.) for a period necessary to ensure that the Site functions, and that Watermelon provides users with the services offered through the Site. In any case, this period may not exceed 10 years from collection.

The user's personal data may be retained for longer periods than those just described only if this is necessary for Watermelon to comply with legal obligations incumbent upon it, or to protect a right in legal proceedings.

Upon expiry of these retention periods, the user's data is deleted, or permanently anonymised.

Data disclosure

Watermelon may disclose the personal data it processes only to the parties and for the purposes indicated below.

Technical service providers (data processors)

For the operation of the application and submission forms described on this page, Watermelon relies on the following third-party providers, which process the user's personal data on behalf of Watermelon and within the limits of the purposes indicated above:

Supabase (Supabase Inc.) — hosts the database where data submitted via the forms is stored, and manages email address verification (sending and checking the 6-digit code).
Google (Google LLC) — provides automatic address suggestions while filling in the forms, and the satellite map in the Location form. As the user types in the address field, the text entered and their IP address are communicated to Google, which returns matching addresses; the satellite map is loaded solely for submissions concerning outdoor locations. The Google APIs used here set no cookies and store no data in the user's browser: this was verified on the Site, both on page load and while typing. Google Maps is also used in the restricted area of the internal application, accessible only to Watermelon staff after signing in.
Cloudinary (Cloudinary Ltd.) — receives and processes the optional self-tape video uploaded in the Casting form, in order to compress it into a lighter format.
Resend (Resend, Inc.) — sends the email messages generated by the Site, including the verification code and Watermelon's internal notifications of a received application or submission.

Combating unlawful acts and security breaches

Watermelon may disclose users' personal data to third parties that work to prevent, detect and mitigate potentially unlawful acts and security breaches.

Law enforcement, legal proceedings and methods authorised by law

Watermelon may disclose users' personal data to Judicial Authorities, Public Authorities or authorised third parties, in cases provided for by law. As well as, more generally, in cases where this is necessary to comply with legal obligations or verified requests relating to a criminal investigation or alleged unlawful activity, or to respond to claims by others concerning the rights, property or safety of Watermelon, its employees or its users.

Rights of data subjects

Only in the cases and within all the limits provided for by Articles 15-22 of the G.D.P.R., the user has the right, at any time, free of charge and without particular burdens or formalities, to:

obtain confirmation of whether Watermelon is processing their personal data;
access their personal data, and learn of its origin, the purposes and aims of the processing, the retention period, and information regarding the third parties to whom the personal data is disclosed;
withdraw their consent at any time, where this constitutes the basis for the processing;
update or rectify their personal data collected by Watermelon, so that it remains accurate at all times;
exercise the so-called right to be forgotten, i.e. to have their personal data collected by Watermelon erased from Watermelon's databases and/or archives, including backups;
restrict the processing of their personal data by Watermelon;
object to the processing, for personal data processed to pursue public-interest needs or Watermelon's legitimate interests;
be informed, within a reasonable time, of any rectifications, erasures or restrictions of processing carried out by Watermelon, as well as of any withdrawal of such measures and the reasons behind such withdrawals.

The user may exercise these rights by written request addressed to Watermelon without any particular formality, by sending an email to info@watermelon.it

Once the above email has been received, Watermelon will fulfil the request within one month of receipt. This period may be extended by two months, upon prior notice to the user, taking into account the complexity and number of requests.

Watermelon reminds the user that, where the response to their requests is not, in their opinion, satisfactory, they may contact and lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) in the manner provided for by the Applicable Privacy Regulation.

Changes to the privacy policy

Watermelon reserves the right to make changes to this privacy policy at any time, giving notice to users on this page of the Site.

Users are therefore asked to consult this page often, referring to the last-updated date indicated at the top. Unless otherwise specified, in the event of a change, the previous privacy policy will continue to apply to personal data collected up to that point.

The Watermelon srl SB website (hereinafter, respectively, the "Site" and "Watermelon"), accessible at watermelon.it, uses certain cookies with respect to users. With this policy, Watermelon informs the user about the cookies installed by the Site alone, their characteristics, and how they are managed. For cookies installed by any other websites reachable through the Site, users are invited to consult the relevant cookie policies.

What cookies are

Cookies are small text files (generally made up of letters and numbers) that are saved on the device used by the user (computer, tablet, mobile phone or other mobile device) and read every time the user accesses the Site. Cookies make it technically possible to record, for a certain period of time (variable depending on duration of use), information useful for ensuring that the Site is easy to use and effective, as well as for understanding how the user uses the Site and what preferences they have shown.

There are several types of cookies:

A. Based on how long they are used:

session cookies, which are automatically removed at the end of the browser session; and
persistent cookies, which instead remain stored on the user's device even after the browser session ends.

B. Based on who installs them on the user's device:

first-party (or proprietary) cookies, installed by the website the user is visiting; and
third-party cookies, installed by a website other than the one the user is visiting.

Necessary cookies

The Site makes use of necessary cookies (see below for the relevant definitions). Necessary cookies are used to allow the user to access and browse the Site, and therefore do not require the user's consent.

Social buttons

The Site uses various links that allow users to visit Watermelon's LinkedIn, Facebook, Instagram and Vimeo profiles (see the Site's footer). These links — which appear as icons of the relevant social networks — do not involve the installation of third-party cookies.

Embedded videos

Some pages of the corporate site host videos played through the Vimeo player (Vimeo.com, Inc.). The player is configured in Do Not Track mode: it installs no cookies, stores no data in the user's browser and sends no viewing statistics to Vimeo. For playback alone, the user's IP address is communicated to the servers delivering the file.

The "Projects" page lists Watermelon's public work on Vimeo. The list is requested by Watermelon's own server, not by the user's browser: no user data reaches Vimeo for this operation. The video preview images, however, are loaded by the browser directly from Vimeo's delivery network (i.vimeocdn.com), which receives the user's IP address in order to deliver them. Verified on the site: these images install no cookies and store no data in the browser. The video player on that page is not loaded when the page opens: it starts only when the user chooses to watch a video, and even then in Do Not Track mode.

Typefaces

The typefaces used by the Site are hosted directly on Watermelon's own servers. The Site makes no calls to external font distribution services.

Form protection (Cloudflare Turnstile)

To protect the Site's forms from automated submissions we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. that verifies that a request comes from a person without asking to solve a puzzle and without tracking for advertising purposes. The processing is described in Cloudflare's Turnstile Privacy Addendum.

Cookies and browser options

Users are informed that, by changing the settings of the browser used, they always have the option to delete cookies already installed and to refuse new ones. The procedures for changing these settings differ for each type of browser and operating system used.

Users can find further information on the main cookies used on the internet (statistical and marketing cookies) and how to uninstall them by consulting the Network Advertising Initiative opt-out page, the Digital Advertising Alliance opt-out page, or the website youronlinechoices.eu.

Cookies used by the Site

When the user visits the Site, the Site itself and third-party websites install certain cookies on the device used by the user, or save data through equivalent technologies (such as the browser's local storage). This data, whether session-based or persistent, makes a website usable, enabling, for example, navigation between pages or access to restricted areas. No website could function properly without them. Below are the main cookies and equivalent technologies installed when visiting the Site:

Name	Provider	Purpose	Duration	Type
sb-<project>-auth-token	Supabase	Keeps the user's session active after email address verification, so a new code is not required on every visit	Until logout or session expiry	Local storage (not a cookie in the strict sense)
equipment_owner_key	Watermelon (watermelon.it)	Remembers which equipment record belongs to this device, so it does not have to be identified on every visit	Until browser data is cleared	Local storage (not a cookie in the strict sense)