Identity of the data controller.

Categories of data collected — account data, payment data, organizer documents (possibly ID/business docs), staff member data. etc.

Purposes & legal basis (contract performance, legal obligation, legitimate interest, consent).

No sale of personal data to third parties — explicit statement, plus clarify if you share data with processors (payment gateway, hosting, email service) since that's technically different from "selling."

Data retention periods.

Data subject rights under GDPR (access, rectification, erasure, portability, objection, complaint to Garante Privacy).

International transfers (if hosting/payment provider is outside EU).

Security measures.

Contact details / DPO if required.

Codice del Consumo (Legislative Decree 206/2005) — Italian consumer protection law, governs your relationship with customers.

GDPR + Codice Privacy (Reg. EU 2016/679 + D.Lgs. 196/2003 as amended) — data protection.

D.Lgs 70/2003 — Italian e-commerce regulations (info obligations for online service providers).

Garante per la Protezione dei Dati Personali guidelines specifically on cookies (2021 update).

Right of withdrawal exception — Art. 59, comma 1, lett. n) of the Codice del Consumo exempts "servizi relativi ad attività del tempo libero se il contratto prevede una data o un periodo di esecuzione specifici" (leisure services tied to a specific date) from the standard 14-day cooling-off withdrawal right. This means you're not legally required to offer refunds for tickets to events that go ahead as scheduled — which matches your rule. But this exemption doesn't override your own promised refund terms for postponed/cancelled events, since once you state a policy, it becomes contractually binding.

Jurisdiction for B2C disputes — under EU rules (Brussels I Regulation recast + Codice del Consumo Art. 33/66-bis), you generally cannot force an Italian consumer to waive their right to sue in their own place of residence. So your T&C should state Italian law applies, but note that mandatory consumer-protection rules of the customer's own EU country may still apply if you sell cross-border, and jurisdiction defaults to the consumer's domicile for B2C claims. Don't write an exclusive "Verona courts only" clause — it's unenforceable against consumers and could get flagged as an abusive clause (clausola vessatoria).