#jrt{–gold:#8C7145;–ink:#0A0A0A;–head:#272727;–text:#585858;–line:#E3E3E3;
font-family:Sora,-apple-system,”system-ui”,”Segoe UI”,Roboto,Oxygen-Sans,Ubuntu,Cantarell,”Helvetica Neue”,sans-serif;font-size:14px;line-height:20px;color:var(–text);background:#fff;-webkit-font-smoothing:antialiased;max-width:940px;margin:0 auto;padding:60px 20px 80px;box-sizing:border-box}
#jrt *{box-sizing:border-box}
#jrt .jrt-head{text-align:center;margin-bottom:48px}
#jrt .jrt-head h1{font-family:inherit;font-size:40px;line-height:1.1;font-weight:400;text-transform:uppercase;color:var(–head);margin:0 0 14px;letter-spacing:0}
#jrt .jrt-head .jrt-co{font-size:13px;line-height:22px;color:var(–gold);margin:0;text-transform:uppercase}
#jrt .jrt-head .jrt-sub{font-size:13px;line-height:22px;color:var(–head);margin:4px 0 0}
#jrt .jrt-head .jrt-ver{font-size:12px;line-height:20px;color:#8A8A8A;margin:10px 0 0}
#jrt .jrt-q{border-top:1px solid var(–line)}
#jrt .jrt-q:last-of-type{border-bottom:1px solid var(–line)}
#jrt summary{list-style:none;cursor:pointer;position:relative;padding:14px 14px 14px 50px;font-size:19px;line-height:23px;font-weight:300;color:var(–gold)}
#jrt summary::-webkit-details-marker{display:none}
#jrt .jrt-ico{position:absolute;left:18px;top:50%;width:14px;height:14px;margin-top:-7px}
#jrt .jrt-ico::before,#jrt .jrt-ico::after{content:””;position:absolute;left:0;top:6px;width:14px;height:1.5px;background:var(–gold);transition:transform .25s}
#jrt .jrt-ico::after{transform:rotate(90deg)}
#jrt details[open] .jrt-ico::after{transform:rotate(0)}
#jrt summary:focus-visible{outline:1px solid var(–gold);outline-offset:-1px}
#jrt .jrt-a{padding:20px 20px 10px 50px}
#jrt .jrt-art{scroll-margin-top:120px}
#jrt h4{font-family:inherit;font-size:18px;line-height:30px;font-weight:400;color:var(–head);margin:10px 0 15px}
#jrt .jrt-art:first-child h4{margin-top:0}
#jrt p{margin:0 0 15px;color:var(–text)}
#jrt ul,#jrt ol{margin:0 0 15px;padding-left:20px}
#jrt li{margin:0 0 10px}
#jrt strong{font-weight:600;color:var(–head)}
#jrt a{color:var(–gold);text-decoration:underline}
@media (max-width:767px){#jrt{padding:40px 16px 60px}#jrt .jrt-head h1{font-size:28px}#jrt summary{font-size:17px;padding-left:44px}#jrt .jrt-ico{left:14px}#jrt .jrt-a{padding:16px 4px 6px 16px}}

Terms and conditions

Affreschi & Affreschi S.r.l. · J.Rose

Terms and conditions of the “Message in a JR Bottle” service

Version 1.1 — 21 July 2026 · Effective from publication of the Service

The Service and definitions

Art. 1 — Service provider and contacts

The digital service “Message in a JR Bottle” (the Service) is sold and provided by Affreschi & Affreschi S.r.l., registered office at Zona P.I.P., Lotto 9 – 73027 Minervino di Lecce (LE), Italy, VAT no. and tax code IT04779110750, REA LE-317690, share capital euro 10,000.00, PEC affreschisrls@pec.it, website www.jrose.it.

J.Rose is a trademark licensed to and managed by Affreschi & Affreschi S.r.l. Any reference to J.Rose therefore means Affreschi & Affreschi S.r.l.

Contacts: support and single point of contact for recipients of the Service under Regulation (EU) 2022/2065 (DSA) info@jrose.it; privacy privacy@jrose.it; PEC affreschisrls@pec.it. Communications may be sent in Italian or English.

J.Rose is responsible to the Creator for performance of the contract and for the mandatory protections that apply, even when it uses technical suppliers. The suppliers named in these Terms do not thereby become parties to the contract between J.Rose and the Creator.

Art. 2 — Definitions and architecture of the Service

For the purposes of these Terms:

  • Enabled Bottle: a J.Rose bottle fitted with an NFC Tag validly associated with the Service.
  • NFC Tag: an electronic component that allows the technical verification to start and, if valid, allows the Digital Page to be reached.
  • Tag ID: the unique identifier associated with the NFC Tag.
  • Creator: an adult individual or legal entity that purchases and activates the Service, uploads the Content and associates their email address with the Service.
  • Professional Creator: a Creator acting in the course of a business, commercial, craft or professional activity.
  • Consumer: an individual acting for purposes outside their business, commercial, craft or professional activity.
  • Recipient: the person to whom the Creator intends to give or dedicate the Bottle and the Content.
  • Visitor: a person who, after a valid scan and, where required, entering the Password, accesses the Digital Page.
  • Content: a text message, a video lasting no more than one minute, or both, associated with the Enabled Bottle.
  • J.Rose Platform: the website, landing pages and interfaces managed on behalf of J.Rose for the purchase, upload, publication, viewing and management of the Service.
  • Digital Page: a private page of the J.Rose Platform, hosted on the technical infrastructure used for the Service, on which the Content is displayed.
  • TagLink: the platform of Sinfotech.it S.r.l. (“Sinfotech”) that is reached first when the NFC Tag is scanned; it verifies the technical authenticity of the Tag and redirects to the J.Rose Platform.
  • Publication: the final confirmation by which the Creator makes the Content accessible through the Digital Page.
  • Open Access: access to the Digital Page after a valid scan, without a Password.
  • Protected Access: access to the Digital Page after a valid scan and entry of the Password.
  • Password: a secret of at least eight characters chosen by the Creator to restrict access.
  • OTP: a temporary single-use code sent to the Creator’s verified email address to authorise management operations.
  • Developer: 650MB.COM S.r.l.s., the technical supplier commissioned by J.Rose for the development, maintenance, support, application management, database and video processing.
  • Serverplan: the provider of the hosting and backup infrastructure used by the Developer; it does not sell the Service to the Creator and does not manage the contractual relationship with the Creator.
  • Sinfotech: Sinfotech.it S.r.l., owner and operator of the TagLink platform and of the Tag verification technology.

The technical path involves two distinct environments: the scan first opens a TagLink page managed by Sinfotech; after verification, TagLink automatically redirects to the J.Rose Digital Page. The J.Rose Platform is managed on behalf of J.Rose by the Developer and uses Serverplan infrastructure registered to the Developer. This technical allocation does not limit the rights the Creator may exercise against J.Rose in relation to the contract for the purchase of the Service.

Art. 3 — Subject matter, independence and conclusion of the contract

The Service allows the Creator to associate a single item of Content with an Enabled Bottle and make it accessible through the NFC Tag. It does not include professional editing, archival storage, restoration, legal advice on content, permanent accounts or the ability to replace the Content after Publication.

The Service is independent of the sale of the Bottle, of memberships, digital cards, digital passports, blockchain, promotional programmes and other J.Rose initiatives. It does not certify ownership, possession, civil-law provenance or transfer of the Bottle.

The electronic procedure consists of: identification of the Tag; entry and verification of the email; upload; choice of access mode; preview; review of the documents; correction of any errors; confirmation via the button “Publish and pay € [amount]” or equivalent wording; payment authorisation; order confirmation and Publication. Before the final command the Creator may correct the data and replace the uploaded files. The contract is concluded when J.Rose confirms the order after payment authorisation.

J.Rose sends without undue delay, on a durable medium, confirmation of the contract, the price, the transaction identifier, the version of the Terms accepted, the Privacy Notice and the withdrawal form. Proof of the order and of the acceptances is stored for the period stated in the Privacy Notice and may be requested at info@jrose.it. No codes of conduct apply other than those, if any, indicated on the Platform.

The contract is offered in Italian and, when made available, in English. The Italian version is the original text; any English version is intended to aid understanding and does not limit the mandatory protections granted to the Consumer by the applicable law.

Art. 4 — Requirements, minors and Enabled Bottles

The Service may be purchased and activated only by persons who have reached the age of eighteen and have the capacity to enter into the contract. Where the Creator is an organisation or a business, the operation must be carried out by an adult with the necessary powers.

The Service can be used only with an Enabled Bottle and with a Tag ID recognised by TagLink and by the J.Rose Platform. The presence of the J.Rose brand does not, on its own, imply that the Bottle is enabled. An Internet connection, a device compatible with NFC or with the corresponding digital link, and an up-to-date browser are required.

Each Enabled Bottle can hold only one experience. If a payment is made despite the technical impossibility of associating the Service with a valid Tag, J.Rose cancels the transaction or refunds the amount in full.

For a Bottle purchased from retailers or channels other than jrose.it, activation requires physical possession of the Tag. For a Bottle purchased on jrose.it and intended for the buyer, activation may be carried out after delivery. If the order names a different recipient, J.Rose may communicate the associated Tag ID to the buyer, allowing activation before delivery. Such communication is technical in nature and is not proof of ownership or possession of the Bottle.

Purchase, activation and publication

Art. 5 — Price, order, payment and invoicing

The total price, including applicable taxes, is shown before the order. It pays for the guaranteed minimum period of one year provided for in Article 17. Any free continuation afterwards is not guaranteed indefinitely. The price is identical for Open Access and Protected Access and includes changes to the Password and to the access mode.

Only the payment methods shown on the Platform are available, which may include Stripe, PayPal, Nexi/virtual POS, Apple Pay, Google Pay and Revolut. Payment providers may apply their own conditions and process data for their own purposes, including fraud prevention and legal compliance. J.Rose does not store full card details.

If payment is authorised but Publication does not complete, J.Rose completes the activation at no cost when the Content is still intact and can be safely associated; otherwise it refunds in full. No second payment is due for the same uncompleted operation.

An invoice may be requested during the order by entering the tax details in the fields provided. Mandatory rules on tax documentation remain unaffected.

Art. 6 — Email, OTP and management without an account

The Creator provides an email address and the Tag ID. The email is verified by OTP and becomes the technical contact associated with the Service. No permanent account is created.

To use the management functions the Creator enters the email and the Tag ID and passes OTP verification. The OTP is short-lived and single-use, and the number of attempts is limited. The Creator must protect the mailbox and the devices used to access it and promptly inform J.Rose of any compromise or unrecognised operations.

The Creator may ask for the email to be replaced through support. To prevent fraud, J.Rose may request reasonable proof of purchase, activation, availability of the Bottle or the requester’s authority. No identity document is required if the check can be carried out with less invasive measures.

For organisations and businesses, the operations of the authorised user bind the entity represented. The Professional Creator must promptly update contact details and revoke internal access that is no longer authorised.

Art. 7 — Included Content and technical limits

The Service includes:

  • a text message within the character limit shown on the Platform;
  • a video lasting no more than one minute, in the formats and size limits indicated;
  • the association of the Content with an Enabled Bottle;
  • viewing with Open or Protected Access;
  • the management, download and deletion functions provided for by the Terms.

The Content may be text only, video only or both. Not included are standalone photographs, separate audio, attachments, additional messages, editing, correction, translation, professional storage or restoration.

To make the file technically usable, J.Rose and the Developer may perform compression, transcoding, preview generation, format adaptation and security checks. These operations do not constitute editorial modification. The Creator must keep their own original copy: the Service does not save or recover drafts.

Art. 8 — Upload, preview and publication

Upload, preview, payment and Publication take place in the same session. Before confirmation the Creator may correct or replace the text and the video, checking their content, orientation, audio, the people depicted and the access mode.

If the session ends before payment, the Content cannot be recovered and must be uploaded again. Transient copies are rendered unusable and automatically deleted within twenty-four hours, except for the time strictly necessary to handle an anomaly or a security event.

Publication requires a separate, explicit confirmation:

PUBLICATION CONFIRMATION — I confirm that I wish to publish definitively the Content associated with the Bottle. I understand that, after Publication, I will not be able to edit, correct or replace it using the normal functions of the Service; I will be able to keep it, download it or delete it in full, without prejudice to the requests and interventions necessary to comply with the law and the rights of the persons concerned.

The date and time of Publication determine the start of the guaranteed minimum period.

Art. 9 — Open access or Password-protected access

The Creator chooses, with no preselected options, between:

  • Open Access: anyone who has the Bottle and performs a valid scan can view the Content;
  • Protected Access: in addition to a valid scan, a Password of at least eight characters is required.

The Password does not identify the Visitor. It is stored exclusively as a modern, salted, irreversible hash. The Creator must not reuse credentials used for other services. The Password may be shared with third parties and does not prevent anyone who has the Bottle and knows it from accessing the Content.

By OTP, the Creator may reset the Password or switch from one mode to the other, without changing the Content or starting a new minimum period. Protected Access is not end-to-end encryption: authorised personnel of J.Rose and of the Developer may access the Content when strictly necessary for support, security, moderation, the exercise of rights or legal obligations.

Access, management and content

Art. 10 — Scanning, TagLink, product data and nature of access

The scan first opens a Sinfotech TagLink page, which shows the verification of the digital certificate and technical identifiers of the Tag and then automatically redirects to the J.Rose Digital Page. TagLink may process technical request data in accordance with its own terms, privacy notice and cookie policy, available respectively at TagLink Terms, Sinfotech/TagLink Privacy Notice and TagLink Cookie Policy. J.Rose does not control the cookies, logs or retention periods applied by Sinfotech on its own page.

For each scan, the verification may generate or use the Tag ID, a dynamic authentication token, date and time, verification outcome, IP address, network data, browser, device/operating system, approximate country or area and NFC channel. Sinfotech holds the individual technical data within the limits of its own service; J.Rose normally receives only aggregate dashboard statistics: number of scans, approximate geographic area, device type and time band. It does not ordinarily receive IP addresses or individual histories and does not use such aggregates for commercial profiling of the Visitor.

For transparency and support purposes, the technical data relating to the Service that is immediately available to J.Rose may be requested at info@jrose.it in a commonly used format, within the limits of trade secrets, security and the rights of others. For individual data held exclusively by Sinfotech, the request must be addressed to Sinfotech through its own channels. The Content uploaded by the Creator remains distinct from the technical data generated by use of the Tag. Any mandatory rights granted by Regulation (EU) 2023/2854 (Data Act) remain unaffected, where concretely applicable.

Saving or forwarding the displayed address does not normally allow renewed access without a valid scan. The Digital Page is not intended for ordinary indexing. No measure guarantees absolute inviolability: anyone who legitimately views the Content can photograph it, record it, take screenshots or show it to third parties using external tools. Dissemination without the authorisation of the rights holders is prohibited.

Art. 11 — Immutability, rights and necessary interventions

After Publication the Creator cannot edit, supplement or replace the Content through the normal functions of the Service. Subsequent content cannot be added. The Password and the access mode remain editable.

Immutability is a contractual feature of the experience and does not override the law. J.Rose may correct metadata, restrict access, obscure, extract, delete or render unusable any Content when necessary to give effect to a data subject’s right, a withdrawal, a well-founded report, an order or a legal obligation. If rectification of the Content is not technically or legally practicable without altering the work, J.Rose will assess an equivalent measure with the person concerned, including restriction or deletion.

Art. 12 — Management, download and deletion functions

With the email, Tag ID and OTP, the Creator may view the status, change the Password or access mode, download a copy of the active Content and delete it in full. The download function may be suspended for maintenance or security, but is restored without undue delay.

Deletion requires an OTP and a second confirmation. The Password alone is not enough.

DELETION CONFIRMATION — I confirm that I wish to permanently delete the Content and deactivate the experience associated with the Bottle. I understand that the Content will no longer be reachable through the Tag, will not be recoverable using the normal functions and cannot be replaced on the same Tag; any remaining copies in backups will be rendered unusable within the maximum cycle indicated in the Privacy Notice.

Removal from the live systems starts immediately. Backup copies do not remain accessible and are deleted or overwritten within thirty days. After deactivation the Tag may redirect to an ordinary jrose.it page. Voluntary deletion is not equivalent to withdrawal and, after the withdrawal period, does not entitle the Creator to a refund, without prejudice to the mandatory remedies for non-supply or lack of conformity.

Art. 13 — Relationship between Creator, Recipient and Visitors

The contract is concluded between J.Rose and the Creator. The Recipient and the Visitor do not acquire ownership of the contractual relationship, without prejudice to the protections granted to them by law, including data protection, intellectual property, image and privacy rights.

Transfer of the Bottle does not automatically transfer the management functions to the new holder. Anyone who disputes an activation or a publication may write to info@jrose.it; J.Rose may suspend access during the review and request proportionate evidence.

If the Professional Creator determines the purposes and means of processing the data contained in the Content, they act as data controller; J.Rose processes such data on their behalf as processor in accordance with the “Article 28 GDPR Agreement for Professional Creators — Message in a JR Bottle” (the Professional Agreement). For contractual, security, abuse-prevention, moderation and legal-compliance activities, J.Rose instead acts as an independent controller. In the purely personal or household context of the consumer Creator, the exemption in Article 2(2)(c) GDPR may apply, without excluding J.Rose’s own obligations.

Art. 14 — Ownership of Content and technical licence

The Creator retains the rights in the Content and warrants that they are entitled to use and publish it. Upon Publication the Creator grants J.Rose, for the duration of the Service, a non-exclusive, royalty-free, limited licence, technically necessary to host, copy for backup, compress, transcode, transmit, display, protect and, where due, moderate or remove the Content.

The licence does not allow J.Rose to sell the Content, use it in advertising, train artificial intelligence systems or exploit it for unrelated purposes. J.Rose may allow only the technical operations necessary to the Developer, to Serverplan and to other authorised sub-suppliers, within the limits of their respective engagements.

Art. 15 — Prohibited content and Creator obligations

It is prohibited to upload content that is unlawful, harmful, unnecessary or incompatible with the personal nature of the Service. In particular, the following are prohibited:

  • images, voice, name or other data that identify or make identifiable a minor;
  • data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data intended to uniquely identify a person, data concerning health, sex life or sexual orientation;
  • data relating to criminal convictions, offences, security measures or criminal proceedings;
  • identity documents, tax codes, credentials, passwords, bank or payment data, private addresses, precise location data or other highly confidential information;
  • intimate nudity, sexual material, non-consensual intimate images, sexual exploitation or abuse of minors;
  • threats, incitement to hatred or violence, stalking, harassment, defamation, discrimination, self-harm, incitement to suicide or instructions for dangerous or criminal activities;
  • content that infringes copyright, trademarks, image rights, privacy, trade secrets or other rights;
  • malware, malicious code, scams, impersonation, advertising or mass communications.

The Creator must limit personal data to what is strictly necessary, inform the persons concerned when required by Articles 13 and 14 GDPR, hold the rights and the applicable legal basis, and choose knowingly between Open and Protected Access. If they cannot comply, they must not upload the data.

The Professional Creator is responsible for the lawfulness of the instructions given to J.Rose and must handle data subjects’ requests, with the assistance provided for in the Professional Agreement. A breach may result in refusal of Publication, suspension or removal, without prejudice to withdrawal, conformity remedies and compensation under the law.

Art. 16 — Reports, moderation, DSA and review

Anyone may report Content believed to be unlawful using the visible text link “Report unlawful content”, available on the private Digital Page and in the legal area, which opens a message addressed to info@jrose.it with a subject and an editable outline of the requested information already prepared; it remains possible to write directly to the same address. The report should indicate, as far as possible: a reasoned explanation of why the content is unlawful; the exact electronic location, such as the Tag ID or URL; the reporter’s name and email, except for reports concerning child sexual abuse offences for which such data is not required; a statement of good faith as to accuracy and completeness. J.Rose acknowledges receipt if it has the contact details.

J.Rose examines reports in a timely, diligent, non-arbitrary and objective manner. It may request clarification, restrict access as a precaution, and take no measure, or a restriction, obscuring, suspension or removal. Technical security checks may be automated; decisions on the Content involve human intervention. No general preventive monitoring is carried out.

When it affects the Content or the Service, J.Rose communicates to the person concerned a clear and specific statement of reasons including the facts and circumstances, the legal or contractual basis, the use of automated means, the territorial scope and duration of the measure, and the available means of redress, unless prohibited by law or impossible.

The Creator may request a review at info@jrose.it within six months of the communication. J.Rose decides with suitably qualified staff and informs of the outcome. Complaints to the authorities, certified out-of-court dispute resolution bodies and judicial remedies remain available. For orders from the authorities and cooperation obligations, the DSA and national law apply.

Duration, warranties and withdrawal

Art. 17 — Guaranteed minimum duration and subsequent continuation

J.Rose guarantees availability of the Service for one year from Publication, except in the event of deletion, withdrawal, lawful suspension, force majeure or impossibility not attributable to J.Rose. Suspensions attributable to J.Rose lasting more than forty-eight hours in total extend the minimum period by an equivalent time, in addition to other applicable remedies.

After the year, the Service may continue free of charge without automatic paid renewal. J.Rose may end such continuation with at least sixty days’ notice to the Creator’s email, stating the end date and offering a reasonable opportunity to download. No consideration is due for the free continuation.

Voluntary deletion by the Creator is immediate. A removal due to unlawfulness does not entitle the Creator to a refund, without prejudice to mandatory rights. A termination attributable to J.Rose during the minimum period gives rise to the remedies in Article 19.

Art. 18 — NFC Tag, compatibility and malfunctions

Sinfotech manages the TagLink technical verification; the Developer manages the J.Rose Platform; Serverplan provides the infrastructure to the Developer. J.Rose coordinates the suppliers and remains responsible to the Creator for performance of the Service purchased, except for causes attributable to the Creator or cases provided by law.

The Tag does not guarantee reading from every device. If NFC is not available, an alternative link may be provided when technically envisaged. The Creator must promptly report the fault and cooperate in the checks without tampering with the Tag.

If the defect concerns the Bottle or the Tag as goods, the seller’s statutory warranties for the goods apply. If it concerns the digital Service, Article 19 applies. The own terms of TagLink, Serverplan or the payment providers do not limit the Consumer’s mandatory rights against J.Rose for the Service.

Art. 19 — Conformity of the Service and remedies

J.Rose provides the Service in accordance with the contract, the Consumer Code and the legislation on digital content and services. The Service must match its description, have the functionality, compatibility, accessibility, continuity and security reasonably expected, and receive the updates necessary to maintain conformity during the period due.

In the event of non-supply or a defect, the Consumer must inform J.Rose at info@jrose.it. J.Rose restores conformity free of charge, within a reasonable time and without significant inconvenience. The Consumer may obtain a price reduction or termination in the cases provided by law, including impossibility, refusal, serious defect or failure to restore. Compensation remains governed by law.

For Professional Creators, J.Rose acts in good faith and in accordance with the declared service levels; mandatory rules remain unaffected. No clause excludes liability for wilful misconduct, gross negligence, injury, mandatory breaches of personal data or rights that cannot be limited.

Art. 20 — Right of withdrawal and refund

The Consumer may withdraw without giving any reason within fourteen days of the conclusion of the contract. J.Rose grants a full refund even if the Consumer requested immediate Publication and the Service has been activated, without demanding advance waivers beyond the limits permitted by law.

Withdrawal may be exercised using the form in Annex A, an unequivocal statement sent to info@jrose.it or by PEC, or through the online function “Withdraw from the contract here”, continuously visible and easily accessible during the withdrawal period. The function allows the name, email and contract identifier to be entered, displays an unambiguous confirmation button and immediately sends, on a durable medium, a confirmation containing the content, date and time of the communication.

J.Rose refunds within fourteen days of the communication, using the same means of payment unless otherwise agreed at no cost. Withdrawal deactivates the experience and removes the Content from the live systems; the Tag may be technically returned to its previous state where possible. Mere deletion through the management functions does not constitute exercise of withdrawal.

The right does not belong to the Professional Creator, unless expressly agreed. The remedies for non-supply or lack of conformity remain separate.

Privacy, liability and contacts

Art. 21 — Privacy, roles and third-party data

The Message in a JR Bottle Privacy Policy, provided under Articles 13 and 14 GDPR, describes the processing, legal bases, recipients, transfers, retention and rights, and supplements these Terms.

On landing pages and on commercial or purchase pages, the “Cookie and Tracking Policy of the J.Rose Digital Ecosystem” applies. On the private Digital Page, Google Tag Manager, Google Analytics, Meta Pixel, unnecessary WordPress statistics or other analytics, profiling or marketing trackers are not installed, even where the Visitor has given consent in a different J.Rose environment.

J.Rose is the controller for orders, payments within its remit, email and OTP, management of the Service, security and logs of the J.Rose Platform, aggregate statistics received, moderation, support, withdrawal, defence and legal obligations. The Developer processes such data on behalf of J.Rose; Serverplan operates in the Developer’s chain as sub-processor for hosting and backup.

Sinfotech determines the processing carried out on its own TagLink page for verification, traffic, security, analytics and platform management in accordance with its own notice. J.Rose does not promise deletion of logs held independently by Sinfotech; it forwards or directs requests where necessary.

When a Professional Creator identifies as such and determines the purposes and means of the data entered in the Content, they must separately accept the Professional Agreement: J.Rose acts as processor, the Developer as sub-processor and Serverplan as further sub-processor. Google Workspace, used by J.Rose for its business mail and for OTPs, is a direct Processor of J.Rose and is not part of the professional Content chain. Absent the necessary prerequisites, the professional must not upload personal data.

Art. 22 — Technical suppliers, changes, continuity and force majeure

J.Rose may replace components or suppliers provided that it does not reduce conformity, security or mandatory rights. Changes necessary for security, the law or interoperability are installed at no cost. Changes that adversely affect access or use are communicated with reasonable notice and give rise to the remedies provided for digital services.

The Developer is the application technical contact and maintains the Serverplan hosting under its own contractual relationship. J.Rose must contractually ensure continuity, export of the database and Content, availability of configurations and credentials, a maximum backup period of thirty days and supplier exit measures. This arrangement does not give the Creator a direct relationship with the Developer or Serverplan.

J.Rose is not liable for delay due to unforeseeable and unavoidable events beyond its control, for the time strictly necessary and provided that it adopts reasonable continuity measures and informs users. If the impediment permanently or for a significant period compromises the Service, withdrawal and conformity remedies apply.

Art. 23 — Liability of J.Rose and of the Creator

J.Rose is liable for performance of the Service in accordance with the law. It is not liable for problems caused solely by incompatible devices, the user’s connections, loss of control of the email, disclosure of the Password, the Creator’s unlawful content, tampering with the Tag or use contrary to the Terms, unless J.Rose contributed.

J.Rose cannot prevent external screenshots or recordings after legitimate access and does not guarantee that the Recipient will interpret the Content as the Creator intended. This does not limit the obligations of security, action on reports and data protection.

For the Consumer, no exclusions or limits incompatible with mandatory rules apply. In professional relationships, except for wilful misconduct, gross negligence and liability that cannot be limited, any compensation for direct damages is limited to the price paid for the single Service; indirect damages or unforeseeable loss of profit are excluded. The limit does not apply to breaches of confidentiality, intellectual property or personal data attributable to J.Rose.

The Creator is responsible for their own statements and for the Content and holds J.Rose harmless from third-party claims arising from their unlawful conduct, within the limits permitted and without transferring to them responsibilities that belong to J.Rose.

Art. 24 — Support, governing law, jurisdiction, ADR and contact points

Support is available at info@jrose.it. For privacy requests: privacy@jrose.it. For formal communications: affreschisrls@pec.it. J.Rose replies in Italian or English.

The contract is governed by Italian law. The Consumer retains the mandatory protections of the country of habitual residence. For Consumer disputes, the court of the Consumer’s place of residence or domicile has jurisdiction. For Professional Creators, the Court of Lecce has exclusive jurisdiction, subject to mandatory rules.

The Consumer may use the ADR bodies listed in the competent registers. The European ODR platform has been discontinued and is not indicated as an operating channel. The right to contact the competent authorities remains, including the Italian Data Protection Authority (Garante) and, for DSA matters, the Communications Regulatory Authority (AGCOM).

As the provider is established in Italy, no legal representative is designated under Article 13 DSA. The single point of contact for authorities, the European Commission, the Board and recipients under Articles 11 and 12 DSA is info@jrose.it.

Art. 25 — Accessibility of the Service

J.Rose designs and maintains the e-commerce and Service functions so as to make them perceivable, operable, understandable and robust, in line with Italian Legislative Decree 82/2022 and the applicable European accessibility requirements. Information is provided in clear language, with a logical structure, reasonable compatibility with assistive technologies and textual or operational alternatives where necessary.

The essential path includes Tag identification, upload, preview, payment, Publication, viewing, management, withdrawal and support. Use of the Tag requires a compatible device and browser; an alternative path is indicated when technically available. J.Rose monitors the Service and assesses updates that may affect accessibility.

Problems or support requests may be sent to info@jrose.it, indicating the page, function, device and assistive technology used, if known. J.Rose provides feedback and, where necessary, a reasonable alternative method. This information does not replace any declaration or documentation required by the competent authorities.

Art. 26 — Acceptance, approvals and version

Before the order the Creator must be able to download or save the Terms and the Privacy Notice. The boxes are not preselected. Acceptance of the Terms is distinct from acknowledgement of the Privacy Notice and from any optional consents for cookies or marketing.

The flow must capture at least the following statements:

  • Terms: “I declare that I have read and accept the Message in a JR Bottle Terms and conditions, in the version indicated next to the link to the document”.
  • Age and powers: “I declare that I am at least 18 years old and, if I act for an organisation, that I have the necessary powers”.
  • Content: “I confirm that the Content complies with the prohibitions and with third-party rights, including the prohibition on data of minors and on special categories or criminal data”.
  • Access mode: “I understand the differences between Open and Protected Access and that external copies cannot be prevented after a legitimate viewing”.
  • Publication: the separate confirmation provided for in Article 8.
  • Professionals: only if the Creator declares that they act in the course of their own activity and as controller of the Content, a separate checkbox reads: “I accept the Article 28 GDPR Agreement for Professional Creators — Message in a JR Bottle, in the version indicated next to the link, and I appoint J.Rose as Processor”. The system separately records professional identity, text, effective version, date/time, order and evidence of the positive action, and provides a durable copy.

For relationships between professionals only, the parties specifically approve, where necessary under Articles 1341 and 1342 of the Italian Civil Code, Articles 17 (duration and end of free continuation), 22 (changes and suppliers), 23 (limits of liability), 24 (exclusive jurisdiction). Any specific approvals of the Professional Agreement are collected separately in the relevant flow.

The Terms are effective from publication of the Service. J.Rose keeps the version accepted by each Creator. Updates do not retroactively affect accrued rights; those required by law, security or conformity are communicated in accordance with Article 22.

Annex A — Model withdrawal form

To: Affreschi & Affreschi S.r.l. — J.Rose, Zona P.I.P., Lotto 9 – 73027 Minervino di Lecce (LE), email info@jrose.it, PEC affreschisrls@pec.it.

I/We hereby give notice that I/we withdraw from the contract for the “Message in a JR Bottle” service.

  • Consumer’s first name and surname:
  • Associated email:
  • Order/contract identifier or Tag ID:
  • Date the contract was concluded:
  • Date of communication:
  • Signature, only if the form is on paper:

The form may be sent by email or PEC. During the withdrawal period the online function “Withdraw from the contract here”, described in Article 20, is also available.