Skip to content

DATA-PROTECTION NOTICE
(pursuant to Articles 13–14 of Regulation (EU) 2016/679 – “GDPR” and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018)
Version 1.0 – 3 July 2025

0. Document outline

  1. Purpose and scope

  2. Key definitions

  3. Controller and contacts

  4. Categories of data processed

  5. Purposes, legal bases and nature of provision

  6. Origin of the data

  7. Processing methods and security measures

  8. Recipients and categories of recipients

  9. Data location and hosting services

  10. Extra-EEA transfers

  11. Automated decisions and profiling

  12. Retention periods

  13. Processing of minors’ data

  14. Data-subject rights

  15. How to exercise your rights

  16. Complaint to the Supervisory Authority

  17. Cookies & tracking technologies

  18. Updates to this notice

  19. Revision history

1. Purpose and scope

This notice explains how Immobiliare S. Angelo S.p.A. (“Controller”) processes personal data of users who visit or interact with the website miramaresearesort.it (“Site”), including data collected through online forms and cookies/tracking tools.

2. Key definitions

  • Personal data: any information about an identified or identifiable natural person.

  • Processing: any operation performed on personal data (collection, recording, storage, etc.).

  • Data subject: the individual to whom the data refer.

  • Processor: an external party processing data on behalf of the Controller (Art. 28 GDPR).

  • EEA: European Economic Area.

3. Controller and contacts

No Data Protection Officer (DPO) has been appointed, as the conditions of Art. 37 GDPR do not apply.

4. Categories of data processed

  1. Browsing data – IP address, device ID, URI/URL, timestamp, HTTP method, server response code, user-agent, OS/browser parameters.

  2. Data voluntarily provided – name, surname, e-mail, phone number, message content and any other information entered in forms (availability requests, contacts, newsletter).

  3. Cookies and similar technologies –
    • technical/session cookies (strictly necessary);
    • analytics cookies (Google Analytics 4 with IP anonymisation);
    • marketing/profiling cookies (Meta Pixel, Google Ads Remarketing) enabled only with consent.

5. Purposes, legal bases and nature of provision

Purpose A – Secure browsing, Site functionality, prevention of unlawful use
• Legal basis: Controller’s legitimate interest (Art. 6 §1 f GDPR).
• Provision: automatic with browsing; necessary to view the Site.

Purpose B – Handling form enquiries, quotations, bookings
• Legal basis: performance of pre-contractual or contractual measures requested by the user (Art. 6 §1 b).
• Provision: mandatory; failure to provide prevents fulfilment of the request.

Purpose C – Post-stay service messages (“soft-spam”)
• Legal basis: legitimate interest (Recital 47 GDPR).
• Provision: optional; the user may object at any time.

Purpose D – Newsletter, commercial offers, remarketing
• Legal basis: explicit consent (Art. 6 §1 a).
• Provision: optional; refusal does not affect browsing or other services.

6. Origin of the data

Data are supplied directly by the user or collected automatically via the Site. The Controller does not purchase third-party lists.

7. Processing methods and security measures

Electronic tools compliant with Art. 32 GDPR are used: TLS 1.3 encryption, multi-factor admin authentication, redundant backups, logical DB segregation, access logging, disaster-recovery procedures and regular vulnerability tests.

8. Recipients and categories of recipients

• Hosting provider: SiteGround Spain S.L.U. (Processor).
• Advertising platforms: Google LLC, Meta Platforms Inc. (independent Controllers for their services).
• IT consultants and maintenance suppliers (Processors).
• Competent public/judicial authorities to meet legal obligations.
No indiscriminate dissemination of personal data is envisaged.

9. Data location and hosting services

Servers are located solely within the EU (data centres in Germany and the Netherlands) and belong to SiteGround Spain S.L.U., appointed Processor with security clauses and periodic audits.

10. Extra-EEA transfers

Transfers to the USA (e.g., Google or Meta cookies) occur under:

  1. Standard Contractual Clauses (EU Decision 2021/914);

  2. additional safeguards (pseudonymisation, data minimisation) per EDPB Recommendations 01/2020;

  3. the user’s explicit consent where required for marketing cookies (Art. 49 §1 a).

11. Automated decisions and profiling

• First-party profiling (basic segmentation by language or stay preferences) relies on legitimate interest and has no significant impact on the user’s rights.
• Third-party profiling via marketing cookies operates only with consent.
• No fully automated decisions producing legal effects are taken.

12. Retention periods

• Technical logs: 24 months (extendable for investigations).
• Form/booking data: 36 months after last interaction.
• Accounting/fiscal data: 10 years (Italian Civil Code 2220).
• Marketing data: until consent is withdrawn or 24 months after last meaningful interaction.
Data are deleted or irreversibly anonymised once the period expires.

13. Processing of minors’ data

The Site targets adults. Data of persons under 16 are processed only with parental consent (Art. 8 GDPR).

14. Data-subject rights

At any time, data subjects may exercise rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent.

15. How to exercise your rights

Send a request to hotel@miramaresearesort.it. The Controller will reply within 30 days (extendable by 60 days for complex cases) after verifying identity.

16. Complaint to the Supervisory Authority

Users may lodge a complaint with the Italian Data-Protection Authority (www.garanteprivacy.it) or with the authority of their habitual residence.

17. Cookies & tracking technologies

Full details (categories, purposes, duration, consent management) are provided in the Cookie Policy published on the Site, which forms an integral part of this notice.

18. Updates to this notice

The Controller may amend this notice at any time. Updated versions will be posted on the Site and, where appropriate, notified by e-mail.

19. Revision history

Version 1.0 – 03/07/2025 – Initial publication.