Privacy Policy

Last updated: 11/09/2026

1. Introduction

This Privacy Policy describes how Hestia Properties S.r.l. ("we", "our" or "Controller") collects, uses and protects the personal data of users of the HestiaBot service, our AI-powered virtual assistant available through Meta platforms (Facebook Messenger and Instagram).

We are committed to protecting your privacy in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Italian data protection legislation.

2. Personal Data Collected

Through the use of HestiaBot, we may collect the following categories of data:

3. Purpose of Processing

Your personal data is processed for the following purposes:

• Service delivery: answering your questions and providing automated assistance through HestiaBot
• Service improvement: analyzing interactions to improve chatbot responses and effectiveness
• Customer support: handling requests that require human intervention
• Legal obligations: complying with legal requirements and responding to requests from competent authorities

4. Legal Basis for Processing

The processing of your data is based on:

• Contract performance (Art. 6.1.b GDPR): to provide the requested service
• Legitimate interest (Art. 6.1.f GDPR): to improve our services and prevent abuse
• Consent (Art. 6.1.a GDPR): for any marketing purposes, with your explicit consent
• Legal obligation (Art. 6.1.c GDPR): to comply with regulatory obligations

5. Data Retention

Personal data is retained for the time strictly necessary for the purposes for which it was collected:

• Conversation data: 24 months from the last interaction
• Marketing data: until consent is withdrawn
• Legal obligation data: as required by law (e.g. 10 years for tax obligations)

6. Data Sharing

Your data may be shared with:

• Meta Platforms, Inc.: as the messaging platform provider
• Cloud service providers: for hosting and data processing (with EU servers where possible)
• AI service providers: for chatbot response processing (e.g. Anthropic for Claude AI)

All our suppliers are bound by GDPR-compliant data processing agreements (DPA).

7. Extra-EU Data Transfers

Some of our providers may transfer data outside the European Economic Area. In such cases, we ensure adequate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Provider certification under the EU-US Data Privacy Framework

8. Your Rights

As a data subject, you have the right to:

• Access: obtain confirmation of processing and a copy of your data
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your data ("right to be forgotten")
• Restriction: restrict processing in certain cases
• Portability: receive your data in a structured format and transfer it to another controller
• Objection: object to processing based on legitimate interest
• Withdrawal of consent: withdraw consent at any time

To exercise these rights, contact us at: privacy@hestiaproperties.eu

9. Complaints

You have the right to lodge a complaint with the Italian Data Protection Authority:

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS)
• Need-to-know access restrictions
• Access monitoring and logging
• Regular backups and disaster recovery procedures

11. Changes to This Policy

We reserve the right to modify this Privacy Policy at any time. Changes will be published on this page with the date of the last update. We encourage you to review this page periodically.

12. Contact

For any questions regarding this Privacy Policy or the processing of your personal data, contact us at: