Privacy Policy

1. Data Controller

The Data Controller for personal data processing is:

The Data Controller can be contacted at the email address indicated above for any matter related to personal data protection.

2. Types of Data Collected

Personal data collected by the website, either independently or through third parties, include:

2.1 Data voluntarily provided by the user

• Email address – provided through the contact form on the website
• Message content – the text entered by the user in the message field of the contact form

2.2 Automatically collected data

• Browsing data – IP address, browser type, operating system, pages visited, access times and referring URLs
• Cookies and tracking technologies – as detailed in our Cookie Policy

2.3 Data collected through third-party services

• Google Analytics / Google Tag Manager – anonymous and/or pseudonymized statistical data related to browsing (cookie: _ga, _ga_*, _gid, _gat)
• Google Ads (Remarketing and Conversions) – data related to interactions with advertisements (cookie: _gcl_au, _gcl_aw, IDE, test_cookie)
• Meta Pixel (Facebook/Instagram) – data related to website interactions for remarketing and conversion analysis purposes (cookie: _fbp, _fbc, fr, tr)

3. Purposes of Data Processing

Personal data is processed for the following purposes:

• Responding to contact requests – data entered in the contact form is used exclusively to respond to user requests (legal basis: legitimate interest and/or user consent)
• Statistical traffic analysis – through Google Analytics, to understand how users interact with the website and improve the experience (legal basis: user consent)
• Remarketing and personalized advertising – through Google Ads and Meta Pixel, to show relevant ads to users who have visited the website (legal basis: user consent)
• Technical website operation – technical cookies necessary for the proper functioning of the website (legal basis: legitimate interest of the Data Controller)
• Compliance with legal obligations – when required by applicable law

4. Legal Basis for Processing

Personal data processing is based on the following legal grounds pursuant to Art. 6 of EU Regulation 2016/679 (GDPR):

• Consent (Art. 6(1)(a)) – for the installation of profiling cookies and for sending communications through the contact form
• Legitimate interest (Art. 6(1)(f)) – for technical cookies necessary for the website operation and for IT security
• Legal obligation (Art. 6(1)(c)) – for compliance with obligations under tax and commercial law

5. Data Recipients

Personal data may be disclosed to:

• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – for Google Analytics, Google Ads and Google Tag Manager services
• Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) – for the Meta Pixel service (Facebook/Instagram)
• Hosting and infrastructure service providers – for the technical operation of the website
• Consultants and professionals – within limits strictly necessary for compliance with accounting, tax and legal obligations

Data is not sold, transferred or disclosed to third parties for purposes other than those indicated in this policy.

6. Data Transfer Outside the EU

Some of the third-party services mentioned above (Google, Meta) may involve the transfer of personal data to the United States of America. Such transfers are carried out on the basis of the EU-U.S. Data Privacy Framework (DPF), following the adequacy decision of the European Commission of July 10, 2023, or alternatively on the basis of Standard Contractual Clauses (SCC) approved by the European Commission.

7. Data Retention Period

• Contact form data – retained for the time necessary to handle the request and for a maximum of 24 months from collection
• Browsing data and cookies – retained according to the durations indicated in the Cookie Policy
• Data for legal obligations – retained for the period required by applicable law (e.g. 10 years for tax obligations)

8. Rights of the Data Subject

As a data subject, pursuant to Articles 15-22 of the GDPR, the user has the right to:

• Access – obtain confirmation of processing and access to personal data
• Rectification – obtain correction of inaccurate data or completion of incomplete data
• Erasure – obtain deletion of personal data in cases provided by the GDPR
• Restriction – obtain restriction of processing in cases provided by the GDPR
• Portability – receive personal data in a structured, machine-readable format
• Objection – object to data processing on legitimate grounds
• Withdrawal of consent – withdraw consent at any time, without prejudice to the lawfulness of processing carried out before the withdrawal

To exercise these rights, the user can send a request to the email address: info@hestiaproperties.eu

The user also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it).

9. Changes to the Privacy Policy

The Data Controller reserves the right to make changes to this policy at any time. Any changes will be published on this page with an update to the date shown above. Users are invited to consult this page periodically.