PRIVACY POLICY
This policy explains how personal data is processed when you visit palazzoamauro.com. It is provided under Article 13 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the "Italian Privacy Code"). It applies to this website only.
1. Who is responsible for your data
The Data Controller is:
SLM Capital S.r.l.
Registered office: Viale Lo Re 6, 73100 Lecce (LE), Italy
VAT number (P.IVA): 05227790754
Email: palazzoamauro@gmail.com
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. All privacy matters are handled at the contact details above.
2. What data we process, why, and for how long
2.1 Enquiries sent through our contact form
Data: your first name, your last name, your email address, the desired check-in and check-out dates (if you choose to provide them), and the content of your message.
Purpose: to answer your enquiry about staying at Palazzo A Mauro.
Legal basis: Article 6(1)(b) GDPR — steps taken at your request for information and possible future bookings. Where your enquiry does not concern a possible stay, Article 6(1)(f) GDPR — our legitimate interest in replying to people who contact us.
Retention: 24 months from our last correspondence with you, after which the message and our reply are deleted.
Your first name, last name, email address and message are required fields: without them we cannot reply to you. The check-in and check-out dates are optional. Please do not include special categories of data as defined in Article 9 GDPR (for example information about health, religious beliefs or political opinions) in your message — we do not collect such data intentionally.
2.2 Technical data recorded automatically
Data: IP address, browser type and version, operating system, pages visited, date and time of visit, referring URL. An IP address is personal data under the GDPR.
Purpose: to keep the website secure and functioning correctly.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in the security and integrity of our website.
Retention: no longer than 6 months.
2.3 Statistics on how the site is used
Data: analytics cookies and the data they generate (see section 6).
Purpose: to understand how many people visit the site and how they move through it.
Legal basis: Article 6(1)(a) GDPR — your consent, given through our cookie banner.
Retention: up to 24 months, corresponding to the maximum lifespan of the cookies concerned.
2.4 Content embedded from Instagram and Google Maps
Data: your IP address and cookies set by the third parties concerned.
Purpose: to display our Instagram feed and a map of our location.
Legal basis: Article 6(1)(a) GDPR — your consent, given through our cookie banner. This content is not loaded unless you consent.
Retention: determined by the third parties concerned (see section 4).
2.5 Compliance with legal obligations
Data: any of the above, as relevant.
Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation to which we are subject.
Retention: for the period required by the applicable law.
Where we rely on legitimate interest, we have weighed that interest against your rights and freedoms and concluded that our processing does not override them. You may object at any time — see section 5.
2.6 Automated decision-making
We do not use your personal data for automated decision-making or profiling within the meaning of Article 22 GDPR.
3. Who we share your data with
We do not sell, rent or trade your personal data. It is shared only with the following categories of recipient:
Providers acting as data processors on our behalf, under written agreements meeting the requirements of Article 28 GDPR:
• Squarespace Ireland Limited and Squarespace, Inc. — website platform and hosting, processing of contact form submissions, and the site's built-in analytics.
• Google Ireland Limited and Google LLC — the email service through which your enquiry is received and stored.
• Studio Athanatos – service provider that supports us in systems, IT support and customer relationships at times.
Independent third parties, which process data under their own responsibility and their own privacy policies:
• Meta Platforms Ireland Limited — the Instagram feed embedded on our site.
• Google Ireland Limited — Google Maps embedded on our site.
Others:
• Lawyers, accountants and public authorities, where disclosure is required by law, court order or other legal process, or is necessary to establish, exercise or defend a legal claim.
4. Embedded content from Instagram and Google Maps
Our pages include an Instagram feed provided by Meta and a Google Maps location map. If you consent to non-essential cookies, your browser connects directly to the servers of Meta or Google when the page loads. Those companies may receive your IP address, set their own cookies, and combine that information with data they already hold about you if you are logged into their services. This processing takes place under their own privacy policies, which we do not control:
• Meta / Instagram: privacycenter.instagram.com/policy
• Google: policies.google.com/privacy
5. International transfers
Some of the providers listed above are established in, or transfer data to, the United States, which means your personal data may be transferred outside the European Economic Area. Where this happens, the transfer is protected by one or both of the following safeguards:
• The European Commission's adequacy decision of 10 July 2023 on the EU–U.S. Data Privacy Framework, where the recipient is certified under that framework; and
• Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR, together with any supplementary measures required.
You may request a copy of the safeguards in place by writing to us at the contact details in section 1.
6. Cookies
Cookies are small text files stored on your device when you visit a website.
Strictly necessary cookies
These are essential for the site to work. They are set by our website platform, Squarespace, and comprise: crumb, which lasts for the browser session and protects the contact form against cross-site request forgery; and ss_cookieAllowed, which lasts 30 days and records your cookie choice so that you are not asked again on every page. Under Article 122 of the Italian Privacy Code these cookies do not require your consent and cannot be disabled.
Analytical cookies
Our website platform includes built-in analytics, which identify unique visitors and track visitor sessions. These set the cookies ss_cid, ss_cvr, ss_cpvisit and ss_cvd (lasting up to two years) and ss_cvisit and ss_cvt (lasting around thirty minutes). They are first-party cookies, set by our own domain, although the data is collected and processed by Squarespace. Because these cookies are not strictly necessary, we set them only if you consent.
Third-party cookies
If you consent, the Instagram feed and Google Maps content may set cookies belonging to Meta and Google. These cookies are governed by the privacy policies of those companies and are outside our control.
Your choices
When you first visit palazzoamauro.com you are asked whether to accept or decline non-essential cookies. Declining is as easy as accepting. You can change your decision at any time by clicking “Cookie preferences” in the footer of any page. You can also manage or delete cookies through your browser settings. Disabling certain cookies may affect how the site functions.
7. Your rights
Under Articles 15 to 22 GDPR you have the right to:
• Access the personal data we hold about you and obtain a copy of it (Article 15)
• Have inaccurate or incomplete data corrected (Article 16)
• Have your data deleted (Article 17)
• Have processing restricted in certain circumstances (Article 18)
• Receive the data you provided in a structured, commonly used and machine-readable format and have it transmitted to another controller, where processing is based on your consent or on a contract and is carried out by automated means (Article 20)
• Object to processing based on our legitimate interests (Article 21)
• Not be subject to a decision based solely on automated processing (Article 22)
• Withdraw your consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out beforehand (Article 7(3))
To exercise any of these rights, contact us by email at palazzoamauro@gmail.com or by post at SLM Capital S.r.l., Viale Lo Re 6, 73100 Lecce (LE), Italy. Exercising your rights is free of charge. We will respond within one month of receiving your request; that period may be extended by two further months where the request is complex, in which case we will tell you within the first month.
8. Right to lodge a complaint
If you believe we have not handled your personal data properly, please contact us first so that we can put it right. You also have the right, at any time, to lodge a complaint with the Italian supervisory authority:
Garante per la protezione dei dati personali
Address: Piazza Venezia 11, 00187 Roma, Italy
Telephone: +39 06 696771
Email: garante@gpdp.it — PEC: protocollo@pec.gpdp.it
Website: www.gpdp.it
If you live or work in another EU or EEA country, you may instead complain to the supervisory authority of that country.
9. Changes to this policy
We may update this policy from time to time. Any changes will be published on this page with an updated effective date.