Privacy Notice on the Processing of Personal Data

1. Purposes of processing, legal basis and whether providing data is required

Failure to provide data marked as “required” will make it impossible to follow up on your request; failure to provide data marked as “optional” has no consequences on the management of the existing relationship.

2. How your data is processed

Your data is processed using electronic and IT tools, according to logic strictly related to the purposes indicated above, and in any case in a way that ensures the security and confidentiality of the data, in compliance with the technical and organizational measures set out in Articles 25 and 32 of the GDPR.

3. Categories of data processed

The Controller processes ordinary personal data (identification and contact details such as name, surname, email, phone number), browsing data automatically collected while using the website, and any other personal data you voluntarily provide by filling in the forms on the website or communicating with us.

4. Recipients of the data and transfers outside the EU

Your data may be shared, for the purposes indicated above, with individuals authorized to process data as employees or collaborators of the Controller, as well as with third-party providers acting as data processors under Art. 28 GDPR (for example: hosting providers, CRM management providers, email marketing providers and messaging platform providers). An up-to-date list of data processors is available upon request by writing to the contact details in section 1.

Since Parco Estate also targets an international clientele, some of these providers may be based, or operate servers, outside the European Economic Area (for example in the United States). In such cases, the data transfer takes place on the basis of one of the safeguards provided for by Articles 44-49 of the GDPR, such as the Standard Contractual Clauses approved by the European Commission, the provider's adherence to the EU-US Data Privacy Framework, or other European Commission adequacy decisions. You may request further information on these safeguards by writing to the contact details in section 1.

5. Data retention period

Data collected through contact forms is retained for a maximum of 24 months from the last relevant contact, unless a contractual relationship is established in the meantime, in which case data related to the contract is retained for 10 years from the end of the relationship in order to comply with civil and tax law obligations. Data processed on the basis of consent (newsletter, promotions) is retained until such consent is withdrawn.

6. Data subject rights

As a data subject, you have the right, under Articles 15-22 of the GDPR, to request the Controller, by writing to the contact details in section 1, to:

• access your personal data;
• rectify inaccurate or incomplete data;
• erase your data (“right to be forgotten”), in the cases provided for by law;
• restrict processing;
• object to processing, in particular for marketing purposes;
• data portability;
• withdraw consent to processing at any time, without affecting the lawfulness of processing carried out before the withdrawal.

7. Complaint to the Data Protection Authority

You also have the right to lodge a complaint with the competent supervisory authority, identified in Italy as the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority):