Privacy notice
Privacy policy
This notice describes how personal data is processed via torre-dominella.it, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Italian legislation.
Compliance notice
The Meta Pixel is currently loaded without prior user consent. Until a consent banner is implemented, the legal basis for the Meta Pixel is not fully compliant with the GDPR and the ePrivacy Directive. An opt-in consent mechanism must be enabled or the pixel must be disabled.
Data controller
22 - S.R.L.
Via Santa Maria
84040 Casal Velino (SA)
Italia
Privacy contact
Reservation request
- Data processed
- First and last name, email address, phone number, party size, date, time, area and free-text message submitted through the reservation form.
- Legal basis
- Pre-contractual measures taken at the request of the data subject — Art. 6(1)(b) GDPR.
- Recipients / providers
- Database hosted on Supabase (Cloud). Transactional email delivery via IONOS SMTP.
- Retention
- Information to be added
Transactional and team emails
- Data processed
- Content of the reservation (data listed above), status, optional message to the guest, log of delivery attempts and SMTP errors.
- Legal basis
- Pre-contractual measures and legitimate operational interest — Art. 6(1)(b) and (f) GDPR.
- Recipients / providers
- IONOS SMTP provider (Germany/EU) and internal team recipients defined in configuration.
- Retention
- Information to be added
Server and security logs
- Data processed
- IP address, user agent, timestamp, requested URL, technical browser data, application error logs.
- Legal basis
- Legitimate interest in site security and abuse prevention — Art. 6(1)(f) GDPR.
- Recipients / providers
- Cloudflare hosting platform (global network) and Supabase (EU).
- Retention
- Information to be added
- Transfers outside the EU
- Possible transfer to third countries via Cloudflare's CDN under standard contractual safeguards.
Session, visits and campaign parameters (UTM)
- Data processed
- Technical session identifier, visited page, UTM parameters (utm_source, utm_medium, utm_campaign, etc.), public interactions (e.g. clicks on the phone number).
- Legal basis
- Legitimate interest in measuring the effectiveness of channels and optimising the site — Art. 6(1)(f) GDPR.
- Recipients / providers
- Supabase database.
- Retention
- Information to be added
Internal admin dashboard
- Data processed
- Reservation requests are visible to authorised staff (Staff/Owner) via a token-protected internal area.
- Legal basis
- Legitimate operational interest — Art. 6(1)(f) GDPR.
- Recipients / providers
- Only authorised personnel of 22 - S.R.L.
- Retention
- Information to be added
Meta Pixel
- Data processed
- The site embeds the Meta (Facebook) Pixel. Technical browser data, IP address, visited page and standard events are transmitted.
- Legal basis
- Consent of the data subject — Art. 6(1)(a) GDPR. Prior consent is currently not collected; see the compliance notice above.
- Recipients / providers
- Meta Platforms Ireland Ltd. and affiliated companies.
- Retention
- Defined by Meta according to its own policies.
- Transfers outside the EU
- Possible transfer to the United States under the EU-US Data Privacy Framework.
Instagram integration
- Data processed
- The Club page displays preview thumbnails of posts by @torredominella. Thumbnails are loaded directly from Meta CDNs (*.cdninstagram.com, *.fbcdn.net); the <img> tag uses referrerPolicy="no-referrer".
- Legal basis
- Legitimate interest in presenting current activities — Art. 6(1)(f) GDPR.
- Recipients / providers
- Meta Platforms Ireland Ltd.
- Retention
- Not applicable: no data is stored by the website.
- Transfers outside the EU
- See Meta Pixel section.
Rights of data subjects
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR)
- Withdrawal of consent, where applicable
Complaint to the supervisory authority
Every data subject has the right to lodge a complaint with the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) or the competent local supervisory authority.
Data Protection Officer (DPO)
The appointment of a DPO is currently under review.