Privacy & Data Protection Policy

1. Introduction and Data Controller Overview

Welcome to Encoretemponst. This Privacy Policy outlines how Encoretemponst S.r.l. ("we", "our", "us", or "the Company"), with registered office at Via della Spiga 28, 20121 Milano (MI), Italy, collects, uses, processes, and protects your Personal Data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR), the Italian Legislative Decree no. 196/2003 as amended, and applicable international privacy legislation including the California Consumer Privacy Act (CCPA).

As providers of ultra-luxury boutique accommodation, private estate charters, and bespoke concierge hospitality throughout Italy, we maintain rigorous standards of privacy, confidential guest management, and cryptographic protection of personal records.

2. Categories of Personal Data Collected

We may process the following types of personal information provided directly by you or generated during your interaction with our platform:

• Identity & Contact Information: Full name, passport/ID details (as legally mandated for Italian Alloggiati Web guest registration), email address, postal address, mobile phone number.
• Concierge & Stay Preferences: Dietary requirements, allergy profiles, guest party composition, arrival times, private aviation/transfer details, and bespoke hospitality requests.
• Financial & Payment Records: Billing addresses, transaction identification numbers, IBAN/SEPA bank transfer confirmations, and cryptographic tokens provided by certified Level-1 PCI-DSS payment gateways. We do not store raw cardholder verification numbers (CVV) on our servers.
• Technical & Spatial Usage Data: IP address, browser type and version, language settings, geolocation data at municipal level, device parameters, and interaction metrics with our 3D WebGL villa viewport.

3. Legal Bases and Purposes of Processing

We process your data strictly under the following lawful bases set forth in Article 6 of the GDPR:

• Performance of Contract (Art. 6.1.b): To process booking reservations, issue confirmation vouchers, coordinate private staff, and manage estate access.
• Legal Compliance (Art. 6.1.c): To comply with Italian Public Security Laws (Testo Unico delle Leggi di Pubblica Sicurezza - T.U.L.P.S., Art. 109) requiring registration of all accommodated guests with the Italian State Police (Polizia di Stato) via the Alloggiati Web portal, as well as fiscal invoicing under Italian Revenue Agency (Agenzia delle Entrate) regulations.
• Legitimate Interests (Art. 6.1.f): To maintain site security, prevent fraud, optimize WebGL rendering performance, and protect our physical estate properties.
• Consent (Art. 6.1.a): For non-essential analytical cookies, bespoke newsletter communications, and tailored sommelier/culinary recommendations.

4. Data Retention Periods

In compliance with the principle of storage limitation (Art. 5.1.e GDPR), we retain personal data only for as long as necessary to fulfill the purposes for which it was gathered. Specifically:

• Stay Records & Police Manifests: Retained for the statutory duration required by Italian national security and administrative law (typically up to 5 years).
• Fiscal Invoices & Tax Documents: Retained for 10 years in compliance with the Italian Civil Code (Art. 2220 C.C.).
• Concierge Inquiry Logs: Retained for 24 months from the last active correspondence, after which records are irreversibly anonymized or securely expunged.

5. International Data Transfers & Third-Party Processors

Personal data is primarily stored within encrypted cloud servers located in the European Union (Frankfurt and Milan regions). Where service providers (e.g., global CRM systems, email routing nodes) operate outside the European Economic Area (EEA), transfers are governed strictly by the European Commission’s Standard Contractual Clauses (SCCs) ensuring an adequate level of protection.

6. Your Rights Under GDPR and CCPA

As a data subject, you hold comprehensive rights regarding your Personal Data, including:

• The right to access, rectify, or obtain erasure (the "Right to be Forgotten") of your records.
• The right to restrict or object to processing under certain conditions.
• The right to data portability in a structured, machine-readable format.
• The right to lodge a formal complaint with the Italian Supervisory Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it) or your local EU authority.

7. Data Protection Officer (DPO) Contact

For inquiries, formal subject access requests (SAR), or data erasure demands, please contact our Data Protection Officer at:

Data Protection Officer
Encoretemponst S.r.l.
Via della Spiga 28, 20121 Milano (MI), Italy
Email: [email protected]