Privacy and cookie policy
Last updated:
This is a courtesy translation. The Italian version is the legally binding one.
This notice explains which personal data are processed when you visit palazzomarzocchi.com (the “Site”), for what purposes, on what legal basis, and what your rights are. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree 196/2003 (the “Privacy Code”) and the Italian Data Protection Authority’s guidelines on cookies and other tracking tools of 10 June 2021. It also contains the Site’s cookie policy (section 10).
1. Data controller
The data controller is [[TO COMPLETE: legal name and form of the controller, e.g. “Rossi S.r.l.” or “Mario Rossi, sole trader”]], which runs Palazzo Marzocchi.
- Registered office: [[TO COMPLETE: registered office address]]
- VAT number / Tax code: [[TO COMPLETE: P.IVA and C.F.]]
- Property: Palazzo Marzocchi, Piazza Umberto I, 52035 Monterchi (AR), Italy
- Email: info@palazzomarzocchi.com
- Certified email (PEC): [[TO COMPLETE: PEC address]]
[[TO COMPLETE: has the controller appointed a Data Protection Officer (DPO)? If so, give their name and contact details; if not, delete this line.]]
2. What data we process
The Site is an informational showcase: it has no private areas, requires no registration, has no contact forms, booking or payment systems, and sends no newsletters.
2.1 Browsing data
Like any website, to show you its pages the systems hosting the Site automatically receive some technical data sent by your browser: IP address, date and time of the request, page requested, browser and operating system type, browser language and referring page. The browser language is also used to send you to the Italian or English version of the Site. These data are not used to identify you.
Every page also makes your browser download the Google Tag Manager script from Google’s servers (see section 5), so Google receives your IP address and technical information about your browser. Google Tag Manager itself sets no cookies and, without your consent, does not start any analytics tool.
2.2 Analytics data (only with your consent)
If you accept analytics cookies, the Site uses Google Analytics 4 to understand, in aggregate, how it is visited: pages viewed, length and sequence of the visit, interactions such as scrolling or clicks on external links, page language and type, device and browser type, and approximate location (city or region) derived from the IP address. Google Analytics links this information to a random identifier stored in a cookie, not to your name or other data that directly identify you. According to Google, Google Analytics 4 does not log or store IP addresses.
We have configured Google Analytics restrictively: Google Signals is off, data sharing with other Google products and services is off, and there is no link to any advertising service. The Site uses no profiling, advertising or remarketing cookies.
Without your consent, no data are sent to Google Analytics.
2.3 Data you send us
If you write to the email address shown on the Site, we process the data in your message (usually your name, email address and anything else you choose to tell us) in order to reply. Please do not send us special categories of data (such as health data) unless strictly necessary for your request.
2.4 Links to social networks
The Site may contain plain links to Palazzo Marzocchi’s Instagram and Facebook pages. They are not “like” buttons or embedded content: until you click them, no data are sent to Meta. If you click them, you leave the Site and Meta Platforms Ireland Limited’s privacy policy applies.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Showing you the Site in your language and keeping it working and secure | Browsing data | The controller’s legitimate interest in running a working, secure website (Art. 6(1)(f) GDPR) |
| Remembering your cookie choice | Technical cookie pm-consent |
Legal obligation to collect and respect consent (Art. 6(1)(c) GDPR); technical cookie exempt from consent (Art. 122 Privacy Code) |
| Aggregate statistics on how the Site is used | Analytics data, Google Analytics cookies | Your consent (Art. 6(1)(a) GDPR and Art. 122 Privacy Code), which you can withdraw at any time |
| Replying to your messages | Data you send us by email | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), such as an enquiry about a stay; for other messages, our legitimate interest in replying (Art. 6(1)(f) GDPR) |
| Protecting our rights, including in court, and meeting legal obligations | The data above, where necessary | Legitimate interest (Art. 6(1)(f) GDPR) and legal obligation (Art. 6(1)(c) GDPR) |
Browsing data are needed to visit the Site. Consent to analytics cookies is optional: if you refuse, the Site works exactly the same. Writing to us is optional, but without your contact details we cannot reply.
We make no decisions based solely on automated processing, including profiling (Art. 22 GDPR).
4. How we process data
Data are processed electronically, by people authorised and instructed by the controller, with technical and organisational measures appropriate to protect them against unauthorised access, loss or disclosure. The Site is served only over an encrypted connection (HTTPS).
5. Who we share data with
Data may be processed on the controller’s behalf by the following providers, appointed as processors under Art. 28 GDPR:
- Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA): hosting and delivery of the Site, protection against cyber attacks. Processes browsing data. Cloudflare’s privacy policy.
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), with its parent company Google LLC (USA): Google Tag Manager and, only with your consent, Google Analytics 4. Google’s privacy policy and how Google uses information from sites that use its services.
- [[TO COMPLETE: provider of the info@palazzomarzocchi.com mailbox, e.g. Google Workspace, Microsoft 365, Aruba, Register.it]]: email hosting.
- [[TO COMPLETE: name of the provider who develops and runs the Site]]: development, maintenance and technical management of the Site, including the Google Analytics setup.
Data may also be disclosed to the competent authorities where the law requires. We do not sell or hand over data to third parties for marketing, and we do not publish them.
The up-to-date list of processors is available on request at the address in section 1.
6. Transfers outside the European Union
Cloudflare, Inc. and Google LLC are based in the United States, so data may also be processed there. Both take part in the EU-U.S. Data Privacy Framework, which the European Commission found adequate in its decision of 10 July 2023 (Art. 45 GDPR): transfers rely on that decision, backed by the Commission’s standard contractual clauses (Art. 46 GDPR) in the providers’ contracts. You can check their participation on the official site, dataprivacyframework.gov.
7. How long we keep data
- Browsing data: only as long as needed to serve pages and keep the Site secure, according to the hosting provider’s technical timescales; the controller does not keep them.
- Cookie choice (
pm-consent): 180 days in your browser, after which you will be asked again. - Google Analytics data: 14 months, then deleted automatically; Google Analytics cookies expire after 2 years (see section 10).
- Email: as long as needed to handle your request and, if it leads to a relationship (such as a stay), for as long as legal and tax obligations require. [[TO COMPLETE: email retention period, e.g. “24 months from the last contact”]]
8. Your rights
At any time you can ask the controller, at the address in section 1, for:
- access to your data and a copy of them (Art. 15 GDPR);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure of your data (Art. 17);
- restriction of processing (Art. 18);
- portability of the data you gave us, in a structured, machine-readable format (Art. 20);
- to object to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21).
You can withdraw your consent to analytics cookies at any time, as easily as you gave it, with the “Cookie preferences” button (section 10). Withdrawal does not affect the lawfulness of processing carried out before it.
We will reply without undue delay and in any case within one month of your request, extendable by two months for complex requests (Art. 12 GDPR). Exercising your rights is free of charge.
9. Complaints to the supervisory authority
If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, Italy; garanteprivacy.it), or with the supervisory authority of the EU country where you live or work or where the alleged infringement took place (Art. 77 GDPR). You can also go to court (Art. 79 GDPR).
10. Cookie policy
Cookies are small text files that a website stores in your browser. The Site uses only the cookies listed below. It uses no profiling or advertising cookies.
Technical cookies
Needed for the Site to work; they do not require consent.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
pm-consent |
Palazzo Marzocchi (first party) | Stores your choice about analytics cookies (accepted or rejected), the date of the choice and the policy version, so the banner is not shown on every visit | 180 days |
Analytics cookies
Set only if you click “Accept” in the banner.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga |
Google (Google Analytics 4) | Tells visitors apart with a random identifier, to count visits in aggregate | 2 years |
_ga_5TPDYG36QC |
Google (Google Analytics 4) | Keeps the state of the visit session | 2 years |
Managing your consent
On your first visit a banner asks whether you accept analytics cookies, with two equal buttons, “Accept” and “Reject”. Until you choose, or if you reject, no analytics cookies are set and no data are sent to Google Analytics. If you leave without choosing, the banner will be shown again on your next visit.
You can change your mind at any time with the button below, or with the “Cookie preferences” link at the bottom of every page of the Site. If you withdraw consent, the _ga and _ga_5TPDYG36QC cookies are deleted from your browser.
You can also block or delete cookies in your browser settings (Chrome, Firefox, Safari, Edge) or install Google’s opt-out browser add-on for Google Analytics. If you block the technical cookie pm-consent, the Site cannot remember your choice and the banner will be shown on every visit.
11. Changes to this notice
We may update this notice, for example if the services used by the Site change. The date of the last update is shown at the top of the page. If the changes concern cookies that require consent, the banner will ask you to choose again.
The Italian version of this notice is the legally binding one; the English version is a courtesy translation.