Privacy policy

PRIVACY STATEMENT pursuant to art. 13, Reg. (EU) no. 2016/679

Dear Customer,
For the purpose of establishing a contractual relationship concerning property sales, leases and holiday rentals, as controller of your personal data, we hereby provide the following information pursuant to and for the purposes of art. 13 of Regulation (EU) 2016/679, as well as the relevant Italian legislation in force.

The data controller is BOTTEGA IMMOBILIARE SRL, registered office at no. 41 Piazza Dei Frutti, 35122 PADOVA - Telephone 049 8764936, email: info@bottegaimmobiliare.com (hereinafter “data controller” or “company”).

Mandatory purposes of processing for which your consent is not required

Purposes Lawfulness of processing
Managing the archiving and storage of data, sending information and communications, including electronic, requested by you also via the company's website, sending documents concerning your relationship with the company for the finalization and management of property sales;
finalization and management of property leases, including for short periods, finalization and management of lettings for holiday properties
(Article 6, paragraph 1, letter c), GDPR)
Processing is necessary for compliance with a legal obligation to which the controller is subject.
(Article 6, paragraph 1, letter f), GDPR)
Processing is necessary for the purposes of the legitimate interests pursued by the controller relating to management and administration of its organisation.

Optional purposes of processing for which your consent is required

Purposes Lawfulness of processing
Promotional and marketing activities with the supply of material and information on new products, promotions, discounts, concessions and other services of interest to you pertaining to your business, including sending specific material in printed and/or electronic form, via newsletters (email, SMS, MMS, instant messaging); sending information and news about the company and its business via newsletters (email, SMS, MMS, instant messaging);
invitations to events organised or sponsored by the company;
carrying out market surveys and/or customer satisfaction surveys. (Article 6, paragraph 1, letter a), GDPR) Data subject’s consent

Recipients of personal data
To achieve the aforementioned purposes, your personal data may be disclosed to:
 employees and/or associates of the data controller, duly appointed as authorised parties and instructed on how to process such data;
 third parties other than the data controller, such as:
Third parties or categories Purposes Notes
IT companies. Management, maintenance, updating of systems and software used by the data controller. Appointment as data processor (article 28, GDPR).
Providers of networks, electronic communications services and IT and network-based services for archiving, storing and managing data using information technology. Hosting, housing, cloud, SaaS and other remote computer services essential for completion of the data controller’s activities; archiving and storage services in accordance with laws on electronic documents Appointment as data processor (article 28, GDPR).
Cloud services may process data in non-EU countries, however which guarantee appropriate confidentiality rights.
Consultants, professionals, law firms, arbitrators, insurance companies, appraisers, brokers, accountants. Judicial, extra-judicial activities, insurance in the event of claims.
Organisational, administrative, financial and accounting management Appointment as data processor (article 28, GDPR).
Websites for managing and booking temporary accommodation. Performance of specific contracts. Third-party data processors.

The third parties to whom your personal data may be disclosed act as:
 data controllers, i.e. subjects that determine the purposes and methods of processing personal data;
 data processors, i.e. subjects that process personal data on behalf of the data controller.
The list and updated information of the subjects identified as data controllers or processors is available from the data controller.

Data storage period
The personal data storage period is specified below; where this is not possible, the criteria used to determine the period are shown.

Personal data and documents Storage period or criteria to determine it
Personal data and documents concerning the relationship with the company. For the duration needed to fulfil the purposes of the processing, as well as subsequently, within the limits permitted by law, for administrative and accounting purposes, as well as to exercise or protect the rights of the data controller, where necessary.

Rights of the data subject
Pursuant to the GDPR, you have a number of rights regarding your personal data and the related processing that you may exercise by contacting the data controller.

Right Description How to exercise this right
Right to withdraw consent
(article 13, paragraph 2, letter c) You have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before such withdrawal. Forms on the website or available from the data controller.
Right of access to data
(article 15) You may request the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You have the right to obtain a copy of the personal data being processed. Forms on the website or available from the data controller.
Right to rectification (article 16) You have the right to obtain the rectification of inaccurate personal data and the right to have incomplete personal data completed. Forms on the website or available from the data controller.
Right to erasure (article 17) You have the right to obtain from the data controller the erasure of your personal data if such personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed. Forms on the website or available from the data controller.
Right to restriction of processing
(article 18) You have the right to obtain restriction of processing from the data controller when you have contested the accuracy of the personal data (for a period enabling the controller to verify the accuracy of the personal data), or if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead, or if the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, Forms on the website or available from the data controller.


exercise or defence of legal rights.
Right to portability
(article 20) You have the right to receive your personal data concerning you in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where the processing: (i) is based on consent, (ii) on the contract and (iii) if the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and that such transmission does not adversely affect the rights and freedoms of others. Forms on the website or available from the data controller.
Right to object (article 21) You have the right at any time to object, in whole or in part, to the processing of your personal data, unless the controller demonstrates compelling legitimate grounds for the processing, if the data are processed for direct marketing purposes. Forms on the website or available from the data controller.
Right to lodge a complaint with a supervisory authority
(article 77) You have the right to lodge a complaint with a supervisory authority if you believe that the data are processed in infringement of the GDPR. Forms on the Data Protection Authority’s website

The exercising of the aforementioned rights is subject to the limits, rules and procedures specified in the GDPR and that the data subject must be aware of and implement. In accordance with the provisions of article 12, paragraph 3, moreover, the data controller shall provide the data subject with information on action taken without undue delay and, in any case, within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and the number of requests. The data controller shall inform the data subject party any such extension within one month of receipt of the request, together with the reasons for the delay.

Changes and updates
This information may be subject to changes and/or additions, including as a consequence of the applicability of the GDPR and any future regulatory amendments and/or updates.
The updated information is constantly available on the data controller’s website.

**********

The personal data provided may be processed by the data controller with and without the aid of computer systems.

We also inform you that the provision of your personal data for the mandatory purposes specified herein is a legal or contractual obligation or a binding requirement for the performance of the contractual obligations, and therefore you are required to provide such personal data, as failure to do so will mean that the relationship with the company cannot be managed.