Privacy Policy

1. Data Controller

Cica Srl, as the Data Controller, informs you that your personal data will be processed in the manner and for the purposes described below.

2. Data Protection Officer (DPO)

3. Personal Data Collected

The personal data we may collect include:

• Browsing data: IP address, browser type, operating system, pages visited, duration of visit
• Data provided voluntarily: First name, last name, email, phone number (via contact or booking forms)
• Data derived from cookies: Preferences, browsing behavior, interactions with the website

4. Purpose of Processing

Your personal data are processed for the following purposes:

a) Necessary purposes (without consent)

• Responding to information and contact requests
• Managing bookings
• Complying with legal, accounting, and tax obligations
• Ensuring website security and proper functionality

Legal basis: Performance of pre-contractual measures (Art. 6.1.b GDPR), Legal obligation (Art. 6.1.c GDPR), Legitimate interest (Art. 6.1.f GDPR)

b) Purposes requiring consent

• Sending commercial and promotional communications
• Newsletters with offers and updates
• Statistical analysis of user behavior via Google Analytics
• Personalized advertising through Facebook Pixel

Legal basis: Explicit consent of the data subject (Art. 6.1.a GDPR)

5. Processing Methods

The processing of personal data is carried out using electronic and telematic tools, with organizational methods and logic strictly related to the stated purposes.

Data are processed with appropriate security measures aimed at ensuring:

• Confidentiality and protection of data
• Integrity and availability of information
• Resilience of processing systems

6. Data Recipients

Your personal data may be disclosed to:

• Authorized personnel: Employees and collaborators of Cica Srl specifically authorized and trained
• Service providers: Hosting providers, email marketing services, analytics services (Google, Facebook)
• Public authorities: Upon request, to comply with legal obligations

Your data will not be shared or sold to third parties for commercial purposes without your explicit consent.

7. Data Transfer

Your personal data are stored within the European Union. Some services used (Google Analytics, Facebook Pixel) may transfer data outside the EU, ensuring adequate protection measures in compliance with the GDPR.

8. Data Retention Period

Personal data will be retained for as long as necessary to fulfill the purposes for which they were collected:

• Contractual data: 10 years (for tax and accounting obligations)
• Contact data: Until consent is withdrawn or deletion is requested
• Browsing data: Maximum 26 months (Google Analytics)
• Profiling cookies: Maximum 12 months

9. Your Rights (Art. 15-22 GDPR)

You may exercise the following rights at any time:

• Right of access (Art. 15): Obtain confirmation as to whether or not your data are being processed and access such data
• Right to rectification (Art. 16): Obtain the correction of inaccurate data
• Right to erasure (Art. 17): Request the deletion of your data (“right to be forgotten”)
• Right to restriction (Art. 18): Request restriction of processing
• Right to data portability (Art. 20): Receive your data in a structured format
• Right to object (Art. 21): Object to the processing of your personal data
• Right to withdraw consent: Withdraw your consent at any time

10. Right to Lodge a Complaint

You have the right to lodge a complaint with the Data Protection Authority:

11. Cookies and Tracking Technologies

Our website uses technical, analytical, and profiling cookies. For more information, please refer to our Cookie Policy.

12. Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Any changes will be published on this page, indicating the date of the latest update.

We encourage you to periodically review this page to stay informed.