Privacy Policy

Data controller

The data controller is Rocca d'Italia S.r.l., Strada di Castellina in Chianti 28, 53100 Siena (SI), Italy, VAT no. 01613940525.

For any request regarding the processing of your data, you can write to amministrazione@roccaditalia.it.

What data we collect

We process information provided through forms and technical data needed to deliver the service. Only after you accept do we also enable Google Analytics and Microsoft Clarity to measure and understand use of the website.

• Identity and contact data: first name, last name, email address, phone number.
• Request details: experience or event of interest, number of participants, preferred dates, messages and notes.
• Any uploaded files: CV (job applications), photographs of a vehicle (car exhibitor application), photographs (photo contest).
• Browsing data: IP address, browser type and server logs, collected automatically by the hosting provider for technical and security purposes.
• With analytics consent: pages visited, interactions, technical device information and online identifiers. The website’s custom events do not include names, email addresses, phone numbers or messages entered in forms.
• With analytics consent, through Microsoft Clarity: pointer movements, clicks, scrolling and the layout of the pages visited, used for heatmaps and session recordings, together with a pseudonymous identifier and technical device information.
• For Giardino dell’Eden voting: a random device identifier and votes cast, used to manage voting limits.

Required information and optional choices

Fields marked as required are needed to handle your request; without them we cannot complete that service. Additional notes, marketing and analytics choices are optional. Acknowledging the privacy notice does not constitute marketing consent. Submitting an experience or tailor-made travel request does not confirm a booking.

Why we process data and on what legal basis

• To respond to information, contact and booking requests (performance of pre-contractual and contractual measures — Art. 6.1.b GDPR).
• To manage job applications and event applications (pre-contractual measures and, where applicable, consent — Art. 6.1.b and 6.1.a).
• To manage participation in contests and initiatives, according to the relevant rules.
• To comply with legal, accounting and tax obligations (Art. 6.1.c).
• To send promotional communications, only with your free and revocable consent (Art. 6.1.a).
• To measure visits and interactions using Google Analytics, and to understand how pages are used through Microsoft Clarity (heatmaps and session recordings), based on optional, revocable consent (Art. 6.1.a GDPR).
• To maintain website operation and security and manage voting limits, based on the legitimate interest in operating and protecting the service (Art. 6.1.f GDPR).

Who we share data with

Data is accessible to staff handling requests and to technology providers needed to deliver the service. Promotional communications require consent separate from the service request. Providers used by the website include:

• Vercel Inc. — website hosting and storage of uploaded files;
• Resend (Plus Five Five, Inc.) — sending internal notification and confirmation emails;
• Google — spreadsheets for managing experience requests, event registrations and activities; Google Analytics 4 for website measurement after consent;
• Microsoft Corporation — Microsoft Clarity, for heatmaps and session recordings after consent.

Some of these providers may process data outside the European Union: in that case the transfer takes place on the basis of appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission.

How long we keep data

We retain requests and correspondence for the time needed to handle the enquiry, prepare a quotation and deliver any agreed service; further retention depends on applicable obligations and the need to protect legal rights. Applications and event materials are retained to manage selection or the initiative and related disputes. Marketing consent may be withdrawn at any time; withdrawal stops subsequent promotional messages.

Browser cookie lifetime differs from retention of data already transmitted to Google Analytics and Microsoft Clarity. Withdrawal stops future measurement but does not automatically erase historical data. For information about applicable retention periods and requests concerning your data, contact amministrazione@roccaditalia.it.

Your rights

As a data subject, you may exercise at any time the rights set out in Articles 15-22 of the GDPR:

• access to your data and its rectification or update;
• erasure of data and restriction of processing;
• data portability;
• objection to processing and withdrawal of consent, at any time.

To exercise your rights, write to amministrazione@roccaditalia.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Cookies

The website uses cookies and local storage for necessary functions and preferences. Google Analytics and Microsoft Clarity are enabled only after acceptance. You can change or withdraw your choice through Cookie preferences in the footer; declining does not prevent browsing or submitting requests. See the Cookie Policy for details.

Changes to this notice

We reserve the right to update this notice. The updated version will always be published on this page with the relevant last-updated date.