Privacy Policy

1. Data controller

The Data Controller is Nuova Cernaia, VAT no. 12835530010, with registered office at Piazza dell’Annunziata, 12, 10078 Venaria Reale (TO), Italy (“Controller”, “we” or “us”).

To exercise rights under Regulation (EU) 2016/679 (“GDPR”) or for privacy-related requests, users may contact us via WhatsApp or in writing at the address above.

2. Scope

This notice describes the processing of personal data through the institutional and commercial website of Nuova Cernaia, including information pages, promotional landing pages and contact or B2B collaboration forms.

It does not apply to third-party websites reached through external links such as Google Maps, WhatsApp or social platforms, which operate under their own privacy notices.

3. Categories of personal data

Depending on how users interact with the website, we may process:

• Browsing data: IP address, technical logs, browser/device identifiers, visited pages, date and time, referral information, and aggregated or pseudonymised information produced by cookies and similar tools.
• Data provided voluntarily: name, surname, company or agency, email, phone number, number of guests, preferred date, messages and other information submitted through contact, group/tour operator or job application forms.
• Communication data: information contained in exchanges started by phone, WhatsApp or email in relation to reservations, information requests or business collaboration.
• Data generated by analytics and marketing cookies or pixels such as Google Analytics 4 and Meta Pixel, only after consent when required.

4. Purposes and legal bases

• Website operation and security: Article 6(1)(f) GDPR, legitimate interest in providing a secure and usable service.
• Responding to information, reservation or B2B collaboration requests: Article 6(1)(b) GDPR and, where applicable, Article 6(1)(f).
• Managing relationships with customers and commercial partners such as tour operators, guides and agencies: Article 6(1)(b) and (f) GDPR.
• Compliance with legal, accounting, tax and administrative obligations: Article 6(1)(c) GDPR.
• Traffic analytics and website improvement through Google Analytics 4: Article 6(1)(a) GDPR, consent, unless configured in a way that is legally exempt from consent.
• Advertising measurement, optimisation and remarketing through Meta Pixel: Article 6(1)(a) GDPR, consent.
• Establishing or defending legal claims: Article 6(1)(f) GDPR.

5. Provision of data

Technical browsing data is necessary to provide the website. Refusing analytics or marketing cookies does not prevent normal browsing but limits measurement and personalised advertising activities.

Providing information through forms or chats is optional, but essential information is required in order for us to respond to the request.

6. Recipients and processors

Personal data may be shared, where necessary, with hosting and maintenance providers, communication service providers such as WhatsApp/Meta Platforms, analytics and advertising providers such as Google and Meta, professional advisers and public authorities when required by law.

Where these providers process personal data on our behalf, they act as processors under Article 28 GDPR or as independent controllers according to their respective notices.

7. International transfers

Some providers, particularly Google and Meta, may process data outside the European Economic Area. Where applicable, transfers are based on adequacy decisions, Standard Contractual Clauses and/or additional safeguards in accordance with the providers’ documentation.

8. Retention periods

• Technical and security logs: normally up to 12 months unless longer retention is required for legal defence.
• Contact, group and information requests: normally up to 24 months after closure of the request unless a continuing business relationship exists.
• Reservation and customer relationship data: in accordance with applicable civil and tax retention periods.
• Analytics and marketing data: according to the retention settings described in the Cookie Policy and consent preferences.
• Where a dispute exists, necessary information may be retained until the matter has been resolved.

9. Data subject rights

Under Articles 15–22 GDPR, data subjects may request access, rectification, erasure, restriction, portability where applicable, objection to processing based on legitimate interests, and withdrawal of consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Requests may be sent through the channels described in section 1. Data subjects may also lodge a complaint with the competent supervisory authority.

10. Children

The website is not directed at children under 14 and does not knowingly collect personal data from children. If inappropriate collection becomes known, the Controller will delete the information where technically and legally possible.

11. Cookies and tracking technologies

For detailed information about cookies, pixels and consent management, please refer to the Cookie Policy, which forms an integral part of this notice.

12. Updates

This privacy notice may be updated to reflect legal, organisational or technical changes. The date of the latest update is shown at the top of the page.