Privacy Policy

This notice is provided pursuant to articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") to all users interacting with the villarussiz.it website and the services offered by Fondazione Villa Russiz.

1. Data Controller

Fondazione Villa Russiz, Via Russiz 4/6, 34070 Capriva del Friuli (GO), Italy. E-mail: villarussiz@villarussiz.it — Certified e-mail (PEC): fondazionevillarussiz@pec.it.

2. Data Protection Officer

The Foundation has appointed a Data Protection Officer, who can be contacted at dpo@villarussiz.it. More information is available on the DPO.

3. Categories of data processed

• Contact data (first name, last name, e-mail, phone number) provided through the contact form, event enquiries, restaurant and country house bookings.
• Browsing data (IP address, user-agent, pages visited) collected in aggregate form for statistical and security purposes.
• Data relating to e-commerce orders (shipping and billing addresses, payment data managed by PCI-DSS certified providers).
• Data possibly sent through unsolicited job applications or reports.

4. Purposes and legal basis

• Responding to information requests, bookings and enquiries — art. 6.1(b) GDPR (pre-contractual measures) and (f) (legitimate interest).
• Managing orders, contracts and tax obligations — art. 6.1(b) and (c) GDPR.
• Sending commercial communications and newsletters — art. 6.1(a) GDPR (consent).
• Compliance with legal obligations — art. 6.1(c) GDPR.
• Defence in legal proceedings and system security — art. 6.1(f) GDPR.

5. Recipients

Data may be shared with parties acting as Data Processors (art. 28 GDPR): hosting providers, booking engine operators, payment providers, couriers, tax and legal consultants, and IT service providers. Data is not otherwise disclosed.

6. Transfers outside the EU

Some providers may process data outside the European Economic Area. In such cases, the transfer is based on adequacy decisions or Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Retention

Data is retained for the time strictly necessary for the purposes for which it was collected and, in any case, in compliance with legal deadlines (e.g. 10 years for tax documentation). Promotional communications are sent until consent is withdrawn.

8. Data subject rights

Data subjects may exercise at any time the rights set out in articles 15-22 GDPR (access, rectification, erasure, restriction, portability, objection, withdrawal of consent) by writing to dpo@villarussiz.it. A complaint may also be lodged with the Italian Data Protection Authority (www.garanteprivacy.it).

9. Cookies

For the use of cookies and tracking technologies, please refer to the Cookie Policy.