Privacy Policy

This Privacy Policy describes how SUBLIME Ventures di Riccardo Ongaro processes personal data collected through the website www.jesolobeach.com(hereinafter, the “Site”), in compliance with EU Regulation 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Codice Privacy”) as amended by Legislative Decree 101/2018, as well as with the Guidelines of the Italian Data Protection Authority (Garante) of 10 June 2021 on cookies.

1. Data Controller

The Data Controller is:

• SUBLIME Ventures di Riccardo Ongaro — self-employed professional
• Registered office: Via Sant’Agostino 36, 31100 Treviso (TV), Italia
• VAT no.: 04840530275
• Email: ciao@jesolobeach.com
• PEC (certified email): r.ongaro@pec.it

No Data Protection Officer (DPO) has been appointed, as the conditions set out in Art. 37 GDPR do not apply. For any request relating to data protection, you may contact the Data Controller directly at the addresses above.

2. Categories of data collected

The Site processes only the following categories of personal data:

• Contact data provided voluntarily via the forms: first name, last name, email address, phone number, company name, message content.
• Navigation data: IP addresses, browser user-agent, pages viewed, date/time of access, technical security logs.
• Aggregated statistical data: interactions with the Site collected through PostHog in pseudonymised form, only if you have given the relevant consent.

The Site does not process special categories of personal data (Art. 9 GDPR), nor data relating to criminal convictions (Art. 10 GDPR). It is not directed at children under 14 and does not knowingly collect data relating to such individuals (Art. 2-quinquies Codice Privacy).

3. Purposes, legal bases and retention periods

4. Nature of data provision

Providing the data requested by the forms is optional; however, failure to provide the fields marked as mandatory will make it impossible to act on your request. Consent to statistical cookies and to the forwarding of data to partners is always optional and does not affect access to the content of the Site.

5. Recipients of the data — providers and partners

Personal data are processed by the Data Controller and by duly authorised personnel. They may be communicated to the following Data Processors (Art. 28 GDPR), who process them on behalf of the Data Controller under a specific agreement (DPA):

Data collected through the “House of the Week” form are also transmitted, subject to your explicit and specific consent, to the partner real-estate agency indicated on the property listing. That agency acts as an independent Data Controllerfor the processing subsequent to the forwarding: to exercise your rights against the agency you must contact it directly, using the details shown in the form before confirmation.

6. Transfers outside the EU

The provider Resend Inc. (email service) is located in the United States. The transfer takes place in accordance with Art. 45 and 46 GDPR, based on:

• participation in the EU-U.S. Data Privacy Framework (EU adequacy decision of 10/07/2023);
• execution of the Standard Contractual Clauses approved by the EU Commission;
• supplementary technical and organisational measures (encryption in transit and at rest).

Cloudinary, where content is served from non-EU regions, applies the same safeguards through SCCs and participation in the DPF.

7. Cookies and similar technologies

The Site uses technical cookies (always active) and, only with your consent, pseudonymised statistical cookies. Full details, the consent options and the list of cookies are described in our Cookie Policy. You can change your choice at any time by clicking Cookie preferences.

8. Rights of the data subject

Under Art. 15-22 GDPR you have the right to:

• access your personal data and obtain a copy;
• rectify inaccurate data or complete incomplete data;
• erase the data (“right to be forgotten”) in the cases provided for;
• restrict the processing;
• object to processing based on legitimate interest;
• receive the data in a structured and readable format (data portability);
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• not be subjected to automated decisions (the Site does not carry out automated profiling or automated decision-making).

To exercise these rights, write to ciao@jesolobeach.com or via PEC to r.ongaro@pec.it. We will reply within 30 days (extendable by a further 60 days in particularly complex cases, under Art. 12.3 GDPR).

9. Right to lodge a complaint

You always have the right to lodge a complaint with the competent supervisory authority. In Italy the authority is the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (Piazza Venezia 11, 00187 Rome — www.gpdp.it).

10. Changes to this Policy

The Data Controller reserves the right to amend this Policy to reflect regulatory or service developments. The date of the latest update is always shown at the top of the document. For substantial changes, a new consent will be requested where necessary.