Information on the processing of personal data pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)
Last updated: 25 September 2026
This Privacy Policy describes how the personal data of users who visit the Tuscany Property Experts website and use the contact services available through the website are processed.
The Data Controller is:
Daniel Loris Bottaini
Viale Nazionale, 72
55025 Ghivizzano – Lucca
Italy
Email: daniel.bottaini@gmail.com
Certified Email (PEC): bottaini.daniel@pec.architettilucca.it
During normal browsing, the IT systems and software procedures used to operate the website may collect certain data whose transmission is inherent in the use of Internet communication protocols.
This may include, for example, IP addresses, the type of browser and device used, the operating system, the time of requests and other parameters relating to the user’s IT environment.
This information is processed to ensure the proper functioning and security of the website and, where necessary, to establish responsibility in the event of unlawful or malicious activities involving the website or its IT systems.
When users voluntarily submit a request through the contact form available on the website, the data entered in the form, together with any additional information included in the message, are collected.
The data requested through the contact form are used exclusively to receive and manage the user’s request and provide an appropriate response.
Users are advised not to include personal data that are not necessary for handling their request, particularly information belonging to special categories of personal data pursuant to Article 9 of the GDPR.
When users voluntarily send communications to the email addresses provided on the website, the sender’s email address and any other personal data included in the communication are also collected.
Personal data may be processed for the following purposes.
Data provided by users are used to respond to requests for information, enquiries regarding the services offered or other communications submitted through the website or by email.
The legal basis for this processing is the performance of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) of the GDPR.
Technical data generated while browsing may be processed to ensure the proper operation, security and integrity of the website and its IT systems.
The legal basis for this processing is the legitimate interest of the Data Controller in ensuring the security and proper functioning of the website, pursuant to Article 6(1)(f) of the GDPR.
Personal data may be processed where necessary to comply with obligations imposed by applicable law.
The legal basis for this processing is compliance with a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) of the GDPR.
Providing personal data through the contact form is voluntary.
However, failure to provide data indicated as necessary may prevent the user from submitting a request or make it impossible for the Data Controller to provide a response.
Personal data are processed using IT and electronic systems and, where necessary, by manual means.
Processing is carried out using technical and organisational measures appropriate to the level of risk and designed to protect personal data against unauthorised access, loss, destruction, disclosure or unauthorised alteration.
Personal data are processed by the Data Controller and by any authorised persons within the scope of their respective duties.
For purposes strictly related to the operation of the website and the management of communications, certain data may also be processed by Aruba S.p.A., as the provider of hosting and email services and, where applicable, as a Data Processor pursuant to Article 28 of the GDPR.
Personal data may also be disclosed to public authorities or other public bodies where required by law.
Personal data are not disseminated to the public.
Data processed through the website and its related technical services are managed using services provided by Aruba S.p.A.
Should the services used involve the transfer of personal data to countries outside the European Economic Area (EEA), such transfers will be carried out in accordance with Articles 44 et seq. of the GDPR and the safeguards required by applicable legislation.
The introduction of any additional services involving transfers of personal data outside the EEA will be assessed to determine whether this Privacy Policy needs to be updated.
Personal data are retained for no longer than necessary to fulfil the purposes for which they were collected.
In particular, data submitted through the contact form or by email are retained for the time necessary to manage and respond to the request. Where the communication results in a professional or contractual relationship, the data may be retained for any additional periods required by applicable legislation.
Personal data may be retained for a longer period where necessary to comply with legal obligations or for the establishment, exercise or defence of legal claims.
The website does not currently use profiling cookies, advertising cookies or analytics cookies.
Should services requiring the use of cookies or similar technologies be introduced in the future, users will be informed accordingly and, where required by applicable law, their prior consent will be requested.
The website may contain links to websites or services operated by third parties.
The Data Controller does not control how such third parties process users’ personal data. Users are therefore advised to review the relevant privacy policies before using external services or providing personal data through third-party websites.
Where provided for by the GDPR, data subjects may exercise the rights set out in Articles 15–22 of the Regulation and, in particular, may request:
Where processing is based on consent, the data subject also has the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
To exercise these rights, data subjects may contact the Data Controller using the contact details provided in this Privacy Policy.
Data subjects who believe that the processing of their personal data infringes the GDPR have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) in accordance with the procedures established by the Authority.
This is without prejudice to any other administrative or judicial remedies available under applicable law.
This Privacy Policy may be updated from time to time, including as a result of changes to the services provided through the website, the technologies used or applicable legislation.
Users are therefore advised to review this page periodically.