Privacy Policy

Data Controller

The controller of personal data processing is:

• Company name: Ci.ti.elle S.r.l.
• Registered office: Corso Giovanni Agnelli 42, 10137 Turin (TO)
• Operating office: Strada degli Scavi 21, 10090 Castiglione Torinese (TO)
• VAT number: 06297820018 — Tax code: 08791390159
• Phone: +39 011 9813131
• Email: info@citielle.com

To exercise the rights described below, or for any request relating to data processing, the data subject may contact the Controller at any of the contact details indicated above.

Introduction

Pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR), in relation to the personal data concerning the user that will be subject to processing, Ci.ti.elle guarantees that the processing takes place in compliance with the fundamental rights and freedoms, as well as the dignity of the data subject, with particular reference to confidentiality, personal identity and data protection.

This notice is provided exclusively for the website citielle.com and not for any other websites that may be accessed via links, for which Ci.ti.elle bears no responsibility whatsoever. This document fully replaces any previously published version.

Specific notices

Further additional and contextual notices are provided on the pages of the site set up for specific services that include forms for data collection.

Types of data processed

Personal data may be collected automatically during browsing, or entered voluntarily by the user. These include, by way of example and not limitation: identification data via cookies and similar technologies, usage and browsing data, first name, last name, email address, phone number, and other data voluntarily entered in the site’s contact forms.

The site does not, as a rule, collect special categories of personal data (Art. 9 GDPR, e.g. health data, biometric data, data concerning sex life or ethnic origin). Should the user choose to voluntarily disclose such data through the contact forms, it will be processed solely to respond to the request and with the data subject’s explicit consent.

Browsing data and other data

The computer systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols (IP addresses, URIs of the requested resources, time of the request, HTTP method used, size of the response, server status code, and parameters relating to the user’s operating system and computer environment).

This data is used solely to derive anonymous statistical information on the use of the site and to verify its correct functioning, and is retained for the time strictly necessary for these purposes. It could be used to establish liability in the event of hypothetical computer crimes, at the request of the competent Authorities.

Personal data voluntarily provided by the user

At various points on the site, the user may voluntarily transmit their personal data (e.g. via contact forms or by sending emails). This is provided on an optional and explicit basis and involves the acquisition of the sender’s email address, necessary to respond to requests, and of any other data entered for the purposes of the service.

The user assumes responsibility for any third-party personal data published or shared through the site, guaranteeing they have the right to do so and releasing the Controller from any liability towards third parties.

Legal basis for processing

The legal bases for processing, pursuant to Art. 6 GDPR, are:

• the data subject’s consent (Art. 6.1.a), for the use of non-technical cookies or for marketing purposes;
• the performance of pre-contractual measures requested by the user or of a contract to which the user is a party (Art. 6.1.b), for example in response to a request for a quote or commercial information;
• compliance with legal obligations to which the Controller is subject (Art. 6.1.c), for example in the tax and administrative-accounting field;
• the Controller’s legitimate interest (Art. 6.1.f), limited to the site’s IT security and aggregate statistical analysis, when the data subject’s fundamental rights and freedoms do not prevail.

Purposes of processing

Data is collected and processed for the following purposes:

• browsing and use of the site and its content;
• management of contact and information requests sent through the site’s forms;
• collection and retention of data for statistical analysis, including in anonymous or aggregate form, on the use of the site;
• fulfillment of contractual, accounting and tax obligations connected with Ci.ti.elle’s business activity.

Subject to explicit consent, when required, the data may also be processed for further purposes such as: sending commercial communications and newsletters, interaction with social networks and external platforms, display of content from external platforms (e.g. interactive maps), and management of support and assistance requests.

Transfer of data outside the European Economic Area

Certain third-party services used by the site (in particular Google Analytics and Google Maps, both provided by companies of the Google group) involve the transfer of some data to servers located in the United States.

Such transfers take place to providers certified under the EU-US Data Privacy Framework, adopted by the European Commission with an adequacy decision of July 10, 2023, which recognizes a level of protection of personal data substantially equivalent to that guaranteed in the European Union for US companies participating in the framework, including Google LLC.

In the absence of a provider’s adherence to the Data Privacy Framework, or should this legal framework be modified or invalidated, the Controller will adopt the alternative safeguards provided for by the GDPR (e.g. Standard Contractual Clauses approved by the European Commission) before proceeding with the data transfer.

Nature of data provision and consent management

Providing data is optional, except for data indicated as mandatory for access to certain services (for example, responding to a request via the contact form, which necessarily requires a valid email address). Failure to provide the necessary data may limit or prevent the provision of the requested service.

Regarding cookies, further information is available in the Cookie Policy published on the site, also accessible from the consent management banner.

Only with the user’s express consent may the data be used for communications relating to market research or commercial information on the Controller’s products and promotional initiatives, via postal mail, email, telemarketing, SMS/MMS. The user may withdraw their consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Processing methods and security measures

The processing of personal data may take place with or without the aid of electronic tools, including through cookies, and in compliance with technical and organizational security measures adequate to guarantee its confidentiality and integrity, pursuant to Art. 32 GDPR, for the time necessary to carry out the requested service or as provided for by the purposes described.

Ci.ti.elle adopts IT security measures that are periodically updated based on the evolution of risks, in order to minimize the risk of unauthorized access, loss, destruction or disclosure of data.

Retention periods

Personal data is processed for the time strictly necessary to achieve the purposes described above:

• anonymous/aggregate browsing data is retained for the time necessary for statistical purposes, generally not exceeding 26 months (in line with the standard settings of Google Analytics 4);
• data provided via the contact form is retained for the time necessary to handle the request and for the following 12 months, unless otherwise agreed commercially or required by law;
• data collected for direct marketing purposes, subject to consent, is retained for a maximum of 24 months from collection, unless consent is withdrawn earlier;
• data subject to contractual, accounting and tax obligations is retained for the periods provided for by applicable law (generally 10 years pursuant to Art. 2220 of the Italian Civil Code).

Categories of data recipients

Data may be disclosed, within the limits strictly necessary for their respective purposes, to the following categories of recipients:

• website hosting and maintenance service providers, appointed as Data Processors pursuant to Art. 28 GDPR;
• Google LLC / Google Ireland Limited, for the Google Analytics and Google Maps services integrated into the site;
• consultants and freelance professionals (e.g. accountant, lawyer) within the limits necessary for carrying out their assignment;
• public and private entities that access the data by virtue of legal, regulatory or EU provisions (e.g. tax authorities, law enforcement upon justified request).

The updated list of appointed Data Processors may be requested by contacting the Controller at the contact details indicated at the beginning of this document. Data is not disclosed to unspecified parties, except with specific free and informed consent for each type of processing.

Defense in legal proceedings

Personal data may be used by the Controller for defense in legal proceedings, or in the preparatory stages of any such proceedings, arising from abuse in the use of the site or related services. The user acknowledges that the Controller may be required to disclose data at the request of public authorities.

Data Protection Officer (DPO)

Ci.ti.elle has not appointed a Data Protection Officer (DPO), as the conditions set out in Art. 37 GDPR do not apply: the Controller’s activity does not involve large-scale processing of special categories of data, nor does it involve, as a core activity, regular and systematic monitoring of data subjects on a large scale.

This assessment may be reviewed should the methods or scope of the processing carried out change; in such a case, the contact details of any appointed DPO will be published in this section.

Rights of the data subject

Data subjects may exercise the following rights at any time, pursuant to Arts. 15-22 GDPR:

• right of access: obtain confirmation as to whether or not personal data concerning them exists, and access it;
• right of rectification: request correction or updating if the data is incomplete or inaccurate;
• right to erasure (“right to be forgotten”): request deletion, within the limits provided by law;
• right to restriction of processing;
• right to data portability, where applicable;
• right to object to processing on legitimate grounds, including in relation to automated decision-making processes (including profiling);
• right to object to processing for marketing purposes, even only partially (e.g. limited to specific channels such as SMS, email or phone);
• right to withdraw consent given, at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, the data subject may contact the Controller by written communication to the registered office or to the email address info@citielle.com. The Controller will respond to the request without undue delay and, in any case, within one month of receiving it, as provided for by Art. 12 GDPR.

The data subject also always has the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it), should they believe that the processing of their data violates applicable law.

Application and changes to this notice

The Controller reserves the right to make changes to this privacy policy at any time, publishing them on the site. Users are advised to periodically check this page, referring to the last update date indicated at the beginning. In the event of non-acceptance of the changes, the user must stop using this site and may request the removal of their personal data.

Notice last updated on July 6, 2026.