This Privacy Policy describes how the personal data of users who browse this website and use the contact form are processed, in accordance with Regulation (EU) 2016/679 (hereinafter referred to as the "GDPR").
1. Data Controller
The Data Controller is:
Villa Montalto s.r.l.
Via Francesco Benaglia, 13
00153 Rome, Italy
VAT No.: 12569351005
Share Capital: €10,000 fully paid-up
Email:
2. Types of Data Collected
This website processes the following categories of personal data:
- Browsing data: During normal operation, the IT systems and software procedures used to operate this website automatically acquire certain data whose transmission is implicit in the use of Internet communication protocols (such as IP addresses, browser type, operating system, and pages visited). Such data may be processed in an aggregated and anonymous form for statistical purposes through traffic analysis tools (analytics).
- Data voluntarily provided by the user: Personal data (such as name, email address, and the content of the message) voluntarily provided by users when completing the contact/report form available on the website.
3. Purpose of the Processing
The personal data provided through the contact form are processed exclusively for the following purpose:
- To respond to requests, reports, and inquiries submitted by the user.
The data provided through the contact form are not used for newsletter subscriptions, marketing communications, or inclusion in mailing lists. They are used solely to respond to the user's request.
4. Legal Basis for Processing
The legal basis for processing personal data submitted through the contact form is the handling of a specific request made by the user (performance of pre-contractual measures or the Controller's legitimate interest in responding). For browsing data collected through analytics tools, the legal basis is the Controller's legitimate interest or, where required by law, the user's consent.
5. Processing Methods
Personal data are processed using electronic and IT tools, with appropriate security measures in place to ensure confidentiality and prevent unauthorized access, loss, or unlawful processing.
6. Data Retention Period
Personal data provided through the contact form are retained only for the time necessary to process the request and manage any related follow-up communications, after which they are deleted unless a longer retention period is required by law.
7. Disclosure and Sharing of Data
Personal data are not disclosed to the public. They may be processed by authorized personnel or by technical service providers (such as hosting providers or analytics service providers), who may be appointed as Data Processors where required.
8. Data Subject Rights
Users have the right, at any time, to exercise the rights provided for in Articles 15 to 22 of the GDPR, including the right to:
- Access their personal data;
- Request the correction or deletion of their personal data;
- Request restriction of processing;
- Object to the processing;
- Request data portability;
- Lodge a complaint with the competent Data Protection Authority.
To exercise these rights, users may contact the Controller at:
9. Changes to this Privacy Policy
The Data Controller reserves the right to amend or update this Privacy Policy, including as a result of changes to applicable legislation. Any updates will be published on this page.
Last updated: June 30, 2026
