Privacy Policy

I. INFORMATION REGARDING THE WEBSITE’S PRIVACY POLICY

This section contains information regarding the management of www.malvarosa.it with reference to the processing of users’ personal data.

This notice is provided pursuant to Article 13 of EU Regulation No. 2016/679 (GDPR), concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data, for individuals interacting with www.malvarosa.it, accessible at the homepage: https://www.malvarosa.it/.

This notice is provided solely for www.malvarosa.it and not for any other websites that the user may consult via links contained therein.

The purpose of this document is to provide information regarding the methods, timing, and nature of the information that Data Controllers must provide to users when connecting to the web pages of www.malvarosa.it, regardless of the purpose of the connection, in accordance with Italian and European legislation.

This notice may be subject to changes due to the introduction of new regulations; users are therefore invited to check this page periodically.

If the user is under 16 years of age, pursuant to Art. 8, par. 1 of EU Regulation 2016/679, their consent must be legitimized through the authorization of parents or legal guardians.

II. DATA PROCESSING

1 – Data Controller and Data Processor

The Data Controller is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. It also manages security profiles.

The Data Processor is the natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Data Controller.

Regarding this website, the Data Controller and Processor is Malvarosa, with registered office at via San Martino n. 3, Carruba di Giarre (CT) – VAT No: 03508850876. For any clarification or to exercise user rights, you may contact the Controller at the following email address: info@malvarosa.it.

2 – Place of Data Processing

Processing resulting from the use of www.malvarosa.it takes place at via San Martino, 3 – 95014 Carruba di Giarre (CT).

If necessary, data related to the newsletter service or order management may be processed by the Data Processor or parties appointed for this purpose at their respective offices or at the data centers of technological service providers (Hosting).

III. COOKIES

The website www.malvarosa.it uses cookies to make the user’s browsing experience easier and more intuitive.

A cookie consists of a small set of data transferred to the user’s browser by a web server and can only be read by the server that performed the transfer.

The extended “Cookie Policy”, including the analytical classification of technical, analytical, and profiling cookies, is published at: https://www.malvarosa.it/en/extended-cookie-policy/.

IV. DATA PROCESSED

1 – Methods of Data Processing

Like all websites, this site uses log files where information collected automatically during user visits is stored (IP address, browser type, ISP, date and time, referral).

The aforementioned information is processed automatically and collected in aggregate form to verify the correct functioning of the site and for security reasons. This information will be processed based on the legitimate interests of the Controller.

On the website’s pages, further summary information regarding specific requested services will be specified. Some data marked with an asterisk (*) are mandatory for the provision of the service.

Users’ personal data are recorded to allow the purchase of products and/or services online and to enable the conclusion of the “sales contract” and the correct execution of related operations (billing, shipping via couriers, after-sales assistance, returns, and warranties).

• Online Payments: To make a payment by credit card, the user will use affiliated platforms (e.g., Stripe or PayPal). Such data will be acquired directly by the payment service provider acting as an independent Data Controller. This site will not process or store confidential credit card data (numbers, CVV, expiry dates) in any way.
• Security and Anti-Fraud: For security purposes (spam filters, fraud prevention), the site uses the Google reCAPTCHA service. Automatically recorded data may include the IP address to block attempts to damage the site or activities constituting a crime, based on the legitimate interests of the Controller. The use of this service is subject to Google’s Privacy Policy and Terms.

Should the site allow the posting of comments or reviews, it automatically detects and records certain user identification data, including the email address.

The user is responsible for third-party data published or shared through this site and warrants that they have the right to communicate or disseminate them.

Filling out the contact form, purchase forms, registration, or newsletter forms implies consent to processing for the listed purposes.

2 – Purposes of Data Processing

Data are collected for:

• Conclusion and execution of the online sales contract;
• Responding to requests submitted via email or contact forms;
• Administrative-accounting purposes and fulfilment of legal obligations;
• Provision of the newsletter service and marketing purposes (subject to express consent);
• Fraud prevention and cybersecurity.

Data retention will be carried out for the period strictly necessary to achieve the purpose and, in any case, not exceeding 10 years for data related to completed orders (fiscal obligation). Data used for security purposes are kept for the time strictly necessary for the indicated purpose.

3 – Data Provided by the User

The optional and voluntary sending of emails to the indicated addresses entails the acquisition of the sender’s address, necessary to respond. Specific summary notices will be displayed on pages set up for particular services on request.

4 – Browser Configuration Support

Users can manage cookies through their browser settings. For further information, visit the specific help page of the browser used.

5 – Social Network Plugins

This site incorporates plugins and/or buttons for social networks. The collection and use of information obtained through these plugins are governed by the respective privacy policies of the social networks.

6 – Third-Party Services, Profiling and Marketing

1. In order to enhance the user experience and optimise its commercial strategies, the website utilises the following third-party tools, which involve profiling and tracking activities:

• Google Analytics 4 and Google Signals: The website utilises Google Analytics for the statistical analysis of traffic. The “Google Signals” feature is active, which associates visit information collected by this website with Google information from the accounts of users who have consented to such association for advertising personalisation. This information includes demographic data, interests, geographic location, and search history, providing aggregated and anonymous statistics on cross-device behaviour.
• Google Ads and Consent Mode: For users who provide consent to the “Advertising” category (ad_storage parameter), Google Ads will utilise cookies and identifiers to improve audience segments, bid optimisation, and conversion measurement. Web activity will be associated with Google information regarding the logged-in user for advertising purposes.
• Meta Pixel (Pixel Your Site): Through the Meta Pixel, the website collects data on user actions to measure the effectiveness of advertising campaigns and to create custom audience groups for Remarketing purposes. Data is transmitted to Meta Platforms Ireland Ltd.
• Freetobook (Booking Engine): For the management of B&B bookings, personal data is processed for contractual purposes and legal obligations. Data resides on servers located in the United Kingdom, a country covered by an adequacy decision from the European Commission.

2. Data Control and Revocation: Users can view, manage, or delete data associated with their Google account by visiting the “Google My Activity” section.

3. Legal Basis: Processing for analysis and marketing purposes takes place exclusively subject to the user’s explicit consent, expressed via the cookie banner. In the absence of consent, the collection of advertising cookies and identifiers will be blocked.

V. USER RIGHTS

Art. 13, par. 2 of EU Regulation 2016/679 lists user rights. The website www.malvarosa.it informs the user of the existence of the rights to: access, update, rectification, integration, restriction, objection, portability, and erasure (right to be forgotten).

Requests can be addressed to the Controller via email at: info@malvarosa.it. The user has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

VI. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

For the provision of the booking service (Freetobook), marketing purposes, or social plugins, some data may be transferred to non-EU countries by adopting the Standard Contractual Clauses of the European Commission (Articles 46-49 GDPR).

VII. SECURITY OF PROVIDED DATA

The site adopts appropriate security measures to prevent unauthorized access or modification of data. Internal personnel or external parties (couriers, hosting providers, IT companies, communication agencies) may have access to the data.

VIII. CHANGES TO THIS DOCUMENT

This document, published at https://www.malvarosa.it/en/privacy-policies/, constitutes the privacy policy of this site. It may be subject to changes or updates. This document was updated on 18/02/2026 to comply with current regulatory provisions.