top of page

Privacy Policy

​

Last updated: 07/07/2026

​

This Privacy Policy is intended to inform users about how their personal data is processed, in compliance with EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003, as amended.


Data Controller


1. Company Name: Portofino Vip sas di Simone Bafico & C.


2. Types of Data Collected

The website collects data in two ways:

​

A. Data provided voluntarily by the user (Contact Form): On the /en/contatti page, users may enter their details to request information. This data includes:

  • Full Name

  • Email Address

  • Phone Number

  • Property of Interest

  • Message (free text)

​

Providing the data marked as mandatory on the form (Full Name, Email Address, Phone Number, Property of Interest and Message) is necessary in order for us to respond to your enquiry: without this information, we will be unable to reply. Any consent given to receive commercial communications (see the "Marketing and Commercial Communications" section below) has no bearing whatsoever on how your enquiry is handled.

 

B. Data collected automatically (Browsing and Cookie Data): The website, hosted on the Wix platform, collects technical data necessary for browsing and security purposes, including:

  • IP address, browser type, and device parameters used to access the site.

  • Essential and security cookies: XSRF-TOKEN, hs, svSession, server-session-bind.


3. Purposes of Processing and Lawful Basis

Your data is processed for the following purposes:

​

A. Responding to enquiries (Lead Generation): To reply to messages sent via the contact form and to provide quotes or commercial proposals.

  • Lawful basis: Performance of pre-contractual measures (Art. 6(1)(b) GDPR).

B. Security and Fraud Prevention: To protect the website from cyberattacks (via the technical cookies detected).

  • Lawful basis: Legitimate interest of the Data Controller (Art. 6(1)(f) GDPR).

C. Interactive maps: Via the Google Maps widget.

  • Lawful basis: Legitimate interest (Art. 6(1)(f) GDPR).

​

4. Marketing and Commercial Communications

For sending newsletters, service updates, promotions and commercial communications by email or SMS.

  • Lawful basis: Explicit consent of the data subject (Art. 6(1)(a) GDPR). Consent is optional and may be withdrawn at any time by clicking the unsubscribe link at the bottom of our emails or by contacting us directly.


5. Processing Methods and Data Transfer (Wix)


Processing is carried out using IT tools.

  • Hosting: The website is hosted on the Wix.com platform. Data may be stored via Wix.com's data storage applications, databases and general applications, on firewall-protected servers.

  • Transfers outside the EU: Wix.com Ltd. is based in Israel, a country which the European Commission has recognised as providing an adequate level of protection for personal data. For further details, please refer to Wix's own Privacy Policy.


6. Interaction with Third Parties

  • Google Maps (Google Ireland Limited): The map widget integration involves the transmission of data (e.g. IP address) to Google. This data is processed in accordance with Google's policies, available here.

​

7. Data Retention Period

  • Data provided via the contact form is retained for as long as strictly necessary to handle the data subject's enquiry (a maximum of 12 months, unless followed by a commercial agreement).

  • Cookies have varying durations: session cookies expire when the browser is closed, while persistent cookies (such as svSession) may remain active for up to 2 years.


8. Your Rights as a Data Subject

As a data subject, you have the right to:

​

  • Access: Find out what data we process about you.

  • Rectification: Request correction of inaccurate data.

  • Erasure ("Right to be Forgotten"): Request the removal of your data from our systems.

  • Restriction and Objection: Object to processing for marketing purposes or request that it be restricted.

  • Data Portability: Receive your data in a structured format.

  • Lodge a Complaint: Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), should you believe that the processing of your data breaches applicable law.


9. Absence of Profiling and Automated Decision-Making

The Data Controller does not carry out any form of automated decision-making, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them.

​

To exercise your rights, please write to: portofinovipapt@gmail.com

bottom of page