Privacy Policy.
Processing of personal data pursuant to EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
1. Introduction
This privacy notice describes how Auxilium Real Estate S.r.l. (hereafter "ELYUS" or "we") processes the personal data of users who visit the elyusresidences.com website and its subdomains, in compliance with EU Regulation 2016/679 (the "GDPR"), the Italian Privacy Code (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018), and the rulings of the Italian Data Protection Authority (Garante per la protezione dei dati personali), in particular the ruling of 10 June 2021 on cookies.
This notice applies to website browsing, completion of contact forms, communications via email/phone/WhatsApp, and data collected during the booking process through the integrated booking engine.
2. Data Controller
The Data Controller is:
- Auxilium Real Estate S.r.l.
- Registered office: Corso Europa 601, 10088 Volpiano (TO), Italy
- VAT / Tax ID: IT13238350014
- Phone / WhatsApp: +39 011 19510799
- Email for GDPR enquiries: privacy@elyusresidences.com
Data Protection Officer (DPO): not appointed. Auxilium Real Estate S.r.l. does not fall within the parties required to appoint a DPO under Article 37 of the GDPR. For any data protection enquiry, the contact point is the Controller at the address above.
3. Categories of personal data collected
3.1 Data provided voluntarily by the user
Personal data collected through direct interaction with the website includes:
- Contact form: name, email address, message content. In future a phone number may also be requested as an optional field.
- Communications via email, phone or WhatsApp: identifying and contact details voluntarily provided by the user, content of communications.
- Booking data: first name, last name, email, phone, address, payment data, identification documents where applicable — collected through the Octorate booking engine (see section 7).
3.2 Data collected automatically during browsing
While browsing the website, the following are automatically collected:
- Browsing data: IP address, browser type and version, operating system, device type, pages visited, date and time of visits, referring website.
- Cookies and similar technologies: technical, analytical and marketing cookies, according to the choices expressed in the cookie banner. Details are available in the Cookie Policy.
4. Purposes of processing and legal bases
Personal data is processed for the following purposes, each with its own legal basis under Article 6 of the GDPR:
| Purpose | Legal basis | Provision |
|---|---|---|
| Responding to user requests (contact form, email, phone) | Art. 6(1)(b) – pre-contractual measures / Art. 6(1)(a) – consent | Required |
| Performance of booking and stay contract | Art. 6(1)(b) – contract performance | Required |
| Tax, accounting and administrative obligations | Art. 6(1)(c) – legal obligation | Required |
| Site measurement, analytics and optimisation (analytical cookies) | Art. 6(1)(a) – consent | Optional |
| Marketing and targeted advertising on third-party platforms (Meta Pixel) | Art. 6(1)(a) – explicit consent | Optional |
| IT security and fraud prevention | Art. 6(1)(f) – legitimate interest | Required |
5. Methods of processing and security
Data is processed using electronic tools, according to logic strictly related to the stated purposes, and with technical and organisational measures appropriate to the risk (Article 32 GDPR), including: encrypted connections (HTTPS/TLS), access limited to authorised personnel only, backup systems, access logging, and server infrastructure protection.
The hosting servers of elyusresidences.com are located in Italy, at the data centre of Auxilium S.r.l., a group affiliate, acting as data processor.
6. Data retention periods
Personal data is retained for the time strictly necessary to achieve the purposes for which it was collected:
- Contact form data: maximum 24 months from last contact, unless converted into a contractual relationship.
- Booking and invoicing data: 10 years, in accordance with Italian tax and civil law.
- Analytical cookies: 14 months (Google Analytics 4) and 13 months (Microsoft Clarity).
- Marketing cookies and identifiers: 90 days (Meta Pixel) unless a longer duration is set by the platform; server-side events transmitted via Conversions API are retained according to Meta's policies (typically 6 months).
- Technical and security logs: 12 months.
- Cookie consent: 6 months, after which the banner is shown again.
7. Data sharing and transfer to third parties
7.1 External data processors
For the operation of the website and the provision of services, ELYUS relies on third-party providers appointed as data processors under Article 28 of the GDPR. Each provider is bound by an appointment agreement (DPA) and processes data exclusively on behalf of the Controller. The current list:
- Octorate S.r.l. – booking engine. Location: Italy. Processing: booking management, calendar, payments.
- Meta Platforms Ireland Ltd. – Meta Pixel and Conversions API for measurement and advertising. Location: Ireland (EU). Possible transfers to the United States covered by the Data Privacy Framework (DPF) and EU Standard Contractual Clauses.
- Google Ireland Ltd. – Google Analytics 4 for traffic analysis. Location: Ireland (EU). Possible US transfers covered by DPF and SCC.
- Microsoft Ireland Operations Ltd. – Microsoft Clarity for behavioural analysis (heatmaps, session recording). Location: Ireland (EU). Possible US transfers covered by DPF and SCC.
- Auxilium S.r.l. – hosting infrastructure, data centre, cloud services. Location: Italy.
7.2 First-party subdomain for data transmission
For technical reliability of tracking, in particular on browsers with advanced restrictions on third-party cookies (e.g. Safari on iOS/macOS), ELYUS may use a dedicated subdomain — tracking.auxilium.online — as a first-party endpoint for the transmission of events to third-party analytics and marketing platforms. This mechanism does not bypass user consent: the active trackers and the data transmitted transparently reflect the choices expressed in the cookie banner and declared in the Cookie Policy.
7.3 Transfer of data outside the EU
Some of the providers listed above may involve transfers of personal data to non-EU countries (in particular the United States). Such transfers take place in compliance with Articles 44-49 of the GDPR, on the basis of:
- Adequacy decisions of the European Commission (e.g. EU-US Data Privacy Framework for participating US providers);
- Standard Contractual Clauses (SCC) approved by the European Commission;
- Supplementary safeguards and technical measures (encryption, pseudonymisation) where applicable.
8. Rights of the data subject
At any time, the data subject may exercise the rights provided by Articles 15-22 of the GDPR, in particular:
- Right of access to personal data (Art. 15);
- Right to rectification of inaccurate data (Art. 16);
- Right to erasure ("right to be forgotten", Art. 17);
- Right to restriction of processing (Art. 18);
- Right to data portability (Art. 20);
- Right to object to processing (Art. 21), in particular for direct marketing purposes;
- Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7);
- Right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), or with the supervisory authority of one's EU Member State.
9. How to exercise your rights
To exercise the rights listed in section 8, the data subject can write to:
or by ordinary mail to:
Auxilium Real Estate S.r.l. — Privacy
Corso Europa 601
10088 Volpiano (TO) — Italy
Requests will be processed within 30 days of receipt, extendable by a further 60 days in particularly complex cases (Art. 12 GDPR). Additional data or documents may be requested to verify the requester's identity.
10. Cookies and tracking
For detailed information on cookies and tracking technologies used by the site, please refer to the Cookie Policy.
The user can change their preferences at any time through the "Cookie preferences" button at the bottom of every page on the site.
11. Changes to this notice
This notice may be subject to changes, additions or updates due to regulatory developments or technological evolution. Significant changes will be communicated on the site and, where required, through the re-presentation of the cookie banner. Users are invited to consult this page periodically. The date of the last update is shown at the top of the document.
12. Regulatory references
This notice has been drafted taking into account:
- EU Regulation 2016/679 (GDPR);
- Italian Legislative Decree 196/2003 (Privacy Code) as amended by Legislative Decree 101/2018;
- Ruling of the Italian Data Protection Authority of 10 June 2021 on cookies;
- EDPB (European Data Protection Board) guidelines;
- Drafting framework inspired by the Iubenda standard, adapted to the activity and processing structure of the Controller.