Privacy & Cookie Policy
Privacy Notice pursuant to Article 13 of Regulation (EU) 2016/679
This Privacy & Cookie Policy describes how DIANA S.r.l. processes the personal data of users who visit and use www.ivivaialparugiano.it and spa.ivivaialparugiano.it, including the related contact, booking, purchase, account and newsletter services.
This notice applies to both domains listed above. External services accessed through links, such as third-party booking or payment platforms, may also be subject to the privacy notices of the relevant providers.
Data Controller
The Data Controller is DIANA S.r.l., with registered office at Via Giuseppe Valentini 23/A - 59100 Prato (PO), Italy, VAT and Tax Code 02395420975.
For privacy-related requests, you may contact info@i-vivai.com. For operational requests concerning SPA services, spa@i-vivai.com is also available.
Categories of personal data processed
Depending on the service used, the following data may be processed:
- identification and contact data, such as name, surname, e-mail address and telephone number;
- information relating to enquiries, accommodation bookings, SPA services, treatments, restaurant bookings or other services provided by the property;
- data required for invoicing and administrative or tax obligations;
- data relating to any account created on the SPA subdomain and transactions performed through the cart and checkout;
- payment-related information to the extent necessary to manage the transaction; full payment instrument details may be processed directly by the relevant payment provider under its own privacy notice;
- browsing data, IP addresses, online identifiers, device information and technical data required for website operation and security;
- cookie preference data and, subject to consent where required, usage data for analytics or marketing purposes.
The websites do not ordinarily require users to provide special categories of personal data under Article 9 GDPR. If a user voluntarily provides health-related information or other special-category data, for example in relation to needs, contraindications or SPA treatments, such information will be processed only to the extent necessary to manage the requested service and, where required by law, on the basis of specific explicit consent.
Purposes and legal bases
| Purpose | Legal basis | Categories of data |
|---|---|---|
| Responding to requests submitted through forms, e-mail, telephone or other contact channels. | Pre-contractual measures requested by the data subject, Art. 6(1)(b) GDPR. | Identification data, contact data and contents of the request. |
| Managing accommodation, restaurant, SPA, treatment and other service bookings. | Pre-contractual measures and performance of a contract, Art. 6(1)(b) GDPR. | Identification data, contact data and booking details. |
| Creating and managing user accounts, carts, checkout and orders/bookings on the SPA subdomain. | Pre-contractual measures and performance of a contract, Art. 6(1)(b) GDPR. | Account, contact, order, booking and technical data. |
| Managing payments and financial transactions. | Performance of a contract, Art. 6(1)(b) GDPR, and compliance with legal obligations, Art. 6(1)(c) GDPR. | Transaction, invoicing and payment-related information. |
| Complying with administrative, accounting, tax and regulatory obligations. | Legal obligation, Art. 6(1)(c) GDPR. | Identification, tax, contractual and payment data. |
| Protecting website security and preventing abuse, unauthorised access and fraudulent activity. | Legitimate interests of the Controller, Art. 6(1)(f) GDPR. | Browsing data, IP addresses, technical and security logs. |
| Sending newsletters and promotional communications concerning I Vivai services and initiatives. | Consent, Art. 6(1)(a) GDPR. | Contact data and preferences. |
| Measuring website usage and producing statistics through non-essential analytics tools. | Consent, Art. 6(1)(a) GDPR, where required by applicable law. | Cookies, online identifiers and usage data. |
Provision of personal data
Providing the data required to respond to an enquiry, make a booking, create an account, purchase a service or comply with legal obligations is necessary in order to provide the requested service. Failure to provide such data may make it impossible to respond to the request or establish the relevant contractual relationship.
Consent to newsletters, promotional communications and non-essential tracking tools is optional, and refusal does not affect access to the main services.
Recipients and processors
Personal data are not publicly disclosed or sold. To the extent necessary for the purposes described above, data may be shared with authorised employees and collaborators of the Controller, professional advisers, IT and hosting providers, booking-system providers, e-commerce platforms, payment providers, e-mail and newsletter services, technical support and security providers, as well as public authorities or other parties where required by law.
Where such parties process personal data on behalf of DIANA S.r.l., they are appointed as processors under Article 28 GDPR where applicable. An up-to-date list of processors may be requested from the Controller.
Services and providers used by the websites
Hosting and infrastructure: the main domain uses SiteGround infrastructure. These services may involve the processing of technical data and logs required for website operation and security.
SimpleBooking: for certain accommodation bookings, the main website may redirect users to SimpleBooking. Data entered on that platform are also processed in accordance with the relevant provider’s privacy notice.
SPA subdomain: spa.ivivaialparugiano.it allows users to manage accounts, carts, checkout, orders and SPA service bookings. Technical providers and any payment providers involved process the data required to provide their respective functions according to the applicable privacy roles.
Google: the websites may use Google Tag Manager and Google Analytics 4 for tag management and traffic measurement. Non-essential analytics tools are enabled in accordance with the user’s consent preferences where required.
Adobe Fonts: the websites may use Adobe Fonts to display typefaces. The user’s browser may connect to the provider’s servers and transmit technical data required to deliver the service.
Transfers outside the European Economic Area
Some service providers may process data in countries outside the European Economic Area. Where this occurs, transfers are carried out in compliance with Chapter V GDPR, on the basis of an adequacy decision by the European Commission or appropriate safeguards such as Standard Contractual Clauses under Article 46 GDPR and, where applicable, other mechanisms recognised under EU law.
Retention periods
| Data / purpose | Retention period or criterion |
|---|---|
| Requests submitted through forms, e-mail or other channels | Up to 24 months from the request or last active contact, unless a contractual relationship is established or longer retention is required to protect legal rights. |
| Operational booking and service data | Normally up to 2 years from the last booking or completion of the service, subject to further legal obligations or the need to protect legal rights. |
| Administrative, accounting and tax data | For the period required by applicable law, normally 10 years. |
| SPA account | For the life of the account and thereafter for the period necessary to manage contractual or tax obligations and data-subject requests. |
| Newsletter and marketing | Until consent is withdrawn or the user unsubscribes, without prejudice to the minimum retention of information needed to document the withdrawal. |
| Technical and security logs | For the period strictly necessary for security purposes and to manage incidents, abuse or disputes. |
| Cookies and other tracking tools | According to the duration shown in the cookie-preference panel and/or in the relevant providers’ notices. |
Browsing and security data
The IT systems and software required to operate the websites acquire, during normal operation, certain data whose transmission is inherent in the use of Internet communication protocols, such as IP addresses, requested-resource URIs, request times, response codes and information concerning the device and browser.
These data are used to provide the websites correctly, obtain aggregated statistics, verify service operation and protect website security. They may also be used to establish liability in the event of suspected cybercrime or abuse affecting the websites.
Cookie Policy
What cookies are
Cookies are small text files that websites may store on a user’s device while browsing. They may be session cookies, deleted when the browser is closed, or persistent cookies, stored for a defined period.
Types of cookies and tracking tools
Technical and necessary cookies: these are used for website operation, security, session management, accounts, carts, checkout and consent preferences. They do not require consent when strictly necessary to provide a service explicitly requested by the user.
Analytics cookies: these allow visits and website usage to be measured. Where the conditions for treating them as equivalent to technical cookies are not met, they are used only with prior consent.
Marketing or profiling cookies: these may be used to measure campaigns, personalise content or advertising and analyse user behaviour. Where present, they are activated only with prior consent.
Third-party cookies: certain external services may install or read tracking tools in accordance with their own privacy notices. Their use is subject to the user’s preferences where consent is required.
Managing consent
On first access, users can accept, reject or customise the use of non-essential cookies through the banner or preference-management panel available on the websites. Preferences can later be changed or withdrawn through the cookie-settings control, where available.
The up-to-date list of cookies and other tracking tools actually detected, including their category, purpose, provider and duration, is made available through the consent-management system installed on the websites and forms an integral part of this Cookie Policy.
Browser settings
Users may also restrict or delete cookies using their browser settings. Disabling technical or necessary cookies may impair the operation of certain website functions, particularly accounts, carts, checkout and bookings.
Data subject rights
Where the conditions set out in Articles 15-22 GDPR are met, the data subject may request:
- confirmation as to whether personal data are being processed and access to such data;
- rectification of inaccurate data or completion of incomplete data;
- erasure of personal data where provided by law;
- restriction of processing;
- data portability, where applicable;
- objection to processing based on legitimate interests and, at any time, to direct marketing;
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Requests may be sent to info@i-vivai.com.
Automated decision-making
Unless otherwise stated in relation to a specific service, DIANA S.r.l. does not make decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them.
Right to lodge a complaint
A data subject who considers that the processing of their personal data infringes the GDPR has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) using the methods indicated at www.garanteprivacy.it, without prejudice to any other administrative or judicial remedy available under the law.
Updates to this notice
DIANA S.r.l. may update this Privacy & Cookie Policy to reflect regulatory, technical or organisational changes. The updated version will be published on the relevant websites.
Last updated: September 2026.