1. Data controller
The data controller is GAM S.r.l., VAT and tax code 03009570304, with registered office at Via Papa Eufemio IV 12, 33044 Manzano (UD), operating the SPAZIO161 brand and spaces.
You can contact the controller at info@spazio161.it.
2. Data we process
The website may process the following categories of data:
- data submitted via the contact form or visit booking: name, email, phone, service of interest, chosen time slot and message content;
- data you voluntarily share by email, phone or WhatsApp;
- technical browsing and security data such as IP address, user agent, request date/time and server logs;
- preferences relating to cookies, analytics and external content, stored locally in your browser;
- data transmitted to Google when you choose to load the embedded map.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Respond to enquiries, provide information and arrange visits. | Pre-contractual steps at the data subject’s request, Art. 6.1.b GDPR. |
| Manage security, abuse prevention and technical operation of the site. | Legitimate interest of the controller, Art. 6.1.f GDPR. |
| Load optional analytics or external content such as Google Maps. | Consent, Art. 6.1.a GDPR, withdrawable at any time. |
| Comply with administrative, accounting or legal duties linked to a possible relationship. | Legal obligation, Art. 6.1.c GDPR. |
4. Providing your data
Name and email are required to respond to your request. Phone, service of interest and message are optional. If required data are not provided, we cannot send or handle the request.
5. Processing methods and security
Data are processed with IT tools and organisational measures designed to reduce risks of loss, unauthorised access, disclosure or alteration. The form uses anti-spam controls and rate limiting; messages are forwarded through the controller’s configured email infrastructure.
6. Recipients and providers
Data may be processed, to the extent necessary, by:
- authorised staff and collaborators of GAM S.r.l.;
- hosting, infrastructure, IT maintenance and email providers;
- Calendly LLC, when you start booking a visit through the related calendar;
- Google Ireland Limited, only when you choose to load Google Maps;
- advisers and public authorities when required by law.
Providers that process data on behalf of the controller are appointed as processors where Art. 28 GDPR requires it.
7. Transfers outside the European Economic Area
The website and the planned analytics system are hosted on infrastructure controlled in the European Union. Enabling Google or Calendly services may involve international processing or transfers under the safeguards those providers make available. Google Maps stays off until consent; Calendly is contacted only when you submit an appointment request.
8. Retention
- contact requests: up to 12 months after the request is closed, unless a relationship begins or protection is needed;
- administrative and contractual records: for the periods required by law;
- technical and security logs: normally up to 30 days, except for incidents or investigation needs;
- cookie preferences: 180 days, unless withdrawn or changed earlier.
9. Your rights
You may request access, rectification, erasure, restriction, data portability, object to processing based on legitimate interest and withdraw consent without affecting prior processing. You can exercise these rights by writing to info@spazio161.it.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante).
10. Automated processes
The website does not use automated decision-making or commercial profiling.
11. Cookies and external services
For details on the technologies used, categories and how to change preferences, see the Cookie Policy.