Privacy notice

Introduction

This Notice fully describes the practices adopted by Shangrilux of Davy De Nizza.

Reference website: https://shangrilux.com.

Data controller

The data controller is Shangrilux of Davy De Nizza — Turin, Italy.

Email: info@shangrilux.com.

Tel.: (+39) 353 482 1033.

CIN: IT001171C29HSXCX9P.

4) Place and methods of processing

Data are processed at the Controller's premises and on servers of authorised hosting/cloud providers located in the EEA or in countries with adequate safeguards (Standard Contractual Clauses). Processing is carried out by electronic and paper means, with appropriate security measures (TLS encryption, firewalls, backups, access control).

5) Nature of provision, refusal and consequences

• Mandatory: data required to perform the contract or required by law (e.g. tax data). Failure to provide them prevents the purchase.

• Optional: data for marketing/profiling and non-essential cookies. Failure to provide them does not affect core services, but prevents personalised communications or advanced features.

You may always change consent preferences via the "Cookie settings" link in the footer or through browser settings.

6) Recipients or categories of recipients

Data may be disclosed to:

• IT, hosting and maintenance providers;

• couriers and shippers;

• banks and payment gateways;

• accounting, tax and legal advisers;

• marketing automation platforms (subject to consent);

• public authorities, supervisory bodies and law enforcement. Such parties will process data as processors or independent controllers, in compliance with the GDPR.

7) Data retention

Data type — Retention period

Accounting/tax records — 10 years (Art. 2220 Italian Civil Code)

Marketing contact data — Until withdrawal and in any case max 24 months from last interaction

Security logs — 12 months

Browsing data (analytics cookies) — 13 months

8) Transfers to third countries

Any transfers outside the EU occur only to countries with an adequacy decision or on the basis of appropriate safeguards (Arts. 44–49 GDPR), such as Standard Contractual Clauses.

9) Withdrawal of consent

You may withdraw consent at any time (Art. 7 GDPR) without affecting the lawfulness of prior processing. To withdraw consent, click "Unsubscribe" in marketing emails or write to info@shangrilux.com.

10) Data subject rights

Data subjects may exercise the rights in Arts. 15–22 GDPR (access, rectification, erasure, restriction, portability, objection) by contacting the Controller. A complaint may also be lodged with the Italian Data Protection Authority (www.garanteprivacy.it).

11) Security

Shangrilux adopts appropriate technical and organisational measures (encryption, pseudonymisation, redundant backups, incident-response procedures) to prevent unauthorised access, disclosure or alteration.

12) Detailed cookie policy

12.1 Types of cookies used

• Session technical cookies – essential for the Site to function.

• Functionality cookies – store preferences (language, cart, consent).

• StayEase assistant cookies / storage – guest-agent widget for stay enquiries (third party, functional to the service).

• Third-party analytics cookies – Google Analytics 4 (anonymised IP, 13 months).

• Marketing/profiling cookies – Google Ads / DoubleClick (subject to consent, 1 year).

12.2 Third-party cookie details

Name — Provider — Description — Duration — Privacy policy

_ga, _ga_* — Google LLC — Anonymous/aggregate statistics — 13 months — https://policies.google.com/privacy

IDE, test_cookie — Google Ads / DoubleClick — Behavioural advertising — 1 year — https://policies.google.com/technologies/ads

StayEase widget — StayEase (Railway proxy) — Stay enquiry / guest-agent assistant — per provider policy — loaded from stayease-proxy-server-production.up.railway.app

fonts — Adobe Fonts — Web font loading — 60 days — https://www.adobe.com/privacy/policy.html

12.3 Cookie management

You may:

• Give or withdraw consent via the cookie banner;

• Configure the browser to accept or refuse all or some cookies;

• Use private/incognito browsing.

Instructions for common browsers are available in their respective help sections (Chrome, Firefox, Edge, Safari).

13) Automated decision-making

The Controller does not carry out processing that consists of automated decision-making or profiling with legal effects.

14) Children's privacy

The Site is aimed at a general audience and does not offer services intended for under-18s. If Shangrilux learns that a minor has provided personal data without parental/guardian consent, it will delete them immediately.

15) External links

The Site may contain links to third-party sites: Shangrilux is not responsible for their privacy policies. Users are invited to read the notices on those sites carefully.

16) Legal defence

Personal data may be used by the Controller in legal proceedings or in preparatory stages to defend against misuse of the Site or related services.

17) Lodging a complaint

The data subject has the right to lodge a complaint with the supervisory authority of the country of residence or with the Italian Data Protection Authority.

18) Legal references

This notice is drafted in compliance with the GDPR, the Italian Privacy Code, Directive 2009/136/EC on cookies and any other applicable law.

19) Changes to this notice

Shangrilux reserves the right to amend this notice at any time: changes will be published on this page with the update date. If changes substantially affect users' rights, Shangrilux will notify them by email or a dedicated banner.

Rome, 19 April 2025