Privacy policy

Who processes your data

The data controller is BC Luxury S.r.l., with registered office at Via Monte Napoleone 8, 20121 Milano, VAT number IT02932560903, REA number MI-2773299. It publishes this website, www.theprimevillas.com, under the brand name Prime Villas.

For any questions regarding this privacy policy, and to exercise your rights, you can write to info@theprimevillas.com or call +39 0789 96296.

Which data we process, and where it comes from

The website forms. There are four: contact, an enquiry about a home from its page, access to the Private Collection and managing your property. They request your name and an email address; depending on the form, also your telephone number, the period of the stay, the number of guests and a message. Your name and email address are required to reply to you, and without them the enquiry cannot be sent. All other fields are optional.

Along with the enquiry, we record the page language, the page from which it was sent, the home if you write from its page, the timestamp of submission with confirmation that you have read this privacy policy, and the browser type, which helps distinguish a genuine enquiry from an automated submission. We do not record the network address of your device: for as long as the server remains running, we retain an irreversible fingerprint of it in memory, which serves to count requests over the last 10 minutes and stop excessive submissions.

Direct contact. If you write to us by email or on WhatsApp, or if you call us, we process the data you provide at that time: your name, contact details and your request.

Cookie choices. When you respond to the cookie banner, the website records your choice together with a random identifier generated by your browser, the version of the cookie policy, the timestamp, the language, the page and the browser type. The network address is not recorded. The cookie policy describes this in full.

The Private area. When you confirm a stay, or when we open a selection of unpublished homes to you, we grant you personal access to the Private area of this website. There we process your name, email address, telephone number and the language for communications; the password, which we never see, because the access system retains only a hash of it; stays, with the dates, the home and the number of guests; the proposals we have sent you; the account, namely how much you have paid and what remains outstanding; the documents of the stay, namely the contract, receipts, photographs of the utility metres and the condition of the home upon handover and return, and any damage along with proof; service requests you make from the Private area. On the booking we also indicate the type of stay, namely a family, a group of friends or a business trip, in order to place the most suitable services at the top.

Property owners. If you own a home that we manage, in the Private area you will find the bookings for your property with the dates and status, the share due to you, amounts already paid out to you and the condition of the home. We process your contact details and the details of our agreement. In the Private area, the property owner does not see the name or contact details of guests.

Proposals. A proposal we send you can also be opened via a personal link: anyone who has the link sees it exactly as we sent it to you, so please keep it secure like a document.

Services. If you request a service from us, such as a chef, a transfer or a boat, we process what is needed to arrange it: the dates, location, number of persons and your specific requirements.

Special categories of data. We do not ask you for data concerning health, religious beliefs or other special categories (Article 9 of the Regulation). If you choose to disclose any such information for a service, for instance an allergy for the chef or mobility requirements for a transfer, we use it solely for that service, share it only with the person providing it, and only with your explicit consent.

Why we process data, and on what legal basis

• To respond to your enquiries and prepare a proposal: these are precontractual measures taken at your request (Article 6, paragraph 1, point b of Regulation (EU) 2016/679, the GDPR). The box you tick on the form confirms that you have read this privacy policy.
• For the stay, the management agreement, the Private area and the services you request from us: this is the performance of a contract to which you are party (the same point b).
• For tax and accounting obligations arising from a contract: this is a legal obligation (point c).
• For the security of the website and forms, including the technical logs of our providers: this is our legitimate interest in a service that functions properly and is not misused (point f). You may object at any time.
• For analytics and marketing: only with your consent, which you give and withdraw via the cookie banner (point a).
• For special categories of data that you disclose to us for a service: only with your explicit consent (Article 9, paragraph 2, point a).
• For the record of choices regarding cookies: to be able to demonstrate consent, as required by Article 7, paragraph 1 of the Regulation (point c).

Who receives the data

Your enquiries and documents are accessed by the people who work with us, each strictly to the extent necessary for their role. To operate the website, we rely on providers who process data on our behalf, bound by a contract (Article 28 of the Regulation):

• Vercel Inc., Covina, California, United States: hosts the website. It distributes pages from its delivery network, with points of presence across the world; enquiries submitted through forms and cookie choices are processed in its data centre in the European Union, in Paris. To deliver pages, it receives the network address of your device, like any web hosting service, and retains technical logs in accordance with its terms.
• Supabase Pte. Ltd., Singapore: the database, documents and access credentials for the Private area. Data is stored in the Paris region, in France.
• Plus Five Five, Inc., San Francisco, United States, via the Resend service: emails sent to you by the management system, such as the link to the Private area and communications regarding your stay. The service is not yet active. When it is activated, dispatch data for each email, namely recipient, subject line and delivery status, will be stored in the United States.
• CartoDB Inc. (CARTO), New York, United States: map imagery on home pages, on the contact page and in the Private area. To deliver them, it receives the network address of your device, the referring page and the browser type.

Only if you give consent via the cookie banner, the following parties receive data collected by their tools, in accordance with their terms:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: Google Analytics, the Google Ads tag and Google Tag Manager.
• Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland: the Meta Pixel.

The website also uses Google Search Console, which shows how pages appear in Google searches: it does not receive any data concerning website visitors.

If you choose to write on WhatsApp, the conversation passes through WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, in accordance with its terms.

If you request a service, the supplier providing it receives the data necessary to carry it out. We disclose data to public authorities only where required by law. Data is never sold or disseminated.

Data outside the European Economic Area

Some of these providers process data in the United States, and Supabase also in Singapore. Every transfer relies on a safeguard provided for by the Regulation: Vercel, Plus Five Five (Resend), CARTO, Google LLC and Meta Platforms, Inc. adhere to the Data Privacy Framework between the European Union and the United States; Vercel, Supabase, Plus Five Five and CARTO also apply standard contractual clauses approved by the European Commission. WhatsApp Ireland Limited sets out in its privacy policy the safeguards it applies: adequacy decisions, Data Privacy Framework and standard contractual clauses. A copy of these safeguards may be requested by writing to info@theprimevillas.com.

How long we retain your data

• Enquiries received via forms and the resulting correspondence: 24 months from the last contact. Thereafter we delete them or render them anonymous.
• Contracts, invoices and accounting records: 10 years, as required by Article 2220 of the Italian Civil Code.
• Access to the Private area: remains active for as long as needed for your stay and our relationship with you, and you may ask us to close it at any time. The documents it contains follow the retention periods stated above.
• Data belonging to special categories disclosed for a service: for the duration of that service.
• The record of choices regarding cookies: 5 years, the limitation period for administrative penalties (Article 28 of Italian Law 689/1981), in order to demonstrate consent for as long as it may be audited.
• Technical logs of providers: for the period specified in their terms. CARTO retains the network address stripped of its final section for 30 days.
• Cookies and other browser tools: for the durations set out in the cookie policy.

Your rights

You may ask at any time to access the data concerning you and obtain a copy, to rectify it, to erase it, to restrict its processing, and to receive it in a machine readable format to transfer it elsewhere (Articles 15 to 20 of the Regulation). You may object to processing based on legitimate interest (Article 21). Consent may be withdrawn at any time, and withdrawal does not affect the lawfulness of processing carried out beforehand: for cookies, simply use the Cookie preferences link at the bottom of each page.

To exercise any right, please write to info@theprimevillas.com. We will reply within one month; if the request is complex, this deadline may be extended by a further two months, and we will inform you within the first month.

If you consider that the processing of your data infringes the Regulation, you may lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it, or with the supervisory authority of the European Union Member State in which you reside or work.

Automated decisions

We do not make decisions concerning you solely by automated means. The party type recorded on the booking serves solely to display the most relevant services at the top of the Private area: it excludes nothing and alters neither prices nor conditions.

Minors

The website, forms and Private area are intended for adults. If we discover that we have received data relating to a minor without the consent of the person holding parental responsibility, we delete it.

Cookies and similar tools

What the website stores in your browser, and what is stored only with your consent, is detailed in the cookie policy, linked at the bottom of each page.

Changes to this privacy policy

We update this privacy policy whenever website services, providers or legal obligations change. The version in force is always this page. Last revised: 30 September 2026.