PRIVACY POLICY

Data Controller

The data controller for personal data processed through this Website is:

Andrea Bartoli / SEA-WEB

For privacy-related enquiries and requests, please contact: andrea.bartoli@sea-web.it.

The professional/business address and VAT number are not published in this Website Privacy Policy pursuant to the Owner's publication decision. This does not alter any information that may be required in other legally applicable business or contractual documentation.

Scope

This Privacy Policy describes the processing of personal data carried out through theolivegroveweddingestate.com, with particular reference to enquiries submitted through the Website's Inquire page.

It also describes the currently verified use of consent-management and advertising-measurement technologies on the Website.

Enquiries and the Inquire Form

The Website allows prospective clients to submit enquiries concerning The Olive Grove Collection, its wedding estates and related wedding or event services.

Users provide the information requested by the form voluntarily. The information is used to receive the enquiry, assess the request, communicate with the prospective client and, where appropriate, prepare or discuss a tailored proposal.

Processing workflow

• submission through the Website Inquire form;
• storage of the submission inElementor Submissionswithin WordPress;
• delivery of the enquiry toinfo@theolivegroveweddingestate.com;
• delivery of a copy toandrea.bartoli@sea-web.it;
• subsequent direct communications relating to the enquiry.

No automatic transfer of Inquire submissions to an external CRM or automated lead-management platform has been verified in the current Website configuration.

Legal basis

To the extent that processing is necessary to respond to a request made by the user and to take steps at the user's request before potentially entering into a contract, the processing is based onArticle 6(1)(b) GDPR.

Where processing is instead necessary for related administrative, security or organisational purposes that are not required in order to take such pre-contractual steps, the applicable basis must be assessed according to the specific processing activity and may include a legitimate interest under Article 6(1)(f) GDPR, where the relevant requirements are satisfied.

Consent to cookies is not treated as the legal basis for the ordinary handling of a user-initiated wedding enquiry.

Retention

Enquiry emails and Elementor Submissions are retained for 24 months from the last interaction with the prospective client.

If an enquiry results in a contractual relationship, information that becomes part of contractual, accounting, tax or other legally relevant records may be retained separately for the periods required by the applicable obligations.

Hosting and Email Infrastructure

The Website usesAruba — Hosting WordPress Gestito Smart.

The email infrastructure used for the Website enquiry workflow is also provided byAruba.

The controlled factual review supports Aruba's role as a processor for the relevant hosting service and supports the use of Italian data centres for the hosting/email services reviewed.

This Policy does not make an absolute statement that personal data can never be transferred outside the European Economic Area, because the final transfer analysis must take into account every processor and technology actually involved in a specific processing operation.

Cookies and Consent Management

The Website usesComplianzfor consent management and cookie blocking.

• EU / GDPR regime configured;
• consent banner enabled;
• Cookie Blocker enabled;
• advertising scripts declared as present;
• Website statistics declared as not collected through the Complianz statistics configuration;
• no additional TCF framework enabled;
• Amazon Consent Signal disabled.

The consent banner has been manually validated in a fresh browser context after the relevant configuration remediation and cache purge. The banner was displayed, Accept Allremoved the banner correctly, and the Inquire page remained normally accessible afterwards.

Users may use the controls provided by the consent-management interface to make or change the choices made available by the Website.

Google Tag Manager and Google Ads

The Website currently uses Google advertising-measurement technology.

• Google Tag ManagerGTM-W9X66BFG
• Google Ads destinationAW-18401207097
• Website eventtog_inquire_form_success

A Google Ads conversion measurement is associated with a successful submission of the Website Inquire form.

The eventtog_inquire_form_successmeans only that the Website has technically registered a successful Inquire-form submission.

It does not by itself establish that the enquiry is a valid or qualified lead, an opportunity, a booking, revenue, a confirmed wedding or any other commercial outcome.

Controlled runtime validation found no actual tog_inquire_form_successdataLayer event and no governed conversion request on ordinary page loads where no form was submitted.

Purpose

The verified purpose of this implementation is to measure successful Website enquiries in connection with Google Ads advertising activity and to support advertising performance measurement.

Consent and legal basis

Where Google advertising technologies store or access information on a user's device, or otherwise perform processing for which consent is required under the applicable ePrivacy/GDPR framework, those operations must be subject to the user's applicable consent choice through the Website consent-management mechanism.

The exact Google processing operations, Google controller/processor roles, applicable transfer mechanisms and any further advertising functionality must be described consistently with the Google services actually enabled at the time of publication.

Google Analytics

No activeGA4 Measurement IDwas observed during the controlled runtime validation of the current production baseline.

Google Analytics / GA4 is therefore not described in this Policy as a verified active Website analytics service.

If Google Analytics or another analytics service is subsequently activated, this Policy and the Website consent configuration must be reviewed before relying on the present wording.

Other Third-Party Content and Services

Within the verified current Website processing inventory, the following embedded services have not been established as active:

• Google Maps embeds;
• YouTube or Vimeo embeds;
• social-media widgets or embedded social feeds;
• reCAPTCHA.

This section must be reviewed whenever Website functionality changes.

Recipients and Processors

Personal data may be processed by service providers that support the Website and communications infrastructure, within the scope necessary for the services they provide.

The verified current infrastructure includesArubafor the relevant Website hosting and email services.

Google-related processing associated with the verified Google Tag Manager / Google Ads implementation must be represented according to the actual Google service terms and processing configuration applicable at publication time.

No external CRM or automated lead-transfer platform has been verified for the Inquire workflow.

International Data Transfers

The controlled review of the Aruba hosting/email scope did not establish a current extra-EEA transfer as a factual condition of those reviewed services.

Google advertising technologies may involve processing within an international service infrastructure. The applicable contractual/privacy framework and transfer safeguards therefore depend on the Google services and configuration actually in use.

No absolute statement that the Website makes no international transfersis made.

Data Subject Rights

Subject to the conditions and limitations established by the GDPR, individuals may have the right to:

• obtain confirmation as to whether personal data concerning them is being processed and obtain access to that data;
• request rectification of inaccurate personal data;
• request erasure where the applicable conditions are met;
• request restriction of processing where the applicable conditions are met;
• object to processing based on legitimate interests where applicable;
• request data portability where Article 20 GDPR applies;
• withdraw consent at any time where processing is based on consent, without affecting prior lawful processing;
• lodge a complaint with the competent supervisory authority.

In Italy, the supervisory authority is the Garante per la protezione dei dati personali.

Requests concerning personal data may be sent to andrea.bartoli@sea-web.it.

The verified person responsible for handling such requests is Andrea Bartoli.

Security and Data Management

The Website and its supporting services use technical and organisational measures appropriate to the relevant systems and processing context.

This Policy does not claim that any Website or electronic transmission is absolutely secure.

Access to personal data should be limited to persons and providers who require it for the relevant processing purposes.

Changes to this Privacy Policy

This Privacy Policy should be reviewed whenever a material change affects Website processing, including changes to:

• forms or enquiry workflows;
• processors or recipients;
• analytics technologies;
• advertising or conversion-measurement technologies;
• consent-management configuration;
• embedded third-party services;
• retention periods;
• CRM or automation integrations.