Privacy Policy

Privacy notice concerning the processing of personal data of users of www.fayoromaison.com, pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”).

Draft date: 9 October 2026 · Update this date when publishing the final version.

1. Data controller and contact details

FAYORO MAISON Srl
Registered office: Via Monte Rosa 11, 47838 Riccione (RN), Italy.
Operational headquarters: Via della Lontra 43, 47923 Rimini (RN), Italy.
Telephone: +39 335 6072608
Website: www.fayoromaison.com

Requests concerning the protection of personal data may be addressed to the Controller at its registered office, marked “Privacy request”.

TO BE COMPLETED: add the email address the company intends to use for privacy requests. If a Data Protection Officer (DPO) has been appointed, also include their contact details. Neither the presence nor the absence of a DPO has been assumed.

2. Personal data processed

Processing may concern individuals who visit the website or contact FAYORO MAISON, including company contacts and representatives.

Data supplied in enquiries: information entered into form fields or provided voluntarily, such as first name, surname, company, email address, telephone number, message content and any attachments.
Browsing data: technical data that may be recorded by the website and hosting systems, such as IP address, the date and time of requests, resources accessed, request outcomes and information about the browser or device.
Cookie preferences: information needed to manage and remember choices made through the consent banner.

TO BE CONFIRMED: check the actual form fields, whether enquiries are stored in the WordPress database, log settings and any other data collected by integrated services. Supplement this notice if accounts, newsletters, purchases or other processing activities are enabled.

3. Purposes and legal bases

Personal data is processed to handle enquiries, enable the website to operate and protect its systems. The legal basis depends on the purpose and the relationship with the individual concerned.

Purpose	Legal basis
Responding to requests for information, availability or quotations made by the individual with a view to entering into a contractual relationship.	Steps taken at the individual’s request prior to entering into a contract: Article 6(1)(b) GDPR.
Managing contacts and correspondence with company representatives.	Legitimate interest in managing business relationships and responding to enquiries: Article 6(1)(f) GDPR.
Maintaining system operation and security, identifying faults and preventing abuse.	Legitimate interest in protecting the website and communications: Article 6(1)(f) GDPR.
Complying with applicable legal obligations, including requests to exercise data protection rights.	Legal obligation: Article 6(1)(c) GDPR.
Establishing, exercising or defending a legal claim, where necessary.	Legitimate interest in protecting the Controller’s rights: Article 6(1)(f) GDPR.

For cookies or tracking tools requiring consent, the choice is collected through the banner and may be changed. The specific purposes must be set out in the Cookie Policy and in the information relating to the services actually used.

TO BE CONFIRMED: verify that these purposes correspond to the actual processing activities. If newsletters, marketing, analytics or embedded services are present, add their purposes, legal bases and choice mechanisms; do not treat them as covered by the handling of a contact enquiry alone.

4. Providing personal data

Submitting an enquiry is optional. Fields marked as required in the form are needed to handle the enquiry and provide a response; without this information, it may not be possible to reply. Other fields are optional.

Cookie preferences are managed separately from contact enquiries. The provision of data for any additional purposes must be specifically described in the relevant notices.

5. How personal data is processed

Personal data is processed using electronic tools and, where necessary, paper records, by authorised personnel or parties entrusted with managing the services. The Controller adopts technical and organisational measures appropriate to the risk to protect personal data against unauthorised access, loss and unlawful use.

6. Recipients of personal data

Within the scope of their respective activities, personal data may be accessible to authorised personnel and providers of hosting, website maintenance, IT support and email services. Providers processing personal data on behalf of the Controller must be engaged as data processors where the conditions of Article 28 GDPR apply.

Data may also be disclosed to professional advisers or authorities where necessary to comply with legal obligations or protect rights. The roles and recipients associated with external services must be determined according to the actual configurations and agreements in use.

TO BE COMPLETED: identify the actual providers. The purchase of Aruba Hosting Easy Linux is known, but it must be confirmed that this service hosts the public version of the website. Also identify the form’s email/SMTP service and any analytics, maps, video, antispam or newsletter providers.

7. Data retention

Personal data must be retained for periods consistent with the purposes of processing, applying the following periods or criteria:

Enquiries not followed by a contractual relationship: PROPOSAL TO BE CONFIRMED: up to 12 months after the last interaction relating to the enquiry, unless a specific documented retention need applies.
Enquiries resulting in a contractual relationship: relevant documents are retained to manage the relationship and for the periods required by the legal obligations actually applicable.
Technical and security logs: TO BE COMPLETED: specify the actual retention periods for website, provider and security-system logs, including any extensions justified by incidents.
Cookies and preferences: according to the actual durations stated in the Cookie Policy and the consent platform settings.

Where needed for a dispute, only relevant data may be retained until the dispute is resolved and for any further applicable periods. At the end of the retention period, data must be deleted or anonymised; any backup copies must follow their replacement cycle.

TO BE CONFIRMED: the 12-month rule should be adopted only if it is feasible and consistent with the company’s needs. Check copies in email accounts, enquiries saved by Elementor and backup retention periods; specify the periods applicable to any contractual documents collected through the website.

8. Cookies and consent management

The website uses Complianz to manage the cookie banner and cookie preferences. The list of cookies and services, their purposes and durations, and how to change your choices are set out in the Cookie Policy (EU).

Necessary technical cookies do not require prior consent. Tools requiring consent must only be activated after a valid choice by the user. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

TO BE CONFIRMED: verify the preference-management function, the prior blocking of services and whether the scan matches the services actually loaded. The English Cookie Policy link uses the proposed address /en/cookie-policy-eu/; confirm or replace it with the actual address of the English page before publication.

9. Transfers outside the European Economic Area

SECTION TO BE COMPLETED AFTER CHECKING THE PROVIDERS: no statement has been made that international transfers do not occur. Specify whether transfers occur, which services and countries are involved, the adequacy decision or safeguards actually applicable, and how to obtain a copy. If no transfers occur, state this only after checking hosting, email, support and all integrated services.

10. Your rights

In the circumstances and within the limits provided by the GDPR, you may request access to your personal data, rectification, erasure and restriction of processing. You may obtain data portability where processing is based on consent or a contract and is carried out by automated means.

For processing based on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time without having to give a reason.

Where the legal basis is consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Requests may be sent using the Controller’s contact details given in this notice.

You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the competent supervisory authority under Article 77 GDPR, and seek a judicial remedy.

11. Automated decision-making and profiling

TO BE CONFIRMED: check whether decisions are made solely on the basis of automated processing that produce legal effects or similarly significant effects. If so, describe the logic, consequences and safeguards; otherwise, state that no such decisions are made. Separately check any advertising profiling and describe it in the relevant sections, without confusing it with these decisions.

12. Updates to this privacy notice

This notice may be updated if processing activities, services used or applicable rules change. The updated version and its date will be available on this page.