Privacy
This notice explains, in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), which personal data are processed when you visit this website or send an inquiry, why this happens and what rights you have.
Controller
Demetz Alexander
Mureda str. 105/D2
I-39046 Ortisei (BZ)
Phone: +39 331 35 88 705
E-mail: info@demetz-alexander.it
VAT-ID: 03018480214
1. Visiting the website
When you open the website, my hosting provider’s server automatically processes technical data sent by your browser: IP address, date and time of access, the page requested, referrer URL, browser type and version, and operating system. These data are needed to deliver the website, keep it secure and fix errors. The legal basis is my legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The logs are kept only as long as necessary for these purposes and are not combined with other data.
I do not use advertising pixels or embedded third-party content such as maps, videos or social media plugins. Fonts and all other files are loaded from my own server. The exceptions are Google Tag Manager and, only with your consent, Google Analytics (section 3).
2. Inquiries via the form or by email
If you write to me via the inquiry form or by email, I process the details you provide (such as name, email address, phone number, date, place, number of guests and your message) to answer your inquiry and prepare a quote. The legal basis is pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) and your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.
The form details are sent to me by email and also stored in a protected log file on the server so that no inquiry gets lost. To protect against automated spam, the form uses a hidden field and a timing check; if a submission is rejected, the IP address is noted in the server’s error log. No external services such as captchas are used.
I delete inquiries once they have been dealt with, unless statutory retention obligations apply. If a booking follows, I keep the necessary documents for the periods required by tax and commercial law.
3. Cookies, consent and statistics
Consent
On your first visit a banner asks whether I may use Google Analytics. Your choice is stored for 6 months in the cookie “ad_consent” so that I can respect it and prove it (Art. 6(1)(c) and (f) GDPR). You can change or withdraw it at any time under “Cookie settings” at the bottom of every page or in the cookie notice.
Google Tag Manager
The banner and the loading of Google Analytics are managed with Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager itself sets no cookies and creates no user profiles; when the script loads, Google processes your IP address for technical reasons. The legal basis is my legitimate interest in managing consent reliably (Art. 6(1)(f) GDPR).
Google Analytics 4, only with your consent
If you agree, I use Google Analytics 4 by Google Ireland Limited to understand how the website is used: which pages are visited, for how long, which links bring visitors here and which devices and browsers they use. For this, Google sets the cookies “_ga” and “_ga_1X6PKY0VCS” (expire after 2 years), which recognise returning visits under a pseudonym. Google uses your IP address only to derive your approximate location (country, region, city); according to Google it is neither logged nor stored. Google signals, the link to Google Ads and personalised advertising are switched off. Event data are deleted automatically after 2 months, user-level data after 14 months at the latest. A data processing agreement with Google is in place (Google Ads Data Processing Terms).
The legal basis is your consent (Art. 6(1)(a) GDPR and, for cookies, Art. 122 of the Italian Data Protection Code). Without consent, Google Analytics is not loaded. If you withdraw your consent, Google Analytics no longer runs and the website deletes the Analytics cookies. Google may also process data in the United States; Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision.
Other browser storage
So that the opening animation appears only once per visit, a small note is stored in your browser’s session storage (sessionStorage). It is deleted when you close the tab and is never sent to me. The password-protected client galleries use technically necessary cookies to keep you signed in during your visit. You’ll find the details in the cookie notice.
4. Recipients
I do not sell or rent personal data. Access is limited to service providers I need for my work, who are bound to confidentiality (in particular my hosting and email provider, and Google for consent management and, if you agree, for statistics) and, in the case of a booking, my tax advisor, as well as authorities where required by law. Should a provider process data outside the European Union, this only happens with appropriate safeguards under Art. 44 ff. GDPR, such as the EU standard contractual clauses.
5. Encryption
The website is delivered over an encrypted connection (TLS), recognisable by “https://” and the padlock symbol in the address bar. Data you send via the form cannot be read by third parties.
6. Your rights
You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw your consent at any time (Art. 7(3)). A short message to the address above is enough.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR); in Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it).
7. Changes
I update this notice when the website or the legal requirements change. The version published here applies.