Green Magnolia S.r.l. a socio unico
Privacy notice
1. Data controller and contact details
Green Magnolia S.r.l. a socio unico
Via Europa 77, 25087 Salò (BS), Italia
VAT no.: 04462660988
Email: privacy@greenmagnolia.it
2. Data and purposes
Browsing involves technical data needed to deliver pages and protect the service, such as IP address, date, requested resource and browser information.
The website code does not include advertising scripts, profiling tools or social widgets. The hosting infrastructure services described in this notice and the optional map, loaded only with your consent, are separate.
If you contact us, we use the details and information you choose to provide to reply and handle your enquiry. Avoid unnecessary sensitive data.
3. Forms and provision of data
When you submit an enquiry form on this website, your name, email and message are transmitted to our OVHcloud server. The enquiry is recorded for follow-up and an email notification is prepared for the team through Microsoft 365. These details are not sent to the AI model. Submission is optional and requires acknowledgement of the privacy notice; without contact details we cannot reply. You may also email us directly.
4. Legal bases
Pre-contractual requests are handled under Article 6(1)(b) GDPR; other relevant communications and site security are based on the legitimate interest in responding, maintaining the service and preventing abuse (Article 6(1)(f)), subject to the rights of data subjects. Any legal obligations are based on Article 6(1)(c). Technical preferences remember choices requested by the user. General consent is not required to contact us.
External maps are optional and only load after a positive choice, which can be withdrawn at any time without affecting access to the location cards.
5. Recipients and hosting
The public website is hosted on OVHcloud Web Hosting in the Gravelines datacentre in France; technical file backups may be replicated in Roubaix, France. The Contact forms and the assistant’s “Send an enquiry” form submit enquiries to the private OVHcloud register. Enquiry notifications and AI summaries use a private email queue and Microsoft 365, as described in the assistant section.
Enquiries are handled by the controller and the people it authorises, within their respective duties.
We use OVHcloud for hosting and Google Workspace for company email. The providers and their subprocessors may process data needed to deliver, secure and support these services. Hosting files in Gravelines does not mean that all processing, including email and remote support, takes place exclusively in the European Union. Provider agreements specify adequacy decisions or standard contractual clauses, where applicable, for international transfers. The relevant data processing agreements and subprocessor lists are available through the links shown here; you can ask the controller for information about the safeguards applied. Microsoft 365 handles the technical sending of enquiry notifications and summaries from ciao@villaeuropahsiao.com. The Microsoft Products and Services Data Protection Addendum is available among the provider links.
Provider documentation
6. Retention
Email enquiries are accessible only to authorised staff. We retain them for the time needed to handle the enquiry and any resulting relationship, then delete them, except where legal obligations or documented needs to protect rights require retention.
The application does not keep a full chat archive. Enquiries, email summaries and security counters follow the retention periods in their respective sections. The application error log contains a date and a generic event code, without enquiry text, IP addresses or User-Agent. Hosting access logs are separate and managed by the OVHcloud infrastructure. Retention takes account of the time needed to provide the service, diagnose faults and handle incidents, together with applicable obligations. We do not state an unverified numerical retention period for raw logs; aggregated statistical reports and backups have separate periods.
For website files, OVHcloud documents restore points from 1, 2, 3, 7 and 14 days earlier. These technical copies restore files and are separate from the enquiry register and sending queues. Deleting content from the queue or application register does not automatically remove copies in mailboxes, provider backups or files exported by authorised staff. These copies are managed separately under the applicable criteria and the controller’s and providers’ procedures; we do not assign backups an unverified retention period. Restoring the register or queue must reapply the 90-day expiry for enquiries and seven-day expiry for pending emails.
OVHcloud provides technical statistics calculated from server logs after anonymisation and aggregation. They do not require an analytics script in the pages. Reports are available for up to 40 months; this period concerns statistical reports, not the retention of raw logs.
Preferences and the latest 20 choice records stay on your device and expire after six calendar months. When you make or change a choice, the website sends a technical record to the controller’s private consent register on OVHcloud, with an expiry of six calendar months.
7. Links and maps
Instagram, UNWINED, SUNAWI and other websites are external links. The card images are hosted locally: your browser contacts the destination only when you open the link. From that point, the chosen service’s policies apply.
If you enable maps, your browser requests images from tile.openstreetmap.org, sharing at least your IP address, the site origin and technical request data with OpenStreetMap Foundation. This site does not request your GPS location. You may decline and use the cards or ordinary directions links.
8. Rights and complaints
Where provided for by Articles 15–22 GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interest. Where applicable, you may withdraw consent without affecting the lawfulness of earlier processing. Write to the data controller’s email address above. You may lodge a complaint with the Italian Data Protection Authority or the competent authority. The site does not make automated decisions that produce legal or similarly significant effects.
AI assistant and team enquiries
You can choose to use an artificial intelligence assistant to explore the website’s content. The controller is Green Magnolia S.r.l. a socio unico. The service starts when you select “Start the conversation”; messages are transmitted to OpenAI’s APIs only when you send them. Avoid personal details, confidential information and other people’s data in the chat. Use the separate “Send an enquiry” form to leave contact details. After each AI exchange, a summary is also emailed to the team as described in the dedicated section.
We process messages to answer your enquiry. For information relating to a contract, the legal basis is Article 6(1)(b) of the GDPR; for other questions, our legitimate interest in responding under Article 6(1)(f). The assistant can make mistakes: it does not confirm orders or bookings, or make decisions with legal effects on people. We do not use conversations for behavioural analytics or marketing.
The copy displayed on your device remains in the page’s memory and is cleared by “New conversation” or by closing the page. OpenAI may retain content in security logs for up to 30 days, subject to legal or abuse-prevention exceptions; the provider’s documented technical retention also applies. We do not enable data sharing for model training.
Enquiries submitted through the forms are stored in a private register on OVHcloud, accessible only to authorised staff. Your name, email, message and any other contact details you provide are used to handle your enquiry and are not sent to the AI model. The enquiry expires in the register after 90 days. Expired records and expired email queues are cleaned up during ordinary service requests as well as scheduled maintenance; when there is no traffic, the maintenance job is needed. Expiry rules are reapplied after restoration. A notification containing the enquiry details is also prepared for info@greenmagnolia.it and sent through Microsoft 365 from ciao@villaeuropahsiao.com. The content needed for sending expires in the private queue after seven days and is removed when the email service accepts the message; acceptance does not guarantee delivery. If the notification cannot be queued or sent, the enquiry remains recorded and accessible to the team. Emails, including any Sent Items copies, are accessible only to authorised staff and retained to handle the enquiry and any resulting relationship, then deleted unless legal obligations or documented needs to protect rights require retention. Technical backups follow the periods described in this notice. Submission does not subscribe you to promotional communications.
We use OVHcloud and OpenAI’s APIs to provide this service. OpenAI’s data processing agreement for customers in the European Economic Area identifies OpenAI Ireland Ltd. and provides for standard contractual clauses or adequacy decisions, where applicable, for transfers outside the EEA. The agreement and subprocessor list are available through the links shown here. You can ask about the safeguards applied, exercise the rights described in this notice or contact us at privacy@greenmagnolia.it. You can continue browsing and contact us directly without using the assistant. Microsoft 365 handles the technical sending of enquiry notifications and summaries from ciao@villaeuropahsiao.com. The Microsoft Products and Services Data Protection Addendum is available among the provider links.
The summary is generated automatically and filtered before it enters the queue and again before sending: the filter masks recognised formats of email addresses, phone numbers, URLs, IBANs, payment details and credentials. It cannot guarantee recognition of every personal or confidential detail, so the summary should not be considered anonymous. It is not a full-transcript archive; names or other unrecognised details may remain in the summary. Avoid entering them in the chat. After each AI exchange, we email a summary of the question and reply to authorised staff to follow up on enquiries. The content needed for sending expires in the private OVHcloud queue after seven days; it is removed once the email service accepts the message, which does not guarantee delivery. Deleting content from the queue or application register does not automatically remove copies in mailboxes, provider backups or files exported by authorised staff. These copies are managed separately under the applicable criteria and the controller’s and providers’ procedures. Restoring the register or queue must reapply the 90-day expiry for enquiries and seven-day expiry for pending emails. Only authorised staff can access emailed summaries. They are kept to handle the enquiry and any resulting relationship, then deleted unless legal obligations or documented needs to establish or defend a right require otherwise. They do not confirm an order, booking or follow-up. Technical sending uses Microsoft 365 through ciao@villaeuropahsiao.com. A copy may remain in Sent Items as well as in the recipient’s mailbox; the same access and retention rules apply to both. For information about the use of your data, email privacy@paeoniasrl.com.
When enabled, Cloudflare Turnstile in Managed mode protects starting a chat and submitting contact requests against automated abuse. It loads only after an explicit action on the relevant control; ordinary browsing does not start it. Cloudflare may receive your IP address, TLS and browser characteristics, User-Agent, public widget key and website origin. Our server verifies the temporary token without sending Cloudflare your name, email, request text or an additional visitor IP address. The application does not retain the token. This check relies on legitimate interests in security (GDPR Article 6(1)(f)); when enabled, it is required for the protected functions and is separate from marketing consent. You can use the email or phone contacts on the site if you do not want to load it or it does not work. Cloudflare acts as a processor for data needed for the check and as an independent controller for improving Turnstile, under its Privacy Addendum and privacy policy; those documents also describe international transfers and applicable safeguards.
To limit assistant abuse, we keep counters linked to an IP-derived HMAC pseudonym that changes each UTC day, without raw IP addresses, User-Agent or messages in the counters. Previous-day data is removed during subsequent requests or maintenance. The temporary session token is valid for 30 minutes and remains in the page’s memory. Consent-service counters, described in the privacy choices section, are separate. Hosting logs follow the criteria described in this notice.
OpenAI · Data Processing Addendum · OpenAI · Sub-processors · OpenAI · Data controls · Microsoft 365 · DPA · Cloudflare: privacy and spam verification — Turnstile · Cloudflare: privacy and spam verification · Cloudflare: privacy and spam verification — Cookie
Managing and demonstrating privacy choices
On public domains hosted by OVHcloud, when you make or change a choice, the website sends a technical record to its own server: a random identifier, website, notice version, date, action, optional-service choice and expiry. The application register does not store your IP address, browser information, email or message contents. Hosting logs, described separately, may contain IP addresses and request data. Separately from receipts, the consent service limits abuse using counters linked to an HMAC pseudonym derived from the IP address (the /64 prefix for IPv6), with a random key renewed each UTC day. These counters do not persist the original IP address, User-Agent or message content. Previous-day counters are deleted on the next access to the consent service or by scheduled maintenance. Without access or maintenance, they may remain until either activity resumes. They are not used for profiling or advertising.
These records are used to manage and demonstrate privacy choices and withdrawals. Demonstrating consent fulfils the controller’s duties under GDPR Articles 5(2) and 7(1); the records are not used for advertising, profiling or behavioural analytics.
External maps are enabled only with consent (GDPR Article 6(1)(a)). Evidence of consent and withdrawal is retained to meet the obligation to demonstrate consent under Article 7(1), on the basis of Article 6(1)(c). Recording a refusal serves the legitimate interest in respecting the choice and keeping preferences working (Article 6(1)(f)), without enabling optional services.
Choice records expire after six calendar months. At expiry they are no longer used to manage preferences. Expired files are deleted progressively during subsequent reads of the register and recording of new choices, with cleanup split into groups of files. Until cleanup is completed, and during periods without traffic, expired data may remain in the files. This period is an operational choice for managing preferences; it is separate from the retention criteria for emails and hosting logs.
The register is stored outside the website’s public folder and is accessible only to authorised staff and technical providers authorised for the service. It is not sent to OpenStreetMap or social websites. For requests concerning your data, contact the controller identified in this notice.
OpenStreetMap map images are served through a global server network. Request data may therefore be processed outside the European Economic Area, as described in the provider’s privacy policy. This map remains optional, and you can use the written addresses without enabling it.