PRIVACY POLICY
Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679
Last updated: [30/04/2026]
This privacy notice describes how the website levillagespa.com collects and processes the personal data of users who browse the website, use online services, submit booking requests, purchase products or interact with the content, forms, online shop and AI chatbot available on the website.
- Data Controller
The Data Controller is:
2KEYS SRL
Via Roma 9/B
12015 Limone Piemonte
VAT No. 03661750046
Email:
Website: https://www.levillagespa.com
For any request relating to the processing of personal data, the Data Controller may be contacted at the email address indicated above.
- Types of data collected
The website may collect the following categories of personal data:
navigation data, such as IP address, browser technical data, operating system, access time, pages visited and technical information necessary for the functioning of the website;
data voluntarily provided by the user, such as name, surname, email address, telephone number, shipping address, billing address, any notes entered in request forms, during the order process or in communications with the facility;
data relating to orders and bookings, such as products or services requested, amounts, shipping methods, preferences indicated by the user, request history and operational communications;
data entered by the user in the AI chatbot, including messages, requests, information voluntarily provided during the conversation and any contact details communicated;
transcripts of conversations with the AI chatbot, which may be sent by email to the Data Controller or to the persons appointed to manage the requests;
data collected through cookies and similar tools, as specified in the Cookie Policy further down this page.
- Purposes of processing
Personal data are processed for the following purposes:
to manage browsing and the correct technical functioning of the website;
to respond to requests for information, contact, booking or assistance;
to manage online orders, shipping requests, booking requests, deliveries, administrative and operational communications;
to manage conversations started through the AI chatbot and provide automatic or assisted replies to the user;
to receive by email the transcripts of conversations generated through the AI chatbot, in order to follow up on requests, improve the service, check any user needs and manage subsequent communications;
to comply with tax, accounting, administrative and legal obligations;
to improve the website, analyse aggregated browsing statistics and understand the use of online services through Google Analytics 4, where active and subject to proper consent management where necessary;
to display interactive maps or content connected to Google Maps, where present;
to use fonts and graphic resources through Google Fonts, where loaded from Google servers;
to redirect the user, where applicable, to connected external websites, including www.san-pietro.it.
- Legal basis for processing
The processing of data is based on the following legal bases:
performance of pre-contractual or contractual measures, when the user requests information, books services, places an order, purchases products or interacts with the AI chatbot to receive information or assistance;
legal obligation, for the management of tax, accounting, administrative and document retention obligations;
legitimate interest of the Data Controller, to ensure security, prevent abuse, ensure the correct functioning of the website, manage ordinary business activities and receive and handle requests coming from the AI chatbot;
user consent, for the use of non-technical cookies and tracking tools, analytics services, maps or third-party services where required by applicable legislation.
- Methods of processing
Data are processed using IT, telematic and, where necessary, paper-based tools, adopting appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.
The website uses the HTTPS/SSL protocol to protect data transmission between browser and server.
Conversations with the AI chatbot may be processed automatically by the system and subsequently transmitted by email to the Data Controller or to authorised persons responsible for managing requests.
- Provision of data
The provision of the data requested in contact, booking or purchase forms is necessary in order to manage the user’s request. Failure to provide mandatory data may prevent the Data Controller from responding to the request, completing the order, managing the shipment or confirming the booking.
The use of the AI chatbot is optional. Users are invited not to enter sensitive data or information that is not necessary for handling the request during the conversation.
The provision of data for statistical or tracking purposes through non-technical cookies is optional and may be managed through the cookie banner or browser settings.
- AI Chatbot
The website may integrate an artificial intelligence-based chatbot, intended to provide information, preliminary assistance and browsing support.
During interaction with the chatbot, the user may voluntarily enter personal data, requests, preferences, contact details or other information useful for managing the conversation.
Conversations with the chatbot may be recorded in the form of a transcript and sent by email to the Data Controller or appointed staff, in order to:
review the user’s request;
provide a subsequent reply, if necessary;
manage requests for information, bookings or assistance;
improve the quality of the service offered;
check the correct functioning of the system.
Users are invited not to communicate through the chatbot data belonging to special categories, such as health data, highly personal information, data relating to minors, unnecessary financial data or other information exceeding what is required for the request.
- Disclosure of data to third parties
Personal data may be disclosed to external parties operating on behalf of the Data Controller or providing services necessary for the management of the website and business activities, including:
hosting and technical service provider, currently SiteGround;
providers of web services, maintenance, technical support and IT security;
technical provider or manager of the AI chatbot, if external to the Data Controller;
providers of email services used to send chatbot transcripts;
providers of payment, shipping, logistics or order management services, if used;
tax, administrative, legal or accounting consultants;
public authorities or authorised parties, where required by law;
Google Ireland Limited / Google LLC for services such as Google Fonts, Google Maps and Google Analytics 4, according to their respective terms and privacy policies.
External parties process data as Data Processors, independent Data Controllers or authorised persons, depending on the service provided and the applicable legal relationship.
- Hosting and place of processing
The website is hosted by SiteGround. Technical data and data relating to the functioning of the website may be processed through infrastructures and data centres used by the hosting provider.
- Transfer of data outside the European Economic Area
Some third-party services, in particular Google services or any services connected to the AI chatbot, may involve the transfer of, or access to, data from countries outside the EU/EEA.
In such cases, the transfer takes place according to the instruments provided for by applicable legislation, such as adequacy decisions, standard contractual clauses or other mechanisms recognised by Regulation (EU) 2016/679.
- Google Fonts
The website may use Google Fonts to improve the graphic rendering of texts. If the fonts are loaded directly from Google servers, the user’s browser may establish a connection with Google and transmit technical data, including the IP address.
- Google Maps
The website may integrate Google Maps widgets or maps to show the location of the facility or make it easier to reach the premises.
The integration of Google Maps may involve the transfer of data to Google and the use of cookies or similar technologies.
- Google Analytics 4
The website may use Google Analytics 4 to collect statistics on the use of the website, pages visited, interactions and content performance.
- Redirects to external websites
The website may contain links or redirects to external websites, including www.san-pietro.it. By clicking on such links, the user leaves levillagespa.com and accesses websites managed by third parties or connected entities.
The Data Controller is not responsible for processing carried out by external websites, which remain governed by their respective privacy and cookie policies.
- Data retention
Personal data are retained for the time necessary to achieve the purposes for which they were collected.
In particular:
data collected through contact or information request forms are retained for the time necessary to manage the request and any subsequent communications;
data relating to orders, purchases, bookings, invoices and administrative documentation are retained for the period required by applicable tax and civil law;
transcripts of conversations with the AI chatbot sent by email are retained for the time necessary to manage the request and subsequently according to the normal retention procedures for business communications;
technical security data and logs may be retained for the time necessary to ensure security, prevent abuse and guarantee the correct functioning of the website;
data collected through cookies are retained according to the durations indicated in the Cookie Policy and in the settings of the individual services.
- Rights of the data subject
The user may exercise at any time the rights provided for by Articles 15-22 of Regulation (EU) 2016/679, including:
right of access to personal data;
right to rectification of inaccurate data;
right to erasure of data, where applicable;
right to restriction of processing;
right to object to processing;
right to data portability;
right to withdraw consent, where processing is based on consent;
right to lodge a complaint with the Italian Data Protection Authority.
Requests may be sent to the email address
- Complaint to the Supervisory Authority
The user has the right to lodge a complaint with the Italian Data Protection Authority, based in Piazza Venezia 11, 00187 Rome, through the channels indicated on the official website www.garanteprivacy.it.
- Changes to this privacy notice
The Data Controller reserves the right to amend this Privacy Policy at any time, including following regulatory, technical or organisational changes.
The changes will be published on this page and will take effect from the indicated update date.
COOKIE POLICY
Last updated: [30/04/2026]
This Cookie Policy describes the use of cookies and similar technologies by the website levillagespa.com.
- What cookies are
Cookies are small text files that the websites visited send to the user’s device, where they are stored and then sent back to the same websites on the next visit.
Cookies may be used to make the website function correctly, remember preferences, collect statistics, enable third-party services or improve the browsing experience.
- Types of cookies used
The website may use the following categories of cookies.
Necessary technical cookies
These cookies are essential for the functioning of the website, browsing, security, session management, cart management, online orders, booking requests and the storage of preferences expressed by the user.
These cookies do not require the user’s consent, but must be indicated in the notice.
Functional cookies
These may be used to remember certain user preferences, such as language, website settings or choices made during browsing.
If not strictly necessary, they are managed according to the preferences expressed by the user.
Analytics cookies
The website may use Google Analytics 4 to collect aggregated statistics on website use, such as pages visited, time spent, traffic source and interactions.
If configured as tools that are not purely technical or with tracking identifiers, analytics cookies are activated only with the user’s prior consent.
Third-party cookies
The website may integrate third-party services that may install cookies or collect data through the user’s browser. These include:
Google Analytics 4, for browsing statistics;
Google Maps, to display maps and geographical directions;
Google Fonts, for the display of typefaces, if loaded from Google servers;
AI chatbot, to provide automated assistance and collect any user requests;
any services connected to the online shop, payment systems, shipping or booking.
- Google Analytics 4
Google Analytics 4 is an analytics service provided by Google that allows the Data Controller to understand how users interact with the website.
The information collected may include technical data, pages visited, browsing events, device used and interactions with the website.
The use of GA4 must be configured consistently with the user’s consent and with the privacy settings required by applicable legislation.
- Google Maps
The website may display interactive maps through Google Maps. Before the map is activated, the website may request the user’s consent, as the loading of Google Maps may involve the transmission of data to Google and the installation of cookies or similar tools.
- Google Fonts
The website may use Google Fonts. If the fonts are loaded from Google servers, the user’s browser may connect to Google servers to download the fonts.
- AI Chatbot
The website may integrate an AI chatbot to provide users with automated assistance, respond to information requests and facilitate browsing.
The chatbot may collect the messages entered by the user and generate a transcript of the conversation. This transcript may be sent by email to the Data Controller or to appointed persons, in order to manage the request, provide a possible reply and improve the service.
Depending on the technology used, the chatbot may use technical cookies, functional cookies or equivalent technologies necessary for its operation. If the chatbot uses third-party services, non-technical tracking tools or profiling systems, such tools must be activated only after the user’s consent.
Users are invited not to enter sensitive data or unnecessary information in the chatbot.
- Consent management
On first access to the website, the user may see a cookie banner that allows them to:
accept all cookies;
reject unnecessary cookies;
customise preferences by category;
modify or withdraw consent at a later time.
Necessary technical cookies are always active because they are essential for the functioning of the website. Analytics, marketing or unnecessary third-party cookies must be installed only after the user’s consent.
- Cookie duration
The duration of cookies varies according to the type and the service that installs them.
Session cookies are deleted when the browser is closed.
Persistent cookies remain stored for a period defined by the individual service.
Consent cookies may be stored to remember the preferences expressed by the user.
Google Analytics 4 cookies have a variable duration depending on the configuration adopted on the website and Google service settings.
Cookies or technical identifiers connected to the AI chatbot may have a variable duration depending on the configuration of the service.
- How to disable cookies from the browser
The user can also manage or delete cookies through their browser settings.
Disabling technical cookies may compromise the correct functioning of the website, cart, online orders, booking requests or AI chatbot.
- Indicative list of services used
Service: SiteGround
Purpose: hosting, security, technical management of the website
Type: technical / infrastructure service
Provider: SiteGround
Service: Google Fonts
Purpose: display of typefaces
Type: third-party service
Provider: Google
Service: Google Maps
Purpose: display of maps and location of the facility
Type: third-party service, potentially subject to consent
Provider: Google
Service: Google Analytics 4
Purpose: browsing statistics and traffic analysis
Type: analytics cookie/tool, to be managed through consent if not configured as technical
Provider: Google
Service: AI Chatbot
Purpose: automated assistance, collection of requests, sending transcript by email to the Data Controller
Type: functional service / possible third-party service, to be verified according to the technical configuration
Provider: Elfsight
Service: Online shop / booking system
Purpose: cart management, orders, booking requests, shipping and operational communications
Type: technical cookies and data voluntarily provided by the user
Provider: internal website system / any connected technical providers
- Changes to the Cookie Policy
The Data Controller reserves the right to amend this Cookie Policy at any time, including following technical changes to the website, the introduction of new services or regulatory updates.
