Privacy & Data Governance Policy

Effective Date: January 1, 2026 | Last Updated: February 2026

1. Introduction and Scope

Cielo Milano Hospitality & Media S.r.l. ("Cielo Milano", "we", "us", or "our"), operating the digital property Viblybuzzpockt.cyou, is deeply committed to upholding the privacy, dignity, and digital sovereignty of every visitor, guest, and concierge client. This policy provides a comprehensive, rigorous disclosure of our practices regarding the acquisition, safeguarding, processing, and transfer of Personal Data in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR), the Italian Personal Data Protection Code (Legislative Decree no. 196/2003 as amended by Legislative Decree no. 101/2018), and relevant international privacy statutes such as the California Consumer Privacy Act (CCPA/CPRA).

2. Data Controller & Data Protection Officer (DPO)

The Data Controller responsible for all processing activities conducted through this website is:
Cielo Milano Hospitality & Media S.r.l.
Registered Office: Via Montenapoleone 8, 20121 Milano (MI), Italy.
Italian VAT & Company Registration No.: IT-09823410965.
Official Contact Email: [email protected]

Our designated Data Protection Officer oversees compliance with EU data protection regulations. Inquiries may be addressed to [email protected].

3. Categories of Personal Data Collected

We only collect personal information that is strictly necessary for delivering editorial publications, handling table reservations, and fulfilling concierge requests. Categories include:

Voluntarily Submitted Data: Full legal name, professional email address, telephone contact number, preferred dining dates, seating preferences, and special VIP concierge requests submitted through our contact and reservation forms.
Automated Technical Identifiers: IP addresses, browser user-agent tokens, operating system profiles, referrers, page interaction durations, and WebGL capability telemetry collected automatically when interacting with our spatial graphics.
Cookie & Tracking Data: Strictly essential session markers and anonymous telemetry tokens detailed in our standalone Cookie Policy.

4. Legal Bases for Data Processing

In accordance with Article 6 of the GDPR, processing of personal data is carried out exclusively under the following valid legal bases:

Contractual Necessity (Art. 6(1)(b)): To process concierge inquiries, secure table arrangements, and fulfill user requests.
Consent (Art. 6(1)(a)): For non-essential cookies and direct newsletter correspondence, obtained via verifiable affirmative action.
Legitimate Interests (Art. 6(1)(f)): For safeguarding system security, preventing fraudulent activity, and optimizing website speed and visual rendering.
Legal Obligation (Art. 6(1)(c)): To maintain mandatory tax and fiscal records under Italian statutory law.

5. Third-Party Service Providers and International Transfers

We do not trade, sell, or rent personal data to marketing brokers. We work with strictly vetted technical infrastructure partners, including European cloud infrastructure providers, secure mail delivery gateways, and WebGL asset distribution networks. In cases where data is processed outside the European Economic Area (EEA), transfers are governed by European Commission Standard Contractual Clauses (SCCs) to assure equivalent protection.

6. Data Retention Protocols

Personal data is stored only for as long as is necessary to satisfy the objectives for which it was gathered:

Concierge and reservation communications are retained for twenty-four (24) months from conclusion of the inquiry.
Technical access logs and security telemetry are purged systematically within ninety (90) days.
Tax-related invoicing data is preserved for ten (10) years in accordance with Italian Civil Code requirements.

7. Your Rights Under the GDPR & International Law

As a data subject, you possess enforceable legal rights regarding your personal information:

Right of Access (Art. 15): Obtain confirmation as to whether your data is being processed, and receive a portable copy.
Right to Rectification (Art. 16): Require immediate correction of inaccurate or incomplete records.
Right to Erasure ("Right to Be Forgotten", Art. 17): Request deletion of your personal data when no legal retention obligation exists.
Right to Restriction of Processing (Art. 18): Restrict processing under specified legal circumstances.
Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
Right to Object (Art. 21): Object to processing carried out under the legitimate interest framework.
Right to Lodge a Complaint: You have the right to lodge a complaint with the Italian Data Protection Supervisory Authority (Garante per la protezione dei dati personali — www.garanteprivacy.it).

8. Exercising Your Data Subject Rights

To execute any of the above rights, submit your request to: [email protected]. In accordance with Article 12 GDPR, requests are acknowledged and addressed within thirty (30) calendar days without fee.