Privacy Policy
Ca’Øriginale · Version 01 · 9 July 2026
This Privacy Policy describes how Ca’Øriginale collects, uses, stores and protects the personal data of users, End Clients, visitors, newsletter subscribers and parties who interact with the Platform.
This notice is provided pursuant to EU Regulation 2016/679 (GDPR) and the applicable Italian legislation on the protection of personal data.
1. Data controller
The data controller is:
- Buscaroli Studio, Luana Buscaroli
- VAT no.: IT12788670961
- Registered office: Via Nazario Sauro 83, 20025 Legnano (MI), Italy
- E-mail: info@buscarolistudio.com
2. Scope of application
This Privacy Policy applies to the caoriginale.com website, the Ca’Øriginale Platform and other connected channels, including, by way of example:
- a) website;
- b) editorial pages;
- c) Partner directory and profiles;
- d) contact or request forms;
- e) newsletter;
- f) concierge services;
- g) communications via email or other channels;
- h) any booking, payment or members area tools.
3. Personal data processed
Ca’Øriginale may process the following categories of personal data.
3.1. Data provided directly by the user
- a) first and last name;
- b) email address;
- c) telephone number, where provided;
- d) country, city or preferred language;
- e) content of messages sent via forms, email or other channels;
- f) requests relating to products, services, experiences, Partners, travel, concierge or partnerships;
- g) data necessary to handle a booking, request, purchase or contact with a Partner;
- h) preferences, interests or information voluntarily provided by the user.
3.2. Technical and browsing data
- a) IP address;
- b) browser and device type;
- c) operating system;
- d) browser language;
- e) pages visited;
- f) date and time of the visit;
- g) interactions with the site;
- h) technical cookies and preferences, as indicated in the Cookie Policy.
3.3. Data relating to newsletter and communications
- a) email address;
- b) subscription consent;
- c) date and time of subscription;
- d) any communication preferences;
- e) technical data relating to the receipt of or interaction with communications, where available.
3.4. Data relating to account or members area
If the user creates an account or accesses a reserved area, Ca’Øriginale may process:
- a) identifying data;
- b) technical access credentials handled by the authentication provider;
- c) data relating to the account;
- d) history of requests, preferences or interactions with the Platform, where applicable.
4. Purposes of processing
Personal data may be processed for the following purposes:
- a) to enable browsing and the correct functioning of the Platform;
- b) to respond to requests sent via the site, email, forms or other channels;
- c) to handle requests relating to Partners, products, services, experiences, bookings or concierge;
- d) to facilitate contact between End Client and independent Partners;
- e) to transmit to Partners the information necessary to handle requests, orders, bookings, assistance or services;
- f) to send newsletters, editorial updates or promotional communications, where permitted;
- g) to manage accounts, members area or user preferences;
- h) to improve the functioning, security and experience of the Platform;
- i) to prevent fraud, abuse, unauthorised access or unlawful use;
- j) to comply with legal, tax, accounting or regulatory obligations;
- k) to protect the rights, security, reputation and legitimate interests of Ca’Øriginale, the Partners, users or third parties.
5. Legal basis for processing
Ca’Øriginale processes personal data on the basis of one or more of the following legal bases:
- a) performance of pre-contractual or contractual measures, when processing is necessary to respond to a request, manage an account, facilitate a booking, purchase or service requested by the user;
- b) consent, for sending newsletters, promotional communications or any non-essential cookies;
- c) legal obligation, when processing is necessary to comply with obligations provided for by law;
- d) legitimate interest, for site security, prevention of abuse, ordinary management of the Platform, protection of rights, improvement of the service and communications relating to requests already initiated, always in compliance with the fundamental rights and freedoms of the data subject.
European rules provide for various legal bases for the processing of data, including consent, contract, legal obligation and legitimate interest.
6. Sharing of data with the Partners
When the End Client sends a request, makes a booking, purchases or expresses interest in a Partner’s Offering, Ca’Øriginale may share with the Partner the data necessary to handle that request, booking, purchase, service or assistance.
Such data may include, by way of example:
- a) first and last name;
- b) email address;
- c) telephone number, where provided;
- d) content of the request;
- e) information necessary for the booking, purchase or enjoyment of the Offering;
- f) any preferences, restrictions, allergies, dietary needs, logistical information or other information voluntarily communicated by the user.
Unless otherwise stated, the Partner will act as an autonomous data controller for the activities carried out under its own responsibility, including the handling of orders, bookings, services, assistance, invoicing, cancellations, refunds and warranties.
The Partner will be responsible for the processing of personal data in accordance with its own privacy policy and applicable law.
7. Recipients and service providers
Personal data may be communicated or made accessible to:
- a) independent Partners, when necessary to handle requests, bookings, purchases or services;
- b) technical providers of the site, hosting, infrastructure, security and maintenance;
- c) authentication providers, where a members area is present;
- d) email, newsletter or CRM providers;
- e) payment or booking providers, where applicable;
- f) consultants, accountants, lawyers or other professionals, where necessary;
- g) public, judicial or administrative authorities, when required by law.
Such parties will process the data, as the case may be, as data processors, autonomous controllers or authorised parties.
8. Transfers outside the European Economic Area
Some technical providers or services used by Ca’Øriginale may process personal data outside the European Economic Area.
In such cases, Ca’Øriginale will adopt appropriate safeguards provided for by the GDPR, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission or other instruments permitted by applicable law. The European Commission provides for the use of Standard Contractual Clauses for international transfers of personal data where necessary.
9. Data retention
Personal data will be retained for as long as necessary for the purposes for which it was collected and, subsequently, for the period required by law or necessary to protect Ca’Øriginale’s rights.
In particular:
- a) data relating to requests and communications: for as long as necessary to handle the request and for any need to protect rights;
- b) data relating to bookings, purchases or services: for as long as necessary to manage the transaction and for applicable legal, tax or accounting obligations;
- c) newsletter data: until consent is withdrawn or unsubscribed;
- d) technical and security data: for as long as necessary to ensure security, functioning and prevention of abuse;
- e) account data: until the account is deleted, save for retention obligations or legitimate interests.
10. Newsletter and promotional communications
The user may subscribe to Ca’Øriginale’s newsletter to receive editorial content, updates, news, invitations, recommendations, offers or communications relating to the Platform.
Subscription to the newsletter is based on the user’s consent, where required.
The user may withdraw consent or unsubscribe at any time using the link present in the communications received or by writing to info@buscarolistudio.com.
The withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal.
11. Cookies and similar technologies
Ca’Øriginale uses cookies and similar technologies as described in the Cookie Policy.
Currently, according to the published Cookie Policy, Ca’Øriginale uses essential and preference cookies. Any analytics, marketing or third-party cookies will be used only within the limits and according to the methods provided for by applicable law and by the Cookie Policy.
12. Data security
Ca’Øriginale adopts reasonable technical and organisational measures to protect personal data from unauthorised access, loss, destruction, alteration, disclosure or improper use.
However, no computer system or online transmission can be considered completely secure. In the event of a personal data breach, Ca’Øriginale will act in accordance with applicable law. The Italian Data Protection Authority (Garante Privacy) indicates that, in the event of a data breach, the data processor must promptly inform the controller so that the required measures can be activated.
13. Rights of the data subject
The user, in the cases and within the limits provided for by the GDPR, may exercise the following rights:
- a) right of access to their personal data;
- b) right to rectification of inaccurate or incomplete data;
- c) right to erasure of data;
- d) right to restriction of processing;
- e) right to object to processing;
- f) right to data portability;
- g) right to withdraw consent, when processing is based on consent;
- h) right to lodge a complaint with the competent supervisory authority.
The Italian Data Protection Authority (Garante Privacy) indicates that the data subject may exercise the rights provided for by Articles 15-22 of the GDPR.
To exercise the rights, the user may write to: info@buscarolistudio.com
14. Complaint to the supervisory authority
The user has the right to lodge a complaint with the competent supervisory authority.
In Italy, the competent authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it).
The user remains free to contact the supervisory authority of their country of residence or of the place where they believe a violation has occurred.
15. Minors
The Platform is not intended for persons under 18 years of age.
Ca’Øriginale does not knowingly collect personal data of minors. Should Ca’Øriginale become aware of the processing of a minor’s personal data without an adequate legal basis, it will take reasonable measures to delete such data.
16. Links to third-party sites
The Platform may contain links to sites, pages, payment tools, booking systems, social media or services managed by Partners or third parties.
Ca’Øriginale does not control such sites or services and is not responsible for their respective privacy policies, cookie policies, conditions or methods of processing personal data.
The user is invited to read the privacy notices of the third parties with whom they interact.
17. Changes to the Privacy Policy
Ca’Øriginale may update this Privacy Policy for legal, technical, operational, commercial or organisational needs.
The updated version will be published on the Platform with an indication of the update date.
Use of the Platform after the publication of the new version constitutes acknowledgement of the updated Privacy Policy.
18. Contact
For questions relating to this Privacy Policy or the processing of personal data, you can contact Ca’Øriginale at the following address: info@buscarolistudio.com
In the event of any discrepancy between language versions, the Italian version prevails.