Privacy policy
Pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR).
Sunscape S.r.l. (hereinafter also "Sunscape" or "Controller") recognises the importance of protecting personal data and is committed to processing them in compliance with EU Regulation 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 ("Italian Privacy Code"). This notice describes how personal data collected via www.sunscape.it are processed.
1. Data Controller
The Data Controller is Sunscape S.r.l.:
- Registered office: Via Nicolò Putignani 12/A, 70121 Bari (BA)
- VAT no.: 08746590721
- Tax code: 08746590721
- REA no.: BA - 647246
- Share capital: 10.000,00 € i.v.
- Certified email (PEC): amministrazione@pec.sunscape.it
- Email: info@sunscape.it
2. Data Protection Officer (DPO)
The Controller has not appointed a DPO, as none of the conditions set out in Article 37 GDPR apply. For any request regarding the processing of personal data, please contact the Controller directly at info@sunscape.it.
3. Categories of data processed
Depending on the service requested, we collect:
a) Contact data— via the "Contacts" form: first name, last name, email, phone number, message content.
b) Landowner data— via the "Sell your land" form: first name, last name, email, phone, region/province/municipality of the land, surface, cadastral data (section, sheet, parcel) and other voluntarily provided information.
c) Application data — via the "Work with us" form: first name, last name, email, phone, message, CV attachment. The CV may contain further personal data (professional experience, education, image). Please do not include in your CV special categories of data (Article 9 GDPR — origin, health, political opinions, etc.) unless strictly necessary.
d) Navigation data — IP address, browser type, operating system, pages visited, referrer, access time. Processed within the limits of cookie law (see Cookie Policy).
4. Purposes of processing, legal basis and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Reply to contact requests | Art. 6.1.b GDPR — pre-contractual measures | 24 months from receipt |
| Assess land suitability and contact the owner | Art. 6.1.b GDPR — pre-contractual measures | 5 years from collection (typical development/permitting cycle) |
| HR selection and applications management | Art. 6.1.b GDPR + Art. 111-bis Italian Privacy Code | 24 months (Garante recommendation for unsolicited CVs) |
| Newsletter and promotional communications | Art. 6.1.a GDPR — explicit consent | Until consent is withdrawn |
| Accounting and tax obligations | Art. 6.1.c GDPR — legal obligation | 10 years (Art. 2220 Italian Civil Code) |
| Defence in court | Art. 6.1.f GDPR — legitimate interest | Applicable statute of limitations |
5. Mandatory or optional nature of the data
Providing the data marked as required in the forms is necessary in order to process the request: refusal makes it impossible to fulfil what is requested. Consent for marketing purposes is optional: failure to give it does not affect the main service.
6. Recipients of the data
The data may be shared with the following categories of recipients:
- Authorised personnel of Sunscape (employees, collaborators), properly trained
- External data processors appointed under Article 28 GDPR, in particular:
- Website hosting provider
- Transactional email service
- Cookiebot (Cybot A/S, Denmark) — cookie consent management
- Intuition Machines, Inc. (USA) — hCaptcha anti-spam service
- Google LLC / Google Ireland Ltd — Google Analytics, Tag Manager, Maps, Fonts
- Meta Platforms Ireland Ltd — Meta Pixel
- Legal, tax and accounting consultants
- Competent authorities upon lawful request
The data are not disclosed nor sold to third parties for autonomous marketing purposes.
7. Transfer of data outside the EU
Some providers (Google LLC, Meta Platforms, Intuition Machines) may process data in countries outside the European Economic Area, particularly the United States. Transfers are based on appropriate safeguards under Article 46 GDPR, in particular:
- Standard Contractual Clauses approved by the European Commission (Art. 46.2.c GDPR)
- EU-US Data Privacy Framework, for certified providers
A copy of the clauses or specific references may be requested by writing to info@sunscape.it.
8. Processing methods and security
Data are processed using electronic and paper means, adopting appropriate technical and organisational measures (Art. 32 GDPR) to prevent loss, unauthorised access, alteration or destruction: encryption in transit (HTTPS), access control, regular backups, staff training.
9. Data subject rights
You may exercise the rights provided by Articles 15-22 GDPR at any time:
- Access to your data (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure — "right to be forgotten" (Art. 17)
- Restriction of processing (Art. 18)
- Portability of data in a structured format (Art. 20)
- Objection to processing (Art. 21)
- Withdrawal of consent at any time (Art. 7.3), without prejudice to the lawfulness of processing carried out before withdrawal
To exercise your rights please write to info@sunscape.it specifying the request and attaching an identity document. We will reply within 30 days.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it).
10. Changes to this notice
Sunscape reserves the right to update this notice to reflect regulatory, organisational or technical changes. The current version is always published on this page with the date of the last update.
Last updated: May 2026