Privacy policy

Who processes your data

The data controller is Orion Management S.r.l., with registered office at Via Bagutta 13, 20121 Milano, VAT number IT02884310901, REA number MI-2773280, publishing this website, www.orionmanagement.it.

For any questions regarding this privacy policy, and to exercise your rights, you may write to info@orionmanagement.it or telephone +39 02 9865 0128.

Which data we process, and where they originate

Website forms. The enquiry form distinguishes guests from home owners. From guests, it requests a name, an email address and, optionally, a telephone number, the dates and a message; if you arrive from a service or a catalogue category, the message opens with its name, which you may alter. From home owners, here and on the owners page, it requests a name, an email address and, optionally, a telephone number and a message. The name and email address are necessary to reply to you, and without them the enquiry cannot be sent.

Together with the enquiry, we record the language of the page, the page from which it was sent, the website from which you write, the timestamp of submission with confirmation that you have read this privacy policy, and the browser type, which helps distinguish genuine enquiries from automated submissions. We do not record the network address of your device: while the server remains active, we keep a non reversible hash in memory, used to count requests over the last 10 minutes and prevent abuse.

Direct contact. If you write to us by email or on WhatsApp, or if you telephone us, we process the data you provide at that time: your name, contact details, and the content of your enquiry.

Cookie choices. When you respond to the cookie banner, the website records your choice together with a random identifier generated by your browser, the version of the cookie policy, the timestamp, the language, the page, and the browser type. The network address is not recorded. The cookie policy explains this in full detail.

Service requests. To organise a service, we process the information required for it: your name and contact details, the dates and location of your stay, the number of guests, your requirements, and the outcome.

Suppliers. Services are often carried out by suppliers with whom we work, such as a chef, a chauffeur, or a crew: they receive only the data required for that specific service. We also process the contact details of the suppliers and professionals with whom we collaborate, for the purposes of our business relationship.

Special categories of data. We do not ask you for data concerning health, religious beliefs, or other special categories (Article 9 of the Regulation). If you choose to share such information for a service, for example an allergy for the chef or mobility requirements for a transfer, we process it solely for that service, share it only with the supplier carrying it out, and solely with your explicit consent.

Home owners. Those who entrust the management of their home to us provide their contact details, details of the home, and the information necessary for the agreement.

Why we process them, and on what legal basis

• To respond to your enquiries and prepare a proposal: these are precontractual measures taken at your request (Article 6, paragraph 1, point b of Regulation (EU) 2016/679, the GDPR). The box you tick on the form confirms that you have read this privacy policy.
• To organise the services you request and for the management agreement for a home: this is the performance of a contract to which you are party (the same point b).
• For tax and accounting obligations arising from a contract: this is a legal obligation (point c).
• For the security of the website and forms, including the technical logs of our suppliers: this is our legitimate interest in providing a service that functions correctly and is not misused (point f). You may object at any time.
• For statistical purposes and marketing: solely with your consent, which you grant and withdraw via the cookie banner (point a).
• For special categories of data that you disclose to us for a service: solely with your explicit consent (Article 9, paragraph 2, point a).
• For the record of choices regarding cookies: to demonstrate consent, as required by Article 7, paragraph 1 of the Regulation (point c).

Who receives the data

Your enquiries are read by the people who work with us, each to the extent required for their duties, and by the supplier of the requested service, for what is necessary. To operate the website, we rely on suppliers who process data on our behalf, bound by contract (Article 28 of the Regulation):

• Vercel Inc., Covina, California, United States: hosts the website. It distributes pages via its content delivery network, with points of presence across the world; enquiries submitted through forms and cookie choices are processed in its data centre within the European Union, in Paris. To serve pages, it receives the network address of your device, as does any website hosting provider, and retains technical logs in accordance with its terms.
• Supabase Pte. Ltd., Singapore: the database and documents. Data are stored in the Paris region, France.
• Plus Five Five, Inc., San Francisco, United States, providing the Resend service: the emails sent to you by the management system, such as booking confirmations for a service. The service is not yet active. When active, data for each transmission, namely recipient, subject line, and outcome, will be stored in the United States.

Only if you provide consent via the cookie banner do the following recipients receive data collected by their tools, in accordance with their terms:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: Google Analytics, Google Ads tag, and Google Tag Manager.
• Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland: the Meta Pixel.

The website also uses Google Search Console, which shows how pages appear in Google search results: it receives no data regarding website visitors.

If you choose to write via WhatsApp, the conversation is routed through WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, in accordance with its terms.

We disclose data to public authorities only when required by law. Data are neither sold nor disseminated.

Data outside the European Economic Area

Some of these suppliers process data in the United States, and Supabase also in Singapore. Every transfer relies on a safeguard provided for by the Regulation: Vercel, Plus Five Five (Resend), Google LLC, and Meta Platforms, Inc. adhere to the Data Privacy Framework between the European Union and the United States; Vercel, Supabase, and Plus Five Five also apply standard contractual clauses approved by the European Commission. WhatsApp Ireland Limited indicates in its privacy policy the safeguards it uses: adequacy decisions, the Data Privacy Framework, and standard contractual clauses. A copy of these safeguards may be requested by writing to info@orionmanagement.it.

How long we retain data

• Enquiries received through forms, service requests, and resulting correspondence: 24 months from the last contact. Thereafter, we delete them or render them anonymous.
• Contracts, invoices, and accounting records: 10 years, as required by Article 2220 of the Italian Civil Code.
• Special category data communicated for a service: for the duration of that service.
• The record of choices regarding cookies: 5 years, the limitation period for administrative sanctions under Article 28 of Italian Law 689/1981, to prove consent for as long as it may be questioned.
• Suppliers technical logs: for the retention periods specified in their terms.
• Cookies and other browser storage tools: for the durations set out in the cookie policy.

Your rights

You may ask at any time to access data concerning you and obtain a copy, to rectify them, to erase them, to restrict their processing, and to receive them in a machine readable format to transfer them elsewhere (Articles 15 to 20 of the Regulation). You may object to processing based on legitimate interest (Article 21). Consent may be withdrawn whenever you wish, and withdrawal does not affect the lawfulness of processing carried out beforehand: for cookies, simply use the Cookie preferences link at the foot of each page.

To exercise a right, write to info@orionmanagement.it. We will reply within one month; if the request is complex, this deadline may be extended by a further two months, and we will inform you within the first month.

If you consider that the processing of your data breaches the Regulation, you may lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it, or with the supervisory authority of the European Union country where you reside or work.

Automated decisions

We do not take decisions concerning you by purely automated means, and we do not create profiles.

Minors

The website and forms are intended for adults. If we discover that we have received data belonging to a minor without the consent of the holder of parental responsibility, we erase them.

Cookies and similar technologies

What the website stores in your browser, and what is stored solely with your consent, is set out in the cookie policy, linked at the foot of each page.

Amendments to this privacy policy

We update this privacy policy whenever website services, suppliers, or legal obligations change. The version in force is always this page. Last revised: 30 September 2026.