Paeonia Resources s.r.l.
Privacy notice
Updated: 3 October 2026 · 2026-10-03.4
1. Data controller and contact details
Paeonia Resources s.r.l.
Via Antonio Gambacorti Passerini 2, 20900 Monza (MB), Italia
VAT no.: 08343120963
Email: privacy@paeoniasrl.com
2. Data and purposes
Browsing involves technical data needed to deliver pages and protect the service, such as IP address, date, requested resource and browser information.
The website code does not include advertising scripts, profiling tools or social widgets. The hosting infrastructure services described in this notice and the optional map, loaded only with your consent, are separate.
If you contact us, we use the details and information you choose to provide to reply and handle your enquiry. Avoid unnecessary sensitive data.
3. Forms and provision of data
The website’s traditional forms prepare a draft on your device: their fields are not transmitted to the server. The assistant’s “Send an enquiry” form is an exception: only when you press its submit button are your name, email and enquiry recorded on OVHcloud for contact, as described in “AI assistant and team enquiries”. After each AI exchange, a summary is also emailed to the team as described in the dedicated section.
4. Legal bases
Pre-contractual requests are handled under Article 6(1)(b) GDPR; other relevant communications and site security are based on the legitimate interest in responding, maintaining the service and preventing abuse (Article 6(1)(f)), subject to the rights of data subjects. Any legal obligations are based on Article 6(1)(c). Technical preferences remember choices requested by the user. General consent is not required to contact us.
External maps are optional and are enabled only after an affirmative choice, which can be withdrawn at any time without affecting access to the location cards.
5. Recipients and hosting
The website is hosted on OVHcloud Web Hosting at the Gravelines data centre in France. Technical copies of the files may also be replicated in Roubaix, France. Pages, images and scripts are served by this infrastructure; the assistant’s separate “Send an enquiry” form records your name, email and enquiry in a private OVHcloud folder accessible only to authorised people. After each AI exchange, a summary is also emailed to the team as described in the dedicated section.
Enquiries are handled by the controller and the people it authorises, within their respective duties.
We use OVHcloud for hosting and Microsoft 365 for company email. The providers and their subprocessors may process data needed to deliver, secure and support these services. Hosting files in Gravelines does not mean that all processing, including email and remote support, takes place exclusively in the European Union. Provider agreements specify adequacy decisions or standard contractual clauses, where applicable, for international transfers. The relevant data processing agreements and subprocessor lists are available through the links shown here; you can ask the controller for information about the safeguards applied.
Provider documentation
6. Retention
Email enquiries are accessible only to authorised staff. We retain them for the time needed to handle the enquiry and any resulting relationship, then delete them, except where legal obligations or documented needs to protect rights require retention.
The applications do not add a full conversation archive. Email summaries and the sending queue are processed separately, as described in the assistant section. To protect the assistant it uses counters with IP-derived HMAC pseudonyms that change each UTC day, without raw IP addresses; previous-day data is removed on the next request or by daily maintenance. Access and security logs are managed by the OVHcloud infrastructure. The retention criterion takes into account the time needed to provide the service, diagnose faults and handle security incidents, together with any applicable obligations. Technical log retention is separate from the retention of anonymised statistical reports and website file backups.
For website files, OVHcloud documents restore points from 1, 2, 3, 7 and 14 days earlier. These are technical copies for restoring the website. The private enquiry register and the email-summary queue are separate stores. Technical copies that include the register follow the provider’s restore periods; the 90-day enquiry expiry is reapplied when data is restored. This expiry does not mean immediate deletion of the provider’s technical copies or copies exported by the operator. The email queue keeps content for up to seven days; technical backups may retain it for up to 31 days. Expiry is reapplied after restoration.
OVHcloud provides technical statistics calculated from server logs after anonymisation and aggregation. They do not require an analytics script in the pages. Reports are available for up to 40 months; this period concerns statistical reports, not the retention of raw logs.
Preferences and the latest 20 choice records stay on your device and expire after six calendar months. When you make or change a choice, the website sends a technical record to the controller’s private consent register on OVHcloud, with an expiry of six calendar months.
7. Links and maps
Instagram, UNWINED, SUNAWI and other websites are external links. The card images are hosted locally: your browser contacts the destination only when you open the link. From that point, the chosen service’s policies apply.
The map requests images from tile.openstreetmap.org only after your consent. The service receives your IP address and the technical data needed for the request. We do not ask for your GPS location or use advertising cookies for the map. You may decline and still use the location cards and directions links.
8. Rights and complaints
Where provided for by Articles 15–22 GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interest. Where applicable, you may withdraw consent without affecting the lawfulness of earlier processing. Write to the data controller’s email address above. You may lodge a complaint with the Italian Data Protection Authority or the competent authority. The site does not make automated decisions that produce legal or similarly significant effects.
AI assistant and team enquiries
You can choose to use an artificial intelligence assistant to explore the website’s content. The controller is Paeonia Resources s.r.l.. The service starts when you select “Start the conversation”; messages are transmitted to OpenAI’s APIs only when you send them. Avoid personal details, confidential information and other people’s data in the chat. Use the separate “Send an enquiry” form to leave contact details. After each AI exchange, a summary is also emailed to the team as described in the dedicated section.
We process messages to answer your enquiry. For information relating to a contract, the legal basis is Article 6(1)(b) of the GDPR; for other questions, our legitimate interest in responding under Article 6(1)(f). The assistant can make mistakes: it does not confirm orders or bookings, or make decisions with legal effects on people. We do not use conversations for behavioural analytics or marketing.
The copy displayed on your device remains in the page’s memory and is cleared by “New conversation” or by closing the page. OpenAI may retain content in security logs for up to 30 days, subject to legal or abuse-prevention exceptions; the provider’s documented technical retention also applies. We do not enable data sharing for model training.
If you submit the separate form, your name, email and enquiry text are saved in a private register on OVHcloud, accessible to authorised staff, to handle your request for contact. These fields are not sent to the AI model. The enquiry expires 90 days after submission; expired records are removed during daily cleanup or the next submission. Technical backups follow the periods described in this notice, and expiry is reapplied after restoration. Any resulting relationship follows the retention criterion already described for enquiries and applicable obligations. Submission does not subscribe you to marketing.
We use OVHcloud and OpenAI’s APIs to provide this service. OpenAI’s data processing agreement for customers in the European Economic Area identifies OpenAI Ireland Ltd. and provides for standard contractual clauses or adequacy decisions, where applicable, for transfers outside the EEA. The agreement and subprocessor list are available through the links shown here. You can ask about the safeguards applied, exercise the rights described in this notice or contact us at privacy@paeoniasrl.com. You can continue browsing and contact us directly without using the assistant.
After each AI exchange, we email a summary of the question and reply to giuseppe@paeoniasrl.com to follow up on enquiries. A private OVHcloud queue keeps the content needed for sending for up to seven days; it is removed once the email service accepts the message, which does not guarantee delivery. Backups may retain it for up to 31 days; expiry is reapplied after restoration. Only authorised staff can access emailed summaries. They are kept to handle the enquiry and any resulting relationship, then deleted unless legal obligations or documented needs to establish or defend a right require otherwise. They do not confirm an order, booking or follow-up. Technical sending uses Microsoft 365 through hello@villaeuropagardalake.com. A copy may remain in Sent Items as well as in the recipient’s mailbox; the same access and retention rules apply to both.
To limit abuse, we keep usage counters associated with an IP-derived pseudonymous identifier that changes each UTC day; these counters contain neither the raw IP address nor messages. Previous-day counters are deleted on the next request or during daily maintenance. The temporary session token is valid for 30 minutes and remains in the page’s memory. Hosting logs follow the criteria already described in this notice.
OpenAI · Data controls · OpenAI · DPA · OpenAI · Sub-processors
Managing and demonstrating privacy choices
On public domains hosted by OVHcloud, when you make or change a choice, the website sends a technical record to its own server: a random identifier, website, notice version, date, action, optional-service choice and expiry. The application register does not store your IP address, browser information, email or message contents. Hosting logs, described separately, may contain IP addresses and request data.
These records are used to manage and demonstrate privacy choices and withdrawals. Demonstrating consent fulfils the controller’s duties under GDPR Articles 5(2) and 7(1); the records are not used for advertising, profiling or behavioural analytics.
External maps are enabled only with consent (GDPR Article 6(1)(a)). Evidence of consent and withdrawal is retained to meet the obligation to demonstrate consent under Article 7(1), on the basis of Article 6(1)(c). Recording a refusal serves the legitimate interest in respecting the choice and keeping preferences working (Article 6(1)(f)), without enabling optional services.
Choice records expire after six calendar months. At expiry they are no longer used to manage preferences. Expired files are deleted progressively during subsequent reads of the register and recording of new choices, with cleanup split into groups of files. Until cleanup is completed, and during periods without traffic, expired data may remain in the files. This period is an operational choice for managing preferences; it is separate from the retention criteria for emails and hosting logs.
The register is stored outside the website’s public folder and is accessible only to authorised staff and technical providers authorised for the service. It is not sent to OpenStreetMap or social websites. For requests concerning your data, contact the controller identified in this notice.
OpenStreetMap map images are served through a global server network. Request data may therefore be processed outside the European Economic Area, as described in the provider’s privacy policy. This map remains optional, and you can use the written addresses without enabling it.