Privacy Policy

The Data Controller, pursuant to Art. 4(7) GDPR, is:

MAIA Parking LLC

Registered office: Albuquerque, New Mexico, USA

Operational address: Viale Daijiro Kato, 4 – Santa Monica-Cella, Misano Adriatico (RN), Italy

For any matter relating to the processing of personal data, data subjects may contact the Controller exclusively via:

— WhatsApp message to: +39 329 757 6862

— Contact form available at parcheggiosantamonica.it

The Controller has not appointed a Data Protection Officer (DPO) pursuant to Art. 37 GDPR, as the conditions of Art. 37(1)(a)(b)(c) GDPR are not met. Requests regarding the exercise of rights under Arts. 15–22 GDPR must therefore be addressed directly to the Controller through the contact channels indicated above.

This Privacy Policy is drafted in conformity with: EU Regulation 2016/679 (GDPR) and all related delegated and implementing acts; Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018; guidelines, recommendations and opinions of the Italian Data Protection Authority (Garante) and the European Data Protection Board (EDPB).

This Policy applies to all personal data processing carried out by the Controller in connection with: website navigation; the online booking form; WhatsApp communications for Service management; newsletter subscription; use of the parking Service. It does not apply to processing by autonomous third parties such as Meta Platforms Inc.

The Controller collects and processes the following categories of personal data, strictly limited to what is necessary for the purposes described in Section 4:

The Controller does not collect or process special categories of data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR). The Controller does not carry out automated decision-making or profiling with legal or similarly significant effects (Art. 22 GDPR).

Personal data is processed by electronic and IT means, and where necessary by paper means, strictly in connection with the purposes described. The Controller implements appropriate technical and organisational security measures pursuant to Art. 32 GDPR, including pseudonymisation and encryption where feasible, measures to ensure ongoing confidentiality, integrity, availability and resilience of processing systems, procedures to restore availability and access to data in the event of a physical or technical incident, and regular testing and evaluation of the effectiveness of measures adopted.

Processing is carried out exclusively by authorised Controller personnel or by parties designated as data processors pursuant to Art. 28 GDPR, bound by confidentiality obligations.

To provide the Service and pursue the purposes described, the Controller uses the following third-party providers acting as data processors pursuant to Art. 28 GDPR:

Personal data is not sold, transferred or shared with third parties for commercial, marketing, profiling or any other purpose unrelated to the Service. Data may be communicated to competent public authorities only where required by law.

As indicated in Section 6, some processors (Supabase Inc. and Resend Inc.) are based in the USA and may store data on servers outside the EU/EEA. Transfers occur exclusively: (a) on the basis of an adequacy decision by the European Commission (Art. 45 GDPR); or (b) with adequate safeguards pursuant to Art. 46 GDPR, including Standard Contractual Clauses (SCC) adopted by the Commission Decision of 4 June 2021 (2021/914/EU).

Data subjects may obtain a copy of the adequate safeguards adopted by the Controller for third-country transfers by submitting a request via the contact channels in Section 1.

Personal data is retained for the minimum period necessary to achieve the purposes for which it was collected, in compliance with the storage limitation principle (Art. 5(1)(e) GDPR).

Upon expiry of retention periods, data is securely and permanently deleted or irreversibly anonymised.

The website uses only strictly necessary technical cookies for correct site operation. Specifically:

The Controller does not use profiling cookies, behavioural tracking cookies, marketing cookies, third-party advertising cookies, beacons, tracking pixels, fingerprinting or any other tracking technology. No third-party social network plugins or widgets are integrated into the website. No user consent is required for strictly necessary technical cookies.

As a data subject, pursuant to Arts. 15–22 GDPR, you have the right to:

To exercise any of the above rights, please send a written request to the Controller via WhatsApp at +39 329 757 6862 or via the website contact form. The Controller will respond without undue delay and in any event within one month of receipt, extendable by a further two months in cases of particular complexity.

In the event of a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data (Art. 4(12) GDPR), the Controller will:

The Controller's website and parking Service are not intended for persons under 18 years of age. The Controller does not knowingly collect personal data from persons under 18. If the Controller discovers that data from minors has been provided, it will delete such data as soon as technically possible.

The Controller processes personal data in compliance with Art. 5(1) GDPR principles:

The Controller reserves the right to amend this Privacy Policy at any time. Amendments will be published on the website with an updated date. Data subjects are advised to periodically review this Policy. Continued use of the website or Service after publication constitutes acceptance of the updated Policy.

This Privacy Policy is drafted in compliance with EU Regulation 2016/679 (GDPR) and applicable Italian data protection legislation. The competent supervisory authority for Italy is the Garante per la protezione dei dati personali (www.garanteprivacy.it).