0. In short: what happens on this site today
- The site offers free tools that run only in your browser: what you type into the tools is not sent to us.
- There are no forms, no sign-ups, no newsletter and no sales: today we do not collect your name or email through the site.
- No cookies, no analytics, no pixels, no third-party fonts or content.
- Today there are two kinds of processing: the technical one by our hosting provider (Cloudflare: IP address and browser data, to deliver the pages and for security) and, only if you write to us, handling your email (mailbox.org, a service of Heinlein Hosting GmbH in Germany, for the hello@benvelia.com mailbox where we receive messages and from which we reply; messages received before the move to mailbox.org (November 2026) remain in the archive of the Gmail mailbox, with Google as independent controller).
- The parts of this notice about sign-ups, the Benvelia Guide app and purchases apply only once those services are live; we will update this page before switching them on.
- If you write to hello@benvelia.com we process the data in your message to reply.
1. Data controller
The data controller is Enrico-Lorenzo Malgieri, owner of the Italian sole proprietorship (ditta individuale) Benvelia di E.L.M. ("Benvelia", "we"):
- VAT no. (P.IVA) 03109650998 · REA RM-1804513
- Registered office (domiciliation) – no office open to the public: c/o TA Solutions, Circonvallazione Clodia 163/167, 00195 Roma, Italy
- Certified email (PEC): benvelia@pec.it
- Email (including privacy requests): hello@benvelia.com
Benvelia is the brand under which the controller offers its products. We have not appointed a Data Protection Officer (DPO): it is not required for our processing.
For the content hosts will enter in Benvelia Guide (texts, instructions, access codes, etc.) and for the technical data of guests who open the guides (§11), Benvelia will act as processor (Art. 28 GDPR) on behalf of the host, who is the controller. The DPA will be part of the app Terms once the app is available to external users.
2. Scope
This notice covers:
- the website benvelia.com and the free tools (live);
- contact by email at hello@benvelia.com (live);
- email sign-ups (free resources and, only with consent, newsletter) — not live yet;
- the Benvelia Guide app (host accounts), including the Setup Pack add-on — not live yet;
- guests who open a Benvelia guide (§11) — not live yet.
Sales: today Benvelia does not sell anything, on the site or elsewhere. Once sales start, Etsy and the payment platform (Merchant of Record) will be independent controllers of the data they process for their own services (§8); we will process buyers' data only to fulfil the order and for legal obligations, not for marketing outside the platform.
3. Categories of data
| Context | Data | Notes |
|---|---|---|
| Website / free tools (live) | technical browsing data processed by the hosting provider (IP, user agent) to deliver the pages and for security | The tools run in your browser: what you enter (e.g. Wi-Fi network name) is not sent to us. The CIN tool may remember your entries only in your browser (local storage), which you can clear at any time |
| Emails you send us (live) | email address, message content | To reply |
| Free-resource sign-up / newsletter (not live) | email, name (optional), language, marketing choice, proof of consent (submission and confirmation date/time, IP, user agent, text versions, source) | Double opt-in |
| Analytics (not live) | cookieless aggregate data only | If we switch it on, we will say so here |
| Benvelia Guide account (host) (not live) | email, language, plan, property data and guide content, security logs | Sign-in by email link: no password |
| Setup Pack (not live) | form data (no secrets), photos (metadata stripped), withdrawal-right statements | Confidential data (address, codes, Wi-Fi) only go into the encrypted section of the guide |
| Confidential section of the guide (not live) | exact address, codes, Wi-Fi entered by the host | Host = controller; Benvelia = processor |
| Guide guests (not live) | IP (hashed), unlock logs | §11 |
| Payments (not live) | handled by the Merchant of Record | We will receive order confirmation, amounts, country, email; never full card details |
Explicit rule: no guest registration, no ID documents, no online check-in.
4. Purposes, legal bases and whether providing data is required
| Purpose | Legal basis (Art. 6 GDPR) | Providing data |
|---|---|---|
| Delivering the website and protecting it from abuse (hosting technical logs) | Legitimate interest (6.1.f) in running the site securely | Automatic, minimised |
| Replying to messages you send us | Pre-contractual steps at your request (6.1.b) if they concern a service; otherwise legitimate interest in replying (6.1.f) | Needed to reply |
| Sending the requested free resource and related service messages (when live) | Performance of a request / contract (6.1.b) | Required: without an email we cannot send it |
| Creating and managing the account, providing Benvelia Guide and the Setup Pack (when live) | Contract (6.1.b) | Required for the service |
| Newsletter and offers by email (when live) | Consent (6.1.a), separate and revocable | Optional: saying no has no consequence on anything else |
| App security, abuse prevention, rate limits (when live) | Legitimate interest (6.1.f) in the security of the service and its users | Automatic, minimised |
| Proof of consent | Obligation to demonstrate consent (Art. 7.1) and legitimate interest | Automatic |
| Invoices and accounting (once there are sales) | Legal obligation (6.1.c) | Required when you buy |
| Aggregate analytics (if switched on) | Legitimate interest (6.1.f), no cookies and no identification | — |
| Improving the Setup Pack software (when live): spot checks of the public parts only of some already published guides (at most 10 per month), after publication; we do not edit or approve your guide, we only use the outcome to fix the software. For this purpose we are controller (we do not act on behalf of the host) | Legitimate interest (6.1.f) in improving the product, with a documented balancing test | You can opt out at any time in your account settings ("Exclude my guides from quality sampling") or by writing to hello@benvelia.com (§5) |
| Content and guest data on behalf of the host (when live) | Contract / DPA with the host | — |
5. Right to object (Art. 21 GDPR)
You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (security, analytics, Setup Pack quality sampling: for the latter the account-settings checkbox is enough). You can object at any time and without giving reasons to direct marketing: with the one-click "Unsubscribe" link in every marketing email or by writing to hello@benvelia.com. After you object to marketing we will no longer use your data for that purpose.
6. Automated decisions (Art. 22 GDPR)
We do not take decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. The AI the app will use generates texts and translations of guides at the host's request, and the host reviews them before publishing; it does not assess people.
AI transparency (AI Act, EU Reg. 2024/1689, Art. 50): AI-generated texts are labelled as such (for example "Text generated with AI and reviewed by the host").
7. Cookies, pixels, fonts and embeds
- Today the site uses no cookies. Once the app exists we will only use strictly necessary technical cookies (host session, unlocking the confidential section for the length of the stay, security, language): they do not require consent.
- The CIN tool may save your entries in your browser's local storage: they stay on your device, are not sent to us and you can clear them from your browser.
- No analytics today; if we switch them on in the future they will be cookieless and aggregate (Italian DPA cookie guidelines, 10/6/2021): no banner needed.
- No tracking pixels in emails (we do not measure individual opens).
- Self-hosted fonts (no calls to third-party font services).
- No third-party embeds (video, maps, social) without prior consent.
- If non-technical cookies were ever needed: a banner with "Reject" as prominent as "Accept", the "X" counts as rejection, scrolling is not consent, no new request before 6 months.
8. Recipients
You can get a copy of the safeguards for transfers by writing to hello@benvelia.com.
| Provider | Role | Purpose | Live today? | Country | Safeguard for non-EEA transfers |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Processor / sub-processor | Website hosting, CDN, security; in future the app database (EU data preference) | Yes | USA (global infrastructure) | EU-US Data Privacy Framework (DPF) + Standard Contractual Clauses (SCC) |
| Heinlein Hosting GmbH (mailbox.org service), Berlin | Processor (Art. 28) | hello@benvelia.com mailbox: receiving, sending and storing email | Yes | Germany (EU) | Data in Germany; no non-EEA transfer stated by the provider |
| Google Ireland Limited (Gmail) | Independent controller of the email service, under its own privacy policy (policies.google.com/privacy) | Archive of emails received before the move to mailbox.org (November 2026), kept for the 24 months in §10 | Yes (archive only) | EU / USA | Google LLC certified under the EU-US DPF; SCCs where needed |
| Resend (Plus Five Five, Inc.) | Processor | Service emails (confirmations, download links) | No | USA | DPF + SCC |
| MailerLite (UAB MailerLite, Lithuania) | Processor | Newsletter (only with consent) | No | EU | No non-EEA transfer declared |
| Mistral AI (France) | Processor / sub-processor; independent controller for abuse monitoring until Zero Data Retention (ZDR) is granted | Generating app texts and translations from data without secrets | No | France / EU | DPA; no use of data for training |
| Payment platform (Merchant of Record) | Independent controller (it is the seller towards you) | Checkout, payment, taxes, refunds | No (no sales today): we will name it here before the first sale | — | Its own safeguards; see its privacy notice |
| Etsy | Independent controller | Template purchases on Etsy | No (no sales today) | EU/USA | Its own safeguards; see Etsy's privacy notice |
| Accountant, authorities | Independent controllers | Legal obligations | Only if needed | Italy | — |
9. Transfers outside the EEA
They only happen to the providers in the §8 table and only with a safeguard (DPF adequacy decision for certified companies, or SCC). We prefer EU providers and regions when available.
10. Retention
| Data | Period |
|---|---|
| Hosting technical logs (website) | kept by Cloudflare for the periods stated in its privacy policy and DPA, for security and diagnostics; Benvelia does not download, keep or combine them |
| Emails you send us | 24 months after the conversation ends (this also applies to the Gmail archive of emails received before the move to mailbox.org) |
| Free-resource sign-up / newsletter | until you withdraw, or 24 months without any interaction (then deletion) |
| Proof of consent | for the whole processing period + 24 months |
| Benvelia Guide account | for the life of the account; deleted within 30 days after closure |
| Setup Pack data (form without secrets) | 90 days after the order is closed; original photos deleted right after metadata stripping |
| Security logs (host) | 12 months |
| Guest unlock logs | 30 days |
| Encrypted backups | 90 days, rotating |
| Quality-sampling notes | no personal data (anonymous ID); no copy of the guide beyond 30 days |
| Invoices and accounting records | 10 years (Art. 2220 Italian Civil Code) |
11. Guests who open a Benvelia guide
Once the app is live, if you open a guide via QR code or link:
- we do not ask you to register or give personal data;
- on behalf of the host you are staying with (controller), we process a hashed IP address and logs of unlock attempts of the confidential section, only for security and to limit attempts;
- we use a technical cookie to keep the confidential section unlocked until the end of your stay;
- no fingerprinting, no profiling, no analytics cookies;
- logs are deleted after 30 days.
To exercise your rights, contact the host; you can also write to us (hello@benvelia.com) and we will pass the request on to the host.
12. Your rights and complaints
You can ask for access, rectification, erasure, restriction, portability, object (§5) and withdraw consent at any time, without affecting the lawfulness of earlier processing. Write to hello@benvelia.com (subject "Privacy") or to the certified email benvelia@pec.it; we reply within 1 month (extendable by 2 months for complex cases, with notice).
Staff access to your content (once the app is live): as a rule, none of our staff read your guide content or the confidential section. Exceptions: (a) the spot checks of public parts only described in §4 (unless you opted out); (b) "break-glass" access, only at your written request to solve a support issue, limited to what is needed, logged (who, when, what) and never used to write or correct guide content.
Complaint (Art. 77 GDPR): you can lodge a complaint with the Italian Garante per la protezione dei dati personali (garanteprivacy.it) or with the supervisory authority of the EU Member State where you habitually reside, work, or where the alleged infringement took place.
13. Age
Free resources and host services are for people over 18 (legal capacity to contract is required). We do not knowingly collect data from minors; if we find out, we delete it.
14. Data breaches
We follow Arts. 33–34 GDPR: notification to the Garante within 72 hours where required and communication to data subjects in case of high risk; as processor we inform the host without undue delay.
15. Changes
We may update this notice; the version published on benvelia.com, with date and version number, is the valid one. Before switching on sign-ups, the app or sales we will update this page. For substantial changes we will give notice on the site and, if there are subscribers, by email.
16. Contact
- Email: hello@benvelia.com
- Certified email (PEC): benvelia@pec.it
- Registered office (domiciliation) – no office open to the public: c/o TA Solutions, Circonvallazione Clodia 163/167, 00195 Roma, Italy. Not an address for returns, shipments or pick-ups.