Privacy Policy

1. Data Controller

The controller within the meaning of the GDPR is:

Aichner Invest AG / S.p.A.
Luigi Cadorna Street 17/A
39100 Bolzano, South Tyrol, Italy
Phone: +39 0471 401 818
Fax: +39 0471 401 826
Email: invest@aichner.bz.it
VAT No. / Part. IVA: IT 02597280219
Bolzano Chamber of Commerce No. BZ 190408
Legal Representative: Devid Aichner

For all questions regarding data protection and the exercise of your rights, you can reach us at the contact details mentioned above. A Data Protection Officer (DPO) has not been appointed, as there is no legal obligation to do so under Art. 37 GDPR.

2. Scope

This policy applies to the website www.aichner-invest.it, including all language versions (German, Italian, English) and all subpages. It does not apply to external websites to which we link. The respective providers are solely responsible for their content and data processing.

3. Principles

We process personal data only to the extent necessary to provide a functional website and for our content and services, or if you have given us your consent. We do not sell your data and do not pass it on for purposes other than those described in this policy.

4. Server Log Files and Hosting

When you access this website, your browser automatically transmits data to the server on which the website runs. This data is temporarily stored in log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the retrieved file
• Amount of data transferred and notification of successful retrieval
• Previously visited page (referrer URL)
• Browser used, browser version, and operating system

This processing serves to establish the connection, system security, technical stability, and defense against attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the website. The log data is deleted after 30 days at the latest, unless it is needed longer to investigate a specific security incident.

The website is hosted for us by SiteGround Spain S.L., Calle Prim 19, 28004 Madrid, Spain. The provider processes the data as a processor based on a contract according to Art. 28 GDPR. The servers are located within the European Union. Additionally, the provider uses security mechanisms that detect and ward off automated access.

5. Cookies and Similar Technologies

Cookies are small text files that are stored on your end device. Additionally, technologies such as local storage, pixels, or scripts can be used, which store or read information on your device in a comparable way. We summarize all of this below under the term cookies.

Technically necessary cookies are required for the operation of the website, for example, for language selection or storing your cookie decision. They are set without consent. The legal basis is Art. 6(1)(f) GDPR in conjunction with Art. 122 of the Italian Data Protection Code.

All other cookies, especially for statistics, marketing, and embedded third-party content, are used by us exclusively after your express consent. The legal basis is Art. 6(1)(a) GDPR.

Consent Management

When you first visit the website, a consent banner appears. There you can grant your consent by category, reject it, or adjust settings individually. Rejection is possible at the same level and with the same effort as agreeing. As long as you have not given consent, no cookies requiring consent will be set and no services requiring consent will be loaded. Simply scrolling further or closing the banner does not count as consent.

To manage your consent, we use CookieYes, a service provided by CookieYes Limited, 3 Warple Mews, Warple Way, London W3 0RF, United Kingdom. The service stores your decision in a cookie so that the banner does not reappear every time you visit the page. For the United Kingdom, there is an adequacy decision by the European Commission.

You can revoke your consent at any time with effect for the future by accessing the cookie settings again via the icon or the link at the bottom of each page and changing your selection. The revocation does not affect the lawfulness of the processing carried out until then. Additionally, you can delete or block cookies at any time in your browser settings. If you block technically necessary cookies, not all functions of the website may be available to you.

Overview of Essential Cookies

The complete and daily updated list of cookies used, including provider, purpose, and duration, can be found at any time in the consent banner under “Customize.”

6. Contact and Inquiry Forms

On our website, you can contact us via forms and request information about our real estate projects. In doing so, we process the following data:

• First and last name
• Email address
• Phone number
• Your message and your request
• The project you are inquiring about, as well as the language of your inquiry
• Your indication of whether we may contact you via WhatsApp
• Time of submission

Mandatory fields are marked as such. Without this information, we cannot process your inquiry. All other information is voluntary.

Purpose is the processing and answering of your inquiry, the sending of the documents you requested, and the preparation of a possible contractual relationship.

Legal basis is Art. 6(1)(b) GDPR, insofar as your inquiry is directed towards the conclusion or initiation of a contract. In all other cases, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in answering inquiries to our company.

Storage duration: We store your inquiry until it has been fully processed and no further queries are to be expected, but for a maximum of two years after the last contact. If a contract is concluded, the statutory retention periods of Italian civil and tax law of up to ten years apply. The legal basis for further storage is then Art. 6(1)(c) GDPR.

Processing of Your Inquiry in Our Systems

To ensure that we can answer your inquiry reliably and promptly, it is transferred to our internal systems and processed further there. The following are used:

• Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) for email traffic
• Google Workspace with Google Sheets and Google Contacts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for the orderly recording and tracking of inquiries
• An IT service provider commissioned by us, who handles the technical operation of the website and the automated initial response to inquiries

Contracts for processing according to Art. 28 GDPR exist with all mentioned entities. They process your data exclusively according to our instructions.

Spam Protection: Google reCAPTCHA

To protect our forms from automated entries and abuse, we use reCAPTCHA v3, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA analyzes behavior when filling out the form and assesses based on various characteristics whether the entry comes from a human or a program. In the process, the IP address, duration of stay, mouse and keyboard movements, as well as device and browser information are transmitted to Google and evaluated there. The service runs invisibly in the background. No content evaluation of your form entries is carried out by reCAPTCHA.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our forms from spam and automated abuse and ensuring the security of our systems. A transmission to Google LLC in the USA cannot be ruled out, see Section 11.

Further information: policies.google.com/privacy and policies.google.com/terms

7. Contact via WhatsApp

In the inquiry form, you can explicitly agree by checking a box that we may contact you via WhatsApp. Only if you give this consent and provide a phone number will we use your details (name, phone number, requested project, language) to reply to you via WhatsApp and send you the requested documents.

We use WhatsApp for this, a service provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland. When sending via WhatsApp, your phone number and the contents of the communication are processed on Meta servers. A transmission to Meta Platforms, Inc. in the USA is possible. We have no influence on what data Meta collects beyond this about your use of WhatsApp and how it is used.

The legal basis is exclusively your consent according to Art. 6(1)(a) GDPR and, regarding the transmission to the USA, according to Art. 49(1)(a) GDPR. You can revoke this consent at any time with effect for the future by sending us a short message to invest@aichner.bz.it or by objecting in the WhatsApp chat. If you do not agree to contact via WhatsApp, we will of course reply to you by email or phone. You will not suffer any disadvantages as a result.

WhatsApp Privacy Policy: whatsapp.com/legal/privacy-policy-eea

8. Reach Measurement and Advertising

The services described in this section are only loaded and active after you have consented to the corresponding category in the consent banner. The legal basis in all cases is your consent according to Art. 6(1)(a) GDPR and, for the storage and reading of information on your end device, Art. 122 of the Italian Data Protection Code.

Google Tag Manager

We use the Google Tag Manager from Google Ireland Limited. The Tag Manager is a tool with which we manage and integrate the services described below. It does not create profiles itself and does not store cookies, but it retrieves your IP address, which is transmitted to Google. The Tag Manager ensures that the individual services are only triggered when the associated consent is present.

Google Analytics 4

We use Google Analytics 4, a web analysis service provided by Google Ireland Limited, to understand how our website is used and how we can improve it.

The data processed includes: the pages accessed and the duration of stay, the approximate location based on the shortened IP address, device type, operating system and browser, the origin of the access, and interactions on the page. IP anonymization is activated by default in Google Analytics 4. Your IP address is shortened by Google and not merged with other data from Google.

The evaluation takes place in aggregated form and serves exclusively statistical purposes. Google processes the data on our behalf based on a contract according to Art. 28 GDPR. The data collected by Google Analytics is automatically deleted after 14 months.

You can additionally prevent collection by Google Analytics by installing the browser add-on: tools.google.com/dlpage/gaoptout

Google Ads with Conversion Tracking and Remarketing

We advertise our real estate projects via Google Ads. To measure the success of our ads, we use conversion tracking. If you reach this website via one of our ads, a cookie is set. If you then perform an action relevant to us, such as submitting an inquiry, Google recognizes that this action is due to an ad. We receive exclusively statistical evaluations from Google and cannot draw any conclusions about individual persons from them.

Additionally, we use remarketing. In the process, Google collects information about your visit to show you our ads again later on other websites and in Google services. Services from Google under the domain doubleclick.net are also used for this.

You can manage your settings for personalized advertising at Google here: adssettings.google.com

Meta Pixel and Custom Audiences

We use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, for our advertising on Facebook and Instagram.

The pixel recognizes which pages you visit on our website and what actions you take there. This allows us to measure the success of our ads and then show you suitable ads on Facebook and Instagram (Custom Audiences). If you have a Meta account and are logged in there, Meta can assign the visit to this website to your account. As the operator of the website, we receive exclusively summarized, non-personal evaluations from Meta.

We are jointly responsible with Meta Platforms Ireland Limited for the collection and transmission of data to Meta within the meaning of Art. 26 GDPR. You can find the essential contents of this agreement at facebook.com/legal/controller_addendum. Meta is solely responsible for the subsequent further processing.

Meta Privacy Policy: facebook.com/privacy/policy
Your advertising settings at Meta: facebook.com/adpreferences

9. Embedded Third-Party Content

The following content is also only loaded after you have consented to the corresponding category in the consent banner. The legal basis is your consent according to Art. 6(1)(a) GDPR. As long as no consent is present, you will see a placeholder at the relevant point.

Google Maps

To display the location of our real estate projects and our company headquarters, we integrate map material from Google Maps provided by Google Ireland Limited. When the map is loaded, your IP address is transmitted to Google and the map is loaded directly from Google servers. Google can set cookies and, if you are logged into a Google account, assign the use to your account. We have no influence on this data processing.

Further information: policies.google.com/privacy

Google Fonts

For a uniform display of fonts, this website integrates fonts from Google Fonts provided by Google Ireland Limited. When you access a page, your browser loads the required fonts from Google servers. In the process, your IP address is transmitted to Google.

LottieFiles and jsDelivr

For animations on our website, we use LottieFiles (Design Barn Inc., 250 Cambridge Avenue, Palo Alto, CA 94306, USA). For the delivery of individual program libraries, we use the content delivery network jsDelivr. In both cases, your IP address is transmitted to the respective provider when the content is loaded. The use serves the fast and reliable delivery of this content.

10. Recipients of Your Data

Access to your personal data is restricted to:

• the responsible employees of our company, insofar as they need the data to fulfill their tasks and are committed to confidentiality
• the processors mentioned in this policy, with each of whom a contract according to Art. 28 GDPR exists
• notaries, lawyers, tax consultants, credit institutions, and authorities, insofar as this is necessary within the framework of initiating or concluding a contract or is required by law
• state bodies and courts, insofar as we are legally obliged to do so

A transfer or sale of your data to third parties for advertising purposes does not take place.

11. Transfer to Third Countries

Some of the services mentioned above are based in the European Union but may transfer data to group companies in the United States of America. This applies in particular to Google, Meta, and Microsoft.

On July 10, 2023, the European Commission determined with the EU-US Data Privacy Framework that an adequate level of protection exists in the USA for certified companies. Google LLC, Meta Platforms, Inc., and Microsoft Corporation are certified under this framework. In addition, we have agreed on the standard contractual clauses of the European Commission according to Art. 46(2)(c) GDPR with the mentioned providers.

We point out that despite these guarantees, access by state bodies to your data in the USA cannot be completely ruled out and you may not have the same legal protection options there as within the European Union. Insofar as the transfer is based on your consent, it takes place additionally on the basis of Art. 49(1)(a) GDPR.

12. Storage Duration

We store personal data only as long as it is necessary for the respective purpose or as required by statutory retention periods. Specifically, the following applies:

After the respective period has expired, the data is deleted or irrevocably anonymized.

13. Your Rights

As a data subject, you have the following rights under the GDPR. You can assert these against us at any time:

• Access (Art. 15 GDPR): You can request information about whether and which data we process about you, for what purpose, to which recipients, and for what duration.
• Rectification (Art. 16 GDPR): You can request the correction of incorrect and the completion of incomplete data.
• Erasure (Art. 17 GDPR): You can request the deletion of your data, provided that no statutory retention obligation prevents this.
• Restriction of processing (Art. 18 GDPR): You can request that we process your data only to a limited extent.
• Data portability (Art. 20 GDPR): You can request to receive the data you have provided in a structured, commonly used, and machine-readable format or to have it transferred to another controller.
• Withdrawal of consent (Art. 7(3) GDPR): You can withdraw a given consent at any time with effect for the future. The lawfulness of the processing carried out until then remains unaffected.
• Complaint (Art. 77 GDPR): You can complain to a supervisory authority.

To exercise your rights, an informal message to invest@aichner.bz.it or a letter to the address mentioned in Section 1 is sufficient. We will answer your inquiry immediately, at the latest within one month of receipt. To safeguard your rights, it may be necessary for us to verify your identity.

Competent Supervisory Authority

Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Rome, Italy
Phone: +39 06 69677 1
Email: garante@gpdp.it
Website: www.garanteprivacy.it

You can also contact the supervisory authority of your usual place of residence or your workplace.

14. Data Security

This website uses SSL or TLS encryption. You can recognize this by the address “https://” and the lock symbol in your browser line. Data that you transmit to us cannot be read by third parties as a result. In addition, we use appropriate technical and organizational measures according to Art. 32 GDPR to protect your data against loss, destruction, manipulation, and unauthorized access. Our measures are continuously reviewed and adapted in line with technical developments.

We point out that data transmission on the Internet can fundamentally have security gaps. Complete protection against access by third parties is not possible.

15. No Automated Decision-Making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.

16. Obligation to Provide Data

You are neither legally nor contractually obliged to provide us with personal data. However, without the information marked as mandatory fields, we cannot process your inquiry and cannot conclude a contract with you.

17. Changes to this Privacy Policy

We adapt this privacy policy as soon as the legal situation, our services, or the technologies used change. The version published on this page applies in each case. If a change affects processing based on your consent, we will obtain your consent again. We recommend that you visit this page occasionally and check the date given below.

Status of this privacy policy: August 28, 2026