+39 010 986 3324
info@tilobusiness.eu
Via XX Settembre 7/3, GenoaInformation on the processing of personal data of tilolux.com users (Articles 13 and 14 of Regulation (EU) 2016/679 – "GDPR" – and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018)
Last updated: 12 October 2026
1. Data controller
The data controller is Tilo Srl, VAT No. 02945640999, REA GE-521993, registered and operating office at Via XX Settembre 7/3, 16121 Genoa. Tilo Lux is the Tilo Srl brand dedicated to the management of villas and prestigious properties.
For any privacy question or to exercise your rights, write to info@tilobusiness.eu or call +39 010 986 3324.
Tilo Srl has not appointed a Data Protection Officer (DPO), as none of the cases in which it is mandatory applies (Article 37 GDPR).
2. What this policy covers
This policy covers the personal data collected through tilolux.com (Italian and English pages): browsing, contact and free evaluation forms, contacts by e-mail, phone and WhatsApp, usage statistics and the presentation video. Cookies are described in the Cookie Policy at the end of this page.
It does not cover third-party websites reached through links (booking engine, owners' area, social networks), which have their own policies: see section 4.5.
3. What data we process
- Browsing data: IP address, date and time of the request, page requested, referring page, browser and device type.
- Data you give us through the forms: first and last name, e-mail, phone number, property type, address, floor area, number of rooms, message and, in the evaluation/quote forms, the photos or documents of the property you choose to attach (up to 10 files, 20 MB in total). We also record the page from which you sent the form and, to protect it from abuse, your IP address and browser type.
- Data you give us when contacting us by e-mail, phone or WhatsApp: your contact details and the content of your messages.
- Data collected through cookies, only with your consent: online identifiers, pages visited, interactions (e.g. clicks on phone, e-mail or WhatsApp, form submissions).
We do not ask for special categories of data or payment details: please do not include them in the forms or photos.
4. Purposes, legal basis and retention
4.1 Browsing and website security
Browsing data are used to run the website, keep it secure (preventing attacks and automated form submissions: hidden anti-spam field, minimum filling time, limit on submissions per IP address) and detect malfunctions.
- Legal basis: legitimate interest in the security and proper functioning of the website (Article 6(1)(f) GDPR).
- Retention: server logs for no more than 14 days, unless needed to establish an offence.
4.2 Information requests and property evaluation
We use the form data and your messages to answer you, evaluate your property, prepare a management proposal and contact you by phone, e-mail or WhatsApp about your request, including to arrange a site visit.
- Legal basis: pre-contractual measures taken at your request (Article 6(1)(b) GDPR). The checkbox in the form confirms that you have read this policy: it is not a consent, which is not required for this purpose.
- Provision of data: name, e-mail and phone (and the property address in the evaluation form) are needed to answer you; the other fields and the photos are optional.
- Retention: 24 months from the last contact if the request does not lead to an agreement; photos are deleted together with the request. If you sign a management agreement, data are kept for its term and then for 10 years for civil-law and tax obligations (Article 2220 of the Italian Civil Code).
4.3 Usage statistics (Google Analytics 4)
With your consent we use Google Analytics 4 to know, in aggregate form, how many people visit the website, which pages they read and which contacts they generate.
- Legal basis: consent (Article 6(1)(a) GDPR and Article 122 of Legislative Decree 196/2003), given through the cookie banner and revocable at any time.
- Retention: for the period set in the Analytics property (14 months at most); cookies last as indicated in the Cookie Policy.
Google Consent Mode. Until you give consent, Google Analytics neither sets nor reads cookies; the Google tag still sends Google cookieless signals (consent status, page visited, browser type and, necessarily, the IP address), which Google uses for aggregate estimates. The website uses no advertising tools (neither Google Ads nor Meta Pixel).
4.4 Presentation video (YouTube)
The home page offers a video hosted on YouTube in "privacy-enhanced mode" (youtube-nocookie.com), which loads only if you ask for it with the "Watch the video" button. To play it your browser connects to Google's servers, which receive your IP address and some technical information about the device; the player stores some technical information in the browser (see the Cookie Policy). YouTube sets no profiling cookies unless you interact with the video.
- Legal basis: legitimate interest in presenting our services with video content (Article 6(1)(f) GDPR).
- Independent controller: Google Ireland Limited, for the data it processes through YouTube.
4.5 Links to external services
- Apartment booking (book.tilobusiness.eu) and owners' area (vr.krossbooking.com/tilo): platforms of the Kross Booking property-management software, which Tilo uses for bookings and the owners' reserved area. The website only links to them: data entered there are processed by Tilo Srl through Kross Booking, under the notice shown on those pages.
- WhatsApp: the button opens a chat in the WhatsApp app (Meta). Your message and number are processed by us to answer you (Article 6(1)(b) GDPR) and by WhatsApp under its own policy.
- Social networks (Facebook, Instagram, TikTok): plain links; no social media content is loaded on the website.
4.6 Legal obligations and protection of rights
We may process data to comply with legal obligations or requests from authorities (Article 6(1)(c) GDPR) and to establish, exercise or defend legal claims (Article 6(1)(f) GDPR), for as long as strictly necessary.
5. How we process data
Data are processed electronically by people authorised and instructed by Tilo Srl, with appropriate technical and organisational measures: encrypted connection (HTTPS), access limited to those handling your request and protected by credentials, backups. We do not take decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you (Article 22 GDPR).
6. Who receives the data
Data are neither disclosed to the public nor sold. They may be received, only for the purposes stated:
- by the staff of Tilo Srl and of the Tilo group handling owners' requests;
- by technical service providers (hosting, website maintenance and handling of the requests sent through the forms), appointed as processors under Article 28 GDPR, with servers in the European Union;
- by the providers of our business e-mail: Aruba S.p.A. (Italy) and Google Ireland Limited (Google Workspace);
- by Google Ireland Limited (and Google LLC) for Google Analytics and YouTube;
- by Kross Booking, for the booking and owners' area reached through the website links;
- by advisers (accountants, lawyers) within the limits of their engagement, and by public authorities where the law requires it.
The up-to-date list of processors is available on request at info@tilobusiness.eu.
7. Transfers outside the European Union
The website and the lead-management system are hosted in the European Union. Some Google services may involve transfers of data to the United States: Google LLC participates in the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and also applies the European Commission's Standard Contractual Clauses.
8. Your rights
At any time you can ask Tilo Srl for access to your data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), portability of the data you provided (Article 20), and you can object to processing based on legitimate interest (Article 21).
Where processing is based on consent, you can withdraw it at any time, without affecting what was done before: for cookies, use "Cookie preferences" in the footer.
To exercise your rights write to info@tilobusiness.eu. We answer within one month (extendable by two months for complex requests, with notice) and may ask you to confirm your identity.
You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it, Piazza Venezia 11, 00187 Rome) or with the supervisory authority of the EU country where you live or work.
9. Children
The website is addressed to adult property owners and is not intended for anyone under 18. We do not knowingly collect data from minors.
10. Changes
We may update this policy; the date of the last update is shown at the top and material changes will be highlighted on the website.
Cookie Policy
Cookie policy of tilolux.com (Article 122 of Italian Legislative Decree 196/2003, Italian Data Protection Authority cookie guidelines of 10 June 2021, Articles 13 and 14 GDPR)
Last updated: 12 October 2026 – applies to visitors from the European Economic Area and Switzerland.
1. What cookies are
Cookies are small text files that a website saves in your browser and reads again on later visits. Similar tools are browser storage (localStorage, IndexedDB) and tags that send information to an external service: on this page we call them all "cookies".
- Technical cookies: needed to run the website or remember a choice you made. They do not require consent.
- Statistics cookies: measure how the website is used. Here they are third-party and not anonymised, so we use them only with your consent.
- Marketing cookies: none at present. The category appears in the banner for completeness; if we ever introduce advertising tools we will update this page and enable them only with your consent.
The controller is Tilo Srl, Via XX Settembre 7/3, 16121 Genoa, Italy – VAT No. 02945640999 – info@tilobusiness.eu.
2. How you choose
On your first visit a banner shows the options Reject, Preferences (to choose category by category) and Accept all. Closing the banner with the X means rejecting: only technical cookies remain active. Scrolling or continuing to browse is not consent.
Your choice is stored in the technical cookie tilo_consent for 6 months; you can change it at any time with the "Cookie preferences" link in the footer or with the button below.
3. Cookies used by this website
Technical and functional cookies (always active)
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
tilo_consent | Tilo (this website) | Remembers the choice made in the cookie banner | 6 months | First party |
yt-player-bandwidth, yt-icons-last-purged, ytidb::LAST_RESULT_ENTRY_KEY, YtIdbMeta database | YouTube (Google), home page video in privacy-enhanced mode | Store technical information for the video player (playback quality, cache) | persistent, until browser data are cleared | Third party (youtube-nocookie.com local storage) |
Statistics cookies (only with consent)
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
_ga | Google Analytics 4 | Distinguishes visitors to compute aggregate statistics | 2 years | First party, managed by Google |
_ga_KH3R6TLE88 | Google Analytics 4 | Keeps the state of the browsing session | 2 years | First party, managed by Google |
Marketing cookies
None.
Before consent
The website uses Google Consent Mode v2 in "advanced" mode: the Google tag (GT-WBK5X432) loads before you choose, with consent denied by default. At this stage it neither sets nor reads cookies and sends Google only cookieless signals (consent status, page visited, browser type and, necessarily, the IP address), used for aggregate estimates. If you reject, nothing changes.
The home page video loads from youtube-nocookie.com only if you ask for it with the "Watch the video" button (or you can open it on youtube.com in a new tab): from then on your browser connects to Google's (YouTube) servers to play it, sending your IP address; YouTube sets no cookies but uses the local storage listed above.
Fonts are hosted on our own server and are not loaded from Google Fonts.
4. Third-party providers
| Provider | Services | Privacy policy | Transfer outside the EU |
|---|---|---|---|
| Google Ireland Ltd / Google LLC | Google Analytics, YouTube | policies.google.com/privacy · how Google uses data from sites | Yes, to the USA: EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
You can install the Google Analytics opt-out browser add-on.
5. Managing cookies in your browser
You can also block or delete cookies in your browser settings: Chrome, Firefox, Safari, Edge. Blocking technical cookies may stop parts of the website from working.
6. Changes
We update this page when the cookies used by the website change; if the changes are material, the banner will be shown again.