Privacy Policy

ELITALY S.r.l. — the Italian legal entity and proposed data controller.
elitaly.club — the ELITALY Club digital platform, membership services and client relationships.
elitaly.luxury — the ELITALY luxury experiences, bespoke travel, concierge and lifestyle services platform.

ELITALY S.r.l. — Global Privacy Notice & Cookie Policy

Draft for elitaly.club and elitaly.luxury | 12 October 2026

I. Introduction

ELITALY S.r.l. (“ELITALY”, “we”, “us” or “our”) respects the privacy and confidentiality of its clients, members, guests, business partners and website visitors.

This Global Privacy Notice (“Notice”) explains how ELITALY collects, uses, stores, discloses and protects personal data in connection with its digital platforms, membership services, luxury travel arrangements, concierge services, curated experiences and related business activities.

This Notice applies to the activities of ELITALY S.r.l., including the following websites and brands:

ELITALY Club — elitaly.club

The ELITALY Club platform, through which eligible individuals may discover or access membership-related services, curated opportunities, privileged experiences, events and personalized lifestyle assistance, as applicable.

ELITALY Luxury — elitaly.luxury

The ELITALY Luxury platform, dedicated to bespoke luxury experiences, tailored travel arrangements, hospitality, concierge assistance and associated premium lifestyle services, as applicable.

For the purposes of this Notice, “Personal Data” means any information relating to an identified or identifiable natural person, as defined under Regulation (EU) 2016/679 (General Data Protection Regulation, or “GDPR”).

ELITALY S.r.l. acts as the data controller for processing activities for which it determines the purposes and means. Certain independent service providers, such as hotels, transportation operators and travel partners, may act as separate controllers for their own processing activities.

Data Controller

Legal entity: ELITALY S.r.l.

Registered office: Elitaly Srl, via Regina Margherita, 145 - 82020 - Molinara, Italy.

VAT / Company registration number: 01860330628

Privacy contact: info@elitaly.club

Data Protection Officer, if appointed: Andrea De Vizio, - CEO Elitaly

Supervisory authority: Garante per la protezione dei dati personali, Italy — www.garanteprivacy.it

II. How Personal Data Is Collected

ELITALY may collect personal data directly when individuals contact the company, complete an inquiry, apply for or maintain a membership, request a quotation, reserve an experience, purchase a service, attend an event or communicate with its representatives.

Subject to the technologies actually implemented, ELITALY may also collect information automatically when individuals use elitaly.club or elitaly.luxury, including IP addresses, device information, browser details, website interactions and cookie identifiers.

Personal data may also be received from third-party sources, including travel advisors, hotels, hospitality partners, experience providers, referral partners and other intermediaries where permitted by applicable law.

Minors

ELITALY's services are primarily intended for adults. Where services involve children or younger guests, relevant personal data may be processed to organize family travel, accommodation, transportation and experiences, subject to applicable legal requirements and appropriate parental or guardian involvement.

III. Categories of Personal Data and Purposes of Processing

ELITALY may process the following categories of personal data, depending on the nature of the relationship and services requested.

Data category

Processing purposes

Identity and contact details

Identifying clients, responding to inquiries, maintaining communications and arranging services

Membership information

Reviewing applications, administering membership privileges and managing member relationships

Personal preferences

Tailoring recommendations, travel arrangements, hospitality and concierge services

Booking and travel information

Organizing reservations, itineraries, transfers, accommodation and experiences

Identification documents

Completing reservations, complying with applicable travel requirements and verifying identity where necessary

Payment and billing details

Processing payments, refunds, invoices and financial records

Dietary, accessibility or health information

Accommodating specific needs where necessary and lawfully permitted

Digital activity and technical data

Operating and securing websites, measuring performance and managing permitted analytics

Marketing preferences

Managing subscriptions, invitations, communications and promotional preferences

Correspondence and feedback

Providing assistance, handling complaints and improving client service

ELITALY will seek to collect only data that is adequate, relevant and necessary for the specified purposes.

Client and member profiles

To provide personalized service, ELITALY may maintain records of client preferences, previous requests, booking history and relevant communications.

Such profiles may help ELITALY tailor future recommendations, anticipate service preferences and maintain continuity in the client relationship.

Where profiling is used for marketing, ELITALY will comply with applicable transparency, consent and objection requirements.

Special categories of personal data

Certain arrangements may require information concerning allergies, disabilities, accessibility requirements or other health-related needs.

ELITALY will process such information only where an appropriate legal basis and a valid condition under Article 9 GDPR apply, including explicit consent where required.

Access will be limited to authorized individuals and relevant providers who need the information to deliver the requested service.

IV. Legal Grounds for Processing Personal Data

ELITALY processes personal data under one or more of the following legal bases:

Performance of a contract — Article 6(1)(b) GDPR

Where processing is necessary to provide requested membership services, travel arrangements, concierge assistance, hospitality bookings or other contractual services, or to take steps at the individual's request before entering into a contract.

Legal obligations — Article 6(1)(c) GDPR

Where processing is necessary to comply with applicable accounting, tax, regulatory and other legal requirements.

Legitimate interests — Article 6(1)(f) GDPR

Where necessary for legitimate business purposes, such as preventing fraud, maintaining platform security, responding to certain business communications and improving service operations, provided those interests are not overridden by individuals' rights and freedoms.

Consent — Article 6(1)(a) GDPR

Where consent is required for activities such as certain electronic marketing communications, optional cookies or other specific processing activities.

Where consent is the applicable basis, individuals may withdraw it at any time without affecting the lawfulness of prior processing.

V. Disclosure of Personal Data to Third Parties

ELITALY may disclose relevant personal data to third parties where necessary to deliver requested services or meet lawful business obligations.

Recipients may include hotels and accommodation providers, airlines and transport operators, destination management companies, guides, restaurants, event organizers, luxury experience partners, payment service providers, technology suppliers and professional advisers.

Where providers act on ELITALY's behalf as data processors, ELITALY will implement appropriate contractual safeguards under Article 28 GDPR.

Where a provider independently determines the purposes and means of processing, that provider may act as an independent data controller.

ELITALY does not sell personal data in exchange for money. Any sharing with advertising or analytics partners must comply with applicable data protection and electronic communications rules.

International transfers

Given the international nature of luxury travel and concierge services, personal data may need to be transferred outside the European Economic Area.

Where the GDPR's international transfer rules apply, ELITALY will rely on an appropriate transfer mechanism, such as an adequacy decision, Standard Contractual Clauses or another permitted mechanism or derogation, depending on the circumstances.

Where necessary to arrange a requested service, specific information may be transferred to a provider in the destination country in accordance with applicable law.

VI. Your Privacy Rights

Subject to the conditions and exceptions established by the GDPR, individuals may exercise the following rights:

Access: Request confirmation of processing and access to their personal data.
Rectification: Request correction of inaccurate or incomplete information.
Erasure: Request deletion of personal data where legally applicable.
Restriction: Request limitations on certain processing activities.
Objection: Object to processing based on legitimate interests and object at any time to direct marketing.
Portability: Receive eligible personal data in a structured, commonly used, machine-readable format and request transmission where applicable.
Withdrawal of consent: Withdraw consent where processing relies upon it.
Automated decision-making: Exercise applicable rights concerning qualifying solely automated decisions, including profiling.
Complaint: Lodge a complaint with a competent data protection supervisory authority.

Requests may be submitted using ELITALY's designated privacy contact.

ELITALY will ordinarily respond within one month of receiving a request, subject to permitted extensions and identity verification requirements.

VII. Security and Retention

ELITALY will implement technical and organizational measures appropriate to the risks associated with the processing of personal data.

These may include access controls, secure communications, confidentiality obligations, appropriate authentication, supplier oversight and secure record-management procedures.

Personal data will be retained only for as long as necessary for the purposes for which it was collected, including the provision of services, the management of contractual relationships and compliance with legal obligations.

Financial and accounting records will be retained in accordance with applicable Italian statutory requirements, which may include ten-year retention obligations.

Marketing data, membership records, client preferences and technical logs will be subject to retention periods appropriate to their purposes and applicable law.

When personal data is no longer required, it will be deleted or anonymized, unless continued retention is legally justified.

VIII. Questions and Concerns

Questions about this Notice, ELITALY's privacy practices or the exercise of data protection rights may be directed to:

ELITALY S.r.l.

Privacy contact: [Insert verified email]

Registered office: [Insert address]

For concerns regarding GDPR compliance, individuals may also contact the Italian supervisory authority, the Garante per la protezione dei dati personali.

IX. International Privacy Considerations

ELITALY may provide services to individuals residing outside the European Union.

Where applicable, additional privacy obligations or rights may arise under the laws of those jurisdictions.

In particular, ELITALY will assess whether specific United States state privacy laws, including California privacy legislation, apply to its processing activities. Where required, supplementary notices and applicable opt-out mechanisms will be made available.

Nothing in this Notice limits rights that individuals possess under mandatory applicable data protection law.

ELITALY Online Cookie Notice

This Cookie Notice applies to elitaly.club and elitaly.luxury and supplements the Global Privacy Notice.

Cookies are small text files stored on a user's device when visiting a website. They may support essential functionality, remember preferences, measure website activity or enable advertising features.

Types of Cookies

Strictly necessary cookies

These support essential website functions, including security, navigation, session management and other functions necessary to deliver a service requested by the user.

Functional cookies

Where implemented, these may remember language choices, display settings and other preferences.

Analytics cookies

Where implemented, these may help ELITALY understand website traffic, navigation patterns and service performance.

Their use will be subject to applicable Italian and European consent requirements and exemptions.

Marketing and targeting cookies

Where implemented, these may support advertising attribution, audience measurement, personalized campaigns or remarketing.

Non-essential marketing and tracking technologies will be activated only where an appropriate legal basis exists, including prior consent where required.

Managing Cookie Preferences

Visitors to elitaly.club and elitaly.luxury should be provided with appropriate cookie controls allowing them to accept, reject or manage non-essential technologies.

Where consent is required, users must be able to withdraw it as easily as they provided it.

Disabling certain cookies may affect optional website functionality but should not prevent access to essential website services.

Other Tracking Technologies

Depending on the website configuration, ELITALY may use server logs, embedded scripts, pixels or similar technologies to support technical operations, security, analytics or marketing.

These technologies will be subject to applicable data protection and consent requirements.

Changes to This Notice

ELITALY may update this Global Privacy Notice and Cookie Notice to reflect changes in its services, legal obligations or processing practices.

The latest version will be published on the relevant ELITALY websites with an updated revision date.

Before publishing

This is a substantive adaptation of the supplied reference, not a verified statement of ELITALY's current practices. The following must be confirmed before publication:

ELITALY S.r.l.'s registered address, VAT number and privacy contact.
Whether ELITALY is the controller for both domains and whether either brand has additional legal operators.
The actual membership, booking, payment, CRM and marketing workflows.
The precise cookies, analytics tools, advertising pixels and consent-management platforms installed on each website.
The actual retention periods, international recipients and applicable transfer safeguards.
Whether U.S. state privacy requirements apply, rather than automatically importing A&K's U.S. provisions.

Recommended publication structure: use one consistent Global Privacy Notice for ELITALY S.r.l., with a domain-specific Cookie Policy and cookie inventory for each website. The original document's U.S. provisions should be included only to the extent legally applicable.

The text above is an English-language working draft and should receive Italian GDPR and cookie-law review before being published as a legal notice.