This Privacy and Cookie Policy describes the purposes and methods relating to the ways in which COIMA SGR S.p.A., the data controller ( “Company” or “Data Controller”) collects and processes the personal data concerning a user (the ”User”) who interacts with the website [https://villaggio.coima.com/] and the relative extensions (“Website”) and the various services that it offers, and how the Company uses cookies and/or other tracking tools on the Website.
The information in this Privacy and Cookie Policy is provided pursuant to Article. 13 of Regulation (EU) no. 679 of 27 April 2016 (“Regulation” or “GDPR”), the Measures issued by the Italian Data Protection Authority and the European authority Guidelines.
Information regarding data processing is only provided for the Website and for processing by the Company and does not extend to processing performed by third parties by means of any other websites the User may be able to consult via links available on the Website. The Company does not accept liability for any such further processing, since the User is responsible for consulting the individual privacy policies of the relevant third-party websites.
1. Data controller
The data controller is COIMA SGR S.p.A., with registered office in Milan (Italy), Piazza Gae Aulenti, 12, 20154, VAT Number 05688240968.
2. Data processing procedures
The Data Controller processes the User’s data with the aid of all appropriate security measures to prevent unauthorised access to or unauthorised disclosure, modification or destruction of the data. Processing takes place using IT tools, with organisational procedures and methods strictly correlated and restricted to the stated purposes.
3. Purposes and legal basis of data processing
Through the Website, the Company may process Users’ data for the following purposes:
- Contact with the Company. The User may contact the Company to request information using the contact data provided on the Website. In this context, the Company will process the personal data contributed voluntarily by the User (e.g. name and address and contact details) in order to receive, correctly manage and reply to the communications and/or requests received from them. The legal basis for the processing is the performance of a service specifically requested by the User (Article 6 (1)(b) GDPR). The contribution of personal data for this purpose is necessary for compliance with the User’s request; in case of failure to contribute the personal data, it will be impossible to manage and reply to the communication or query.
- Updating Users on progress of the “Villaggio” student housing. Users have the option of registering and receiving updates concerning the opening of the Villaggio (the “Newsletter”). In this context, the Company will process the personal data contributed by the User (e.g. name and address and contact details) in order to receive and correctly manage registration requests received from them. The legal basis of the processing is the User’s consent, which they may withdraw at any time (Article 6 (1)(a) GDPR).
- Transfer of data to the future managing entity of the Villaggio. In addition, the User’s data (e.g. name and address and contact details) may be transferred, with their prior consent, to the entity designated to manage the Villaggio on its completion. The legal basis of the processing is the User’s consent, which they may withdraw at any time (Article 6 (1)(a) GDPR).
- Pursuance of the legitimate interests of the Company and/or third parties. The User’s data may also be used in order to exercise the rights and/or pursue the legitimate interests of the Company and/or third parties, such as the management of complaints and litigation and the prevention of fraud and/or unlawful activities (Article 6 (1)(f) GDPR). In these cases, although the contribution of the User’s personal data is not compulsory, it is still necessary to the extent that these data are closely linked to and useful for the pursuance of the Company’s legitimate interests, which prevail over the User’s fundamental rights and freedoms; in the event of refusal to contribute these data the Company may be unable to provide the services requested (e.g. request to subscribe to the Newsletter).
4. Categories of data processed
Through the Website, the Company receives and collects information about any User who browses the Website’s pages and uses the web services it provides. Specifically, the Company acquires and processes the following information.
4.1 Data collected via browsing and cookies
When a User visits the Website, it collects navigation data such as, for example, the User’s IP address and the duration of the session (“navigation data”). The Company uses these data for technical purposes.
Navigation data might also be used to identify those responsible in the event of IT crimes against the Website.
For information about collection of the User’s data using cookies and similar technologies, please refer to the Cookie Policy (section 8).
4.2 Data contributed voluntarily by the User
The Company only collects information contributed voluntarily by the User and that necessary for pursuance of the purposes set out in section 3 “Purposes and legal basis of data processing“ above (e.g. name and address and contact details). In addition, the Company may collect and process additional personal data contributed voluntarily by the User in the context of the services offered by the Website, such as if the User contacts the Company to report problems, exercise their rights with regard to the processing of personal data, etc.
5. Disclosure of data to third parties
Data contributed by the User and collected by the Website in the context of the relevant services (e.g. IP address) will not be disseminated and may be disclosed, for the purposes and by the procedures described in this Privacy and Cookie Policy, to the following categories of entities:
- COIMA platform companies, for organisational purposes or in-house controls, for pursuance of the legitimate interests of the Company and/or third parties, and for the performance of services requested/fulfilment of requests made by Users;
- companies, associates, consultants or professionals contracted by the Company to perform technical or organisational functions (e.g. IT service providers), or with which the Company cooperates (including the other COIMA companies) for the provision and functioning of its services, or for possible communication activities;
- entity designated to manage the Villaggio;
- individuals, companies or professional firms providing assistance and consultancy services to the Company, with particular but not exclusive reference to accounting, administrative, legal, tax and financial matters;
- entities having a right to access the data under the law or by order of the authorities.
Entities in the aforesaid categories will use the data, depending on circumstances, as independent data controllers in accordance with the law, or as data processors formally designated and instructed by the Company by means of a contract pursuant to art. 28 GDPR.
The list of entities to which data are or may be disclosed can be requested from the Company using the contacts provided in section 7 “User’s Rights and Contacts”.
6. Data storage
Data are processed for the time necessary for performance of the activities described in section 3 above, and are erased on expiry of the purposes for which they were collected and processed.
Information collected via cookies will be stored for the times stated in each table provided in section 8 below.
7. User’s rights and contacts
In the cases envisaged by the law and when applicable, the User may exercise the following rights under the Regulation:
- Right to access: the right to obtain from the Data Controller confirmation as to whether their personal data are being processed (or whether an automated decision-making process is being used) and, where that is the case, to obtain access to and/or a copy of such data (Article 15 GDPR).
- Right to rectification: the right to obtain the rectification or completion of inaccurate, partial and/or incomplete personal data (Article 16 GDPR).
- Right to erasure (right to be forgotten): when specific grounds apply, the right to obtain the erasure of the personal data without undue delay (Article 17 GDPR).
- Right to restriction of processing: when specific grounds apply, the right to obtain the restriction of processing (e.g. if the right to rectification is exercised and/or if the processing is unlawful). Where processing has been restricted, the personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. In all cases, the Company shall notify the User before this restriction is revoked (Article 18 GDPR).
- The right to data portability: when specific grounds apply, the right to request and receive all their personal data processed by the Data Processor in a structured, commonly used and machine-readable format or to request their transmission to another controller without hindrance (Article 20 GDPR).
- Right to withdraw consent: the right to revoke, at any time, any consent given to data processing, without prejudice to the lawfulness of processing based on the consent given before revocation.
To exercise these rights and for more information about processing (e.g. regarding the recipients of personal data and storage periods), Users may send an email to privacy@coimasgr.com.
To conclude, if the User considers that the processing of their personal data is in breach of data protection legislation, they may lodge a complaint with the relevant Supervisory Authority using the contacts available at https://www.garanteprivacy.it/.
8. Collection of data via cookies
8.1 About cookies
In general terms, cookies are short text files which the websites visited by the User send to the terminal via which they accessed the Internet (usually to the browser), where they are stored and then re-transmitted to the same websites at the same User’s next visit. Every cookie is unique in relation to the browser and device used to access the Website.
Cookies may be installed by the owner or manager of the website the User is visiting (“first-party cookies”) or by other providers (“third-party cookies”).
Cookies may be permanently stored on the User’s device. In this case, they are not erased when the browser is shut down but remain until a set expiry date or until deleted by the User (“permanent cookies”); otherwise, they may be erased automatically whenever the User leaves the Website or the browser is shut down (“session cookies”).
Cookies may be:
- Technical: these cookies are necessary for the correct functioning of a website, i.e. they are used to store Users’ information during their subsequent visits to the website. Therefore, they do not require the User’s consent;
- Analytical: these cookies may be used, amongst other purposes, to assess the efficacy of one of the information company’s services, for the design of a website or to help to measure its “traffic”, i.e. the number of visitors, if required also subdivided by geographical, area, time of visit, or other characteristics. The use of analytical cookies installed and managed directly by the first party for statistical purposes (within the limits of a simple statistical count) does not require the User’s consent, as they are considered equivalent to technical cookies. However, if they are used by third parties, they can only be considered equivalent to technical cookies if there is no possibility that their use will lead to direct identification of the data subject (“singling out”). In other words, the User’s consent will not be required if: (i) the same cookie refers to not one but multiple devices, in order to create a reasonable degree of uncertainty regarding the digital identity of the subject which receives it (e.g. by masking appropriate parts of the IP address); (ii) the cookies are only used to produce aggregate statistics relating to a single website or mobile app, and; (iii) the third parties do not combine the analytical cookies, thus minimised, with other data processing, or share them with other third parties. Naturally, if they are not equivalent to technical cookies, they require the User’s consent;
- Profiling: these cookies are used to link specific actions or recurrent patterns of behaviour in use of the functions provided by websites to specific identified or identifiable users, in order to group the various profiles in uniform groups of different size, to enable the Data Controller, amongst other things, to modulate the provision of the service in a more and more customised manner above and beyond the extent to which this is strictly necessary for its delivery, and to send advertising messages in line with the preferences expressed by the same user during their online browsing. These cookies cannot be used without the User’s consent.
8.2 Cookies used on the Website
For a full list of the cookies used on the Website, please refer to the table provided at this section.
8.3 Changing and managing cookie settings
Most browsers (e.g. Internet Explorer, Firefox, Chrome, etc.) are configured to accept, manage and disable cookies through their own settings. Browser settings can be used to block or delete cookies received from this or any other Website, by changing the browser’s settings using its relevant function.
The settings for managing cookie preferences can normally be found in the “options” or “preferences” heading of the browser menu.
The following are the links to the instructions for the listed browsers:
Microsoft Edge – Manage cookies in Microsoft Edge: View, allow, block, delete and use – Microsoft Support
Chrome – Delete, allow and manage cookies in Chrome: – Computer – Google Chrome Help
Firefox – Cookie management | Firefox support
Opera – http://www.opera.com/help/tutorials/security/privacy/
Safari – Deleting Cookies in Safari on Mac – Apple Help (EN)
Otherwise, users can manage their cookie choices using the www.aboutcookies.org website.
Please bear in mind that disabling all cookies, including strictly necessary cookies, could interfere with browsing of the Website and prevent use of some of its functions.
9. Use of other websites
Users are advised to read the privacy and cookie policies of any websites accessed via the links provided on the Website. Please note that the cookie preferences set on this Website will not be active on the websites of other companies.
10. Transfer to non-EU countries
Unless this is strictly necessary for the purposes set out in this Privacy and Cookie Policy, the Company will not transfer Users’ personal data to entities based outside the European Economic Area (“EEA”).
If data are transferred outside the EEA, the Company will adopt all necessary measures to guarantee compliance with the provisions of Chapter V of the Regulation.
11. Changes to the Privacy and Cookie Policy
The Company reserves the right to amend this Privacy and Cookie Policy at any time, notifying users via publication on the Website. Users are kindly requested to check the Website for updates. In case of particularly significant changes and/or major impacts to the User’s rights, the Company may inform the User via other means (e.g. by sending an email).
Privacy and Cookie Policy updated to September 2025
