Notice on the use of Cookies and similar tracking technologies
Last revised: 6 November 2026

1. Introduction and regulatory references
This notice sets out the main information relating to the processing of personal data and the use of cookies within this site.
This notice is addressed to anyone who accesses or uses this site, describing how the user’s personal data may be collected, used and protected through cookies and similar technologies, as well as the rights granted by law.
These provisions do not concern other websites, pages or online services accessible through external links that may be present on the site, in respect of which you are invited to consult the relevant privacy notices.
This notice is provided in compliance with the principal national and international regulations on the protection of personal data, including:

• Regulation (EU) 2016/679 (GDPR) and Directive 2002/58/EC, known as the ePrivacy Directive
• UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, Privacy and Electronic Communications Regulations (PECR) and Data (Use and Access) Act 2025 (DUAA)
• Swiss Federal Act on Data Protection (nFADP / FADP)
• Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)
• California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
• Colorado Privacy Act (CPA)
• Connecticut Data Privacy Act (CTDPA)
• Delaware Personal Data Privacy Act (DPDPA)
• Indiana Consumer Data Protection Act (INCDPA)
• Iowa Consumer Data Protection Act (ICDPA)
• Kentucky Consumer Data Protection Act (KCDPA)
• Maryland Online Data Privacy Act (MODPA)
• Minnesota Consumer Data Privacy Act (MCDPA)
• Montana Consumer Data Privacy Act (MTCDPA)
• Nebraska Data Privacy Act (NDPA)
• Nevada Privacy Law (NRS 603A)
• New Hampshire Privacy Act (NHPA)
• New Jersey Data Privacy Act (NJDPA)
• Oregon Consumer Privacy Act (OCPA)
• Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
• Tennessee Information Protection Act (TIPA)
• Texas Data Privacy and Security Act (TDPSA)
• Utah Consumer Privacy Act (UCPA)
• Virginia Consumer Data Protection Act (VCDPA)
• Other regulations that may be applicable.

2. Who manages your data and how can you contact us?
Your personal data is processed by:
Building Heritage SRL
Via Montebello 17/A - 50123 - Firenze (FI), Italia
[email protected]
VAT ID: IT07138370486

For any information concerning the processing of personal data or to exercise the rights granted by law, data subjects may contact the Data Controller.

3. What data do we collect when you visit the site?
When you browse this site, we may collect certain information through cookies, related tools and tracking technologies. The main types of data that may be recorded include:

• Technical and navigation information: IP address, identifiers of the device in use, information about the browser and operating system, date and time of accesses, pages visited, technical commands necessary for the correct display of content, system errors.
• User preferences: choices made in relation to cookies and privacy settings, collected through panels, banners or similar tools.
• Statistical and usage data: information used to assess and improve the functioning of the site, for example the frequency of visits or the most consulted areas. This data may be processed in aggregated or anonymized form where the tool used allows it; in other cases the related processing takes place according to the preferences expressed by the user and as indicated in the detailed list of cookies.
• Interactions with integrated external services: technical data shared when the site integrates third-party services (e.g. fonts, maps, image display), always in accordance with the rules of the operators involved.

For details on the processing of data provided through contact forms, service requests or other features, we invite you to consult our Personal Data Policy.

4. What types of cookies (and similar) exist?
In general, there are several categories of cookies and similar technologies (web beacons, local storage and equivalent technologies). Below is a description of the categories that can generally be used; the list of those actually present on this site is set out in the following section “Services, purposes and personal data: detailed list of cookies”.

• Strictly necessary cookies: essential for the technical functioning of the site, they allow, for example, access to protected areas, session management or remembering essential preferences.
• Cookies for preferences and personalization: they serve to store display choices, such as language, text size or viewing mode, in order to offer you an interaction closer to your preferences.
• Analytics and performance cookies: they help us understand how the site is used. They may be used without prior consent only when all the conditions set by the applicable legislation, as interpreted by the competent authorities, are met: for example, when they are intended exclusively to produce statistics for improving the site, the data is adequately minimized or aggregated and any sharing with third parties is limited to that purpose. In other cases they are activated only with prior consent.
• Cookies for promotional or advertising activities: used to offer personalized commercial content and to monitor the effectiveness of advertising campaigns.
• External components and services: by interacting with social plugins, analytics tools or third-party platforms, cookies or comparable systems managed directly by external parties may be installed.

5. How can you give or refuse consent to the use of cookies?
Jurisdictions EU, United Kingdom, Switzerland, or in any case in countries with legislation similar to the GDPR:

• The use of cookies and similar technologies that are not strictly necessary is subject, where required by the applicable legislation, to the prior consent of the user, freely given, specific, informed and unambiguous; in other cases, it takes place in compliance with the conditions of lawfulness and, where applicable, on the basis of an appropriate legal basis, following transparent information and in compliance with the rights of refusal, objection or withdrawal provided for by the applicable legislation. As a precautionary choice, the consent management system My Agile Privacy® adopted on this site blocks the non-necessary cookies and tools configured by the Data Controller, including those that the system adds by itself when it detects them, until the user has expressed their preferences through the banner or the consent management panel.
• The user can manage and modify their preferences at any time, withdraw the consent granted and access the “Manage cookie preferences” function.

United States (California CCPA/CPRA, Colorado CPA, Connecticut CTDPA, Delaware DPDPA, Indiana INCDPA, Iowa ICDPA, Kentucky KCDPA, Maryland MODPA, Minnesota MCDPA, Montana MTCDPA, Nebraska NDPA, Nevada NRS 603A, New Hampshire NHPA, New Jersey NJDPA, Oregon OCPA, Rhode Island RIDTPPA, Tennessee TIPA, Texas TDPSA, Utah UCPA, Virginia VCDPA, any other state laws), Canada (PIPEDA), or in any case jurisdictions with similar legislation:

• Where provided for by the applicable US laws, the user may exercise the opt-out from the sale of personal data, its sharing or processing for targeted advertising and, where provided for, from profiling in furtherance of decisions that produce legal or similarly significant effects. With reference to Canada, where PIPEDA or the relevant provincial legislation applies, the collection, use and disclosure of personal information generally require valid and meaningful consent. The user may withdraw consent in the manner and within the limits provided for by the applicable law; where PIPEDA applies, withdrawal may take place at any time, with reasonable notice and subject to legal or contractual restrictions, after being informed of the related consequences.

Operational details:
On first access to the site, a banner is normally displayed that allows you to manage preferences relating to cookies and tracking tools.
Through the banner, the user can choose whether to:

• Accept all cookies: by clicking the dedicated button, all non-essential cookies will be activated.
• Customize the settings: you can select in detail which cookies to authorize and which to keep disabled.
• Reject optional cookies: by pressing the reject button or closing the banner via the dedicated close command (X), the default settings remain unchanged and browsing continues with only the technical cookies necessary for the functioning of the site; closing the banner therefore amounts to a refusal of consent.

The preferences expressed through the banner are retained for a period of 180 days by means of a technical cookie. If you access from a different device or browser, you will need to reconfigure your preferences.
The user may, in any case, at any time modify the choices made by accessing the dedicated functionality, identifiable by the icon or the link dedicated to consent management.

The preferences on the use of cookies and tracking tools are collected and managed through the consent management system (Consent Management Platform) My Agile Privacy®, a Google-certified partner for integration with Google Consent Mode v2.

6. On what legal bases do we process the data collected through cookies and related technologies?
The installation of cookies and the use of tracking tools are based on different legal bases depending on the category of the tool and the applicable legislation. In general:

1. Technical cookies and strictly necessary tools: they are used without the user’s consent, as they are necessary to carry out the transmission of a communication over an electronic communications network or to provide an information society service expressly requested by the user. This category includes, for example, cookies necessary for the functioning of the site, session management, security and the storage of consent preferences.
2. Cookies and tools that are not strictly necessary: they are used only with the user’s prior consent, which is freely given, specific, informed and revocable at any time. This category includes, for example, profiling, marketing and behavioral advertising cookies, social plugins and analytics tools that cannot be treated as technical cookies.

Where cookies or other tools involve the processing of personal data, the storage of information on the device or access to it is subject to consent only where this is required by the applicable legislation, save for the exemptions indicated above for strictly necessary tools; the subsequent processing operations on the data collected are based on a legal basis under the applicable data protection legislation. Any legitimate interest of the Data Controller may concern such subsequent processing, where necessary and proportionate (for example specific security activities), and cannot replace the consent required for tools that are not strictly necessary.

Additional rules and rights for US jurisdictions:
Where the US state laws on the protection of personal data indicated in this notice apply, the user may exercise at any time the opt-out from the sale of personal data, its sharing or processing for targeted advertising through the dedicated functions (the reject button in the banner or in the consent management panel accessible from the widget, which blocks non-necessary cookies and tools, and the Global Privacy Control (GPC) signal detected by the site). Where provided for, the opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects is exercised in the manner indicated in the Personal Data Policy.

With reference to Canada, where PIPEDA or the relevant provincial legislation applies, the collection, use and disclosure of personal information generally require valid and meaningful consent. The user may withdraw consent in the manner and within the limits provided for by the applicable law; where PIPEDA applies, withdrawal may take place at any time, with reasonable notice and subject to legal or contractual restrictions, after being informed of the related consequences. In Québec, the user is also informed in advance of the use of technologies that allow them to be identified, located or profiled and of the means to activate such functions; these functions are not activated by default and are activated only through an action of the user. Consent, where required, is clear, free and informed, is given for specific purposes and is requested separately for each purpose, in clear and plain language and, if requested in writing, separately from the other information presented to the user.

Refusing or withdrawing consent to the use of certain cookies may limit access to some personalized features of the site.

7. How is your data protected?
The personal data collected through this site by means of cookies and tracking tools is processed by electronic means in accordance with the principles of lawfulness, fairness, minimization, integrity and confidentiality.

In particular, communications between the user’s browser and the site are protected by HTTPS encryption, a measure aimed at reducing the risk of interception or manipulation of the data transmitted during browsing.

The Data Controller also adopts further technical and organizational measures appropriate to ensure a level of security suited to the risk. For details of such measures, please refer to the Personal Data Policy on this site.

8. Where can your data be processed and transferred?
Some of the cookies and third-party tools listed in the following section “Services, purposes and personal data: detailed list of cookies” are provided by parties that may process the data in countries other than the one in which you reside, including foreign countries.

The data collected through cookies and tracking tools is processed, as a rule, in the country where the Data Controller is established and at the service providers used. Where data is transferred or made accessible outside the relevant territory under the applicable legislation, the transfer takes place by means of one of the mechanisms it permits, including adequacy decisions, appropriate or suitable safeguards and, where applicable, derogations or other conditions provided for by the applicable legislation. For transfers subject to the GDPR, the relevant territory is the European Union / European Economic Area and, in particular, the EU-U.S. Data Privacy Framework, limited to organizations included in the relevant list and within the scope of the certification, and the Standard Contractual Clauses adopted by the European Commission are relevant. The destination countries and the mechanism actually applied are indicated in the detailed list of cookies, together with the methods for obtaining a copy of any safeguards.

For transfers to third countries subject to the UK GDPR, the basis consists of the adequacy determinations recognized by the United Kingdom (including, for the US, the UK Extension to the EU-US Data Privacy Framework - “UK-US Data Bridge” for certified suppliers) or of appropriate safeguards such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the Standard Contractual Clauses, subject to a positive outcome of the “data protection test” (transfer risk assessment, or “TRA”), carried out in a reasonable and proportionate manner given the circumstances of the transfer, to verify that the level of protection is not materially lower than that guaranteed in the United Kingdom.

The details of the individual suppliers and their respective destination countries are set out in the list in section 10. Countries to which transfers may take place: United States

9. Who can receive your data?
The personal data collected through cookies and tracking tools may be processed by the Data Controller, by authorized persons and by technical service providers or third parties involved in the provision of the services on the site.

Such parties may, depending on the activities actually carried out and the applicable legislation, process the data on behalf of the Data Controller or determine the purposes and means of the processing, independently or jointly with other parties. The identities or categories of such parties, their respective roles and, where relevant, the purposes are indicated in the detailed list of cookies; the privacy notices of the individual suppliers provide supplementary information.

With reference to the applicable US regulations, the involvement of third-party providers of advertising or profiling cookies may constitute, according to the definitions of the applicable law, a sale, a sharing for cross-context behavioral advertising or processing for targeted advertising: in such cases the user can exercise the related right to opt out as described in this notice. With reference to Canada, where PIPEDA or the relevant provincial legislation applies, the collection, use or disclosure of data by third parties for their own advertising or profiling purposes generally requires valid and meaningful consent, which the user may withdraw in accordance with the applicable law.

The updated list of suppliers can be consulted in section 10 and is also available on request at the Data Controller’s contact details.

10. Services, purposes and personal data: detailed list of cookies

Google Analytics

Google Analytics is a web analytics service provided by Google Ireland Limited ("Google"). Google uses the collected personal data to track and examine the usage of this website, compile reports on its activities, and share them with other Google services. Google may use your personal data to contextualize and personalize the ads of its advertising network. The data sent is collected for the purposes of personalizing the experience and statistical tracking. You can find more information on the "More information on Google's handling of personal information" page.

Place of processing: Ireland - Privacy Policy

Google Tag Manager

Google Tag Manager is a tag management service provided by Google Ireland Limited. You can find more information on the "More information on Google's handling of personal information" page.

Place of processing: Ireland - Privacy Policy

Cloudflare Web Analytics

Cloudflare Web Analytics is an analytics service provided by Cloudflare Inc. that gives the Data Controller insight into the use of this website by users.

Privacy Policy

Facebook Remarketing

Facebook Remarketing is a Remarketing and Behavioral Targeting service provided by Meta Platforms Ireland Limited. This service is used to link the activity of this website with the Facebook advertising network.

Place of processing: Ireland - Privacy Policy

Google Ads conversion tracking

Google Ads conversion tracking is an analytics service provided by Google Ireland Limited that is used to connect data from the Google Ads advertising network with actions performed on this Site.

Place of processing: Ireland - Privacy Policy

Google Fonts

Google Fonts is a service used to display font styles operated by Google Ireland Limited and serves to integrate such content into its pages.

Place of processing: Ireland - Privacy Policy

Google reCAPTCHA

Google reCAPTCHA is a SPAM protection service provided by Google Ireland Limited.
The use of reCAPTCHA is subject to the Google privacy policy and terms of use.

Place of processing: Ireland - Privacy Policy

Hotjar Heat Maps & Recordings

Hotjar is a session recording and heat mapping service provided by Hotjar Ltd.

Place of processing: Malta - Privacy Policy

LinkedIn Insight Tag

LinkedIn conversion tracking (LinkedIn Insight Tag) is an analytics and behavioral targeting service provided by LinkedIn Corporation that connects data from the LinkedIn advertising network with actions performed on this Website.

Place of processing: United States - Privacy Policy

Microsoft Clarity

Clarity is a session recording and heat mapping service provided by Microsoft Corporation.

Place of processing: United States - Privacy Policy

11. How long do we keep your data and preferences?

The preferences expressed on the use of cookies and tracking technologies through the banner or the consent management platform are retained for a period of 180 days.

For the retention, duration and methods of deletion of data other than those mentioned, you can consult the specific provisions set out in the Personal Data Policy on this site.

12. What are your rights regarding the data collected?
In relation to the data collected through cookies and tracking tools, the user can exercise at any time the rights granted by the applicable legislation.

In particular, the right most directly connected to cookies is the right to withdraw the consent previously given to the use of non-essential cookies and to modify one’s preferences at any time, through the dedicated consent management function identifiable by the icon or the dedicated link, without retroactive effect on the lawfulness of processing already carried out on the basis of consent, without prejudice to the further rights provided for by the applicable legislation, including, where applicable, the right to erasure or deletion of the data.

Users in the United Kingdom have the right to make a data protection complaint to the Data Controller; the Data Controller will acknowledge receipt within 30 days and take appropriate steps to respond to the complaint without undue delay, informing the data subject of the progress and outcome. This is without prejudice to the right to approach the competent UK supervisory authority.

With reference to the applicable US regulations, the user can exercise the right to opt out of the sale of personal data, its sharing or processing for targeted advertising through the dedicated functions of the banner or of the consent management widget, or through the Global Privacy Control (GPC) signal sent by the browser. Where provided for, the opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects is exercised in the manner indicated in the Personal Data Policy. With reference to Canada, where PIPEDA or the relevant provincial legislation applies, the user may withdraw consent to the use or disclosure of data for marketing purposes and request its cessation, in the manner and within the limits provided for by the applicable law; where PIPEDA applies, with reasonable notice and subject to legal or contractual restrictions.

The user also has, under the applicable legislation, the further rights granted to data subjects - including access, rectification, erasure, restriction, objection to processing, data portability and lodging a complaint with the competent authority, pursuant to Article 77 of the GDPR. For a full description of these rights and the methods of exercising them, please refer to the Personal Data Policy on this site.

13. How to delete cookies

Each browser provides different procedures to prevent the use of cookies or to remove them. You can act from the settings of your browser to block and/or delete them. Below you will find references to the official guides of the main browsers on how to manage and delete cookies:

• instructions for Google Chrome
• instructions for Safari
• instructions for Mozilla Firefox
• instructions for Microsoft Edge

If you use a browser other than those indicated, consult the support section of the official website of the relevant manufacturer.

14. How do we inform you of changes to this notice?
This notice is subject to periodic revision to reflect regulatory changes or modifications to the services offered through the site. Any significant change will be communicated through this page. For Minnesota consumers, when the Data Controller makes a material change to this notice or to its processing practices, it takes reasonable electronic measures to notify affected consumers, with respect to personal data collected after the change, and gives them a reasonable opportunity to withdraw consent to any further materially different collection, processing or transfer of previously collected personal data. For Connecticut consumers, in the event of material changes with retroactive effect, the Data Controller takes reasonable electronic measures to notify affected consumers and gives them a reasonable opportunity to withdraw consent to any further materially different collection, processing or transfer of previously collected personal data.
Last revised: 6 November 2026