The Data Controller for personal data collected through this website and in the context of professional engagements is:
This Privacy Policy is drafted in compliance with:
| Category | Examples | How Collected |
|---|---|---|
| Identification data | Full name, nationality, date of birth | Directly from you |
| Contact data | Email, phone number, postal address | Directly from you |
| Professional data | Occupation, company name, professional role | Directly from you |
| Engagement data | Property preferences, budget, search criteria, investment objectives, correspondence | During advisory sessions |
| Financial data | Budget indications, funding source (AML compliance) | During engagement onboarding |
| Technical data | IP address, browser type, pages visited | Automatically via website |
We do not collect special categories of personal data (GDPR Art. 9) unless strictly required and with your explicit consent.
| Purpose | Legal Basis (GDPR) |
|---|---|
| Responding to inquiries and providing advisory services | Art. 6(1)(b) — Contract performance / pre-contractual steps |
| Executing and managing advisory mandates | Art. 6(1)(b) — Contract performance |
| Compliance with legal, tax and accounting obligations | Art. 6(1)(c) — Legal obligation |
| Communication relevant to ongoing engagements | Art. 6(1)(f) — Legitimate interest |
| Anti-Money Laundering (AML) verification where required | Art. 6(1)(c) — Legal obligation (D.Lgs. 231/2007) |
| Sending professional updates or market insights (with consent) | Art. 6(1)(a) — Consent |
| Website analytics (anonymised data only) | Art. 6(1)(f) — Legitimate interest |
Personal data may be shared, strictly on a need-to-know basis and subject to confidentiality obligations, with:
We never sell, rent or transfer your personal data to third parties for commercial or marketing purposes.
Where data is shared with recipients outside the European Economic Area (EEA), we ensure adequate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or applicable adequacy decisions. Transfers may occur in the context of engagements involving clients or properties in Switzerland, the United Kingdom, the United States or other non-EEA jurisdictions.
| Type of Data | Retention Period | Reason |
|---|---|---|
| Inquiry data (no mandate signed) | 12 months from last contact | Legitimate interest / pre-contractual |
| Engagement and contractual data | 10 years from mandate conclusion | Italian Civil Code Art. 2946 |
| Invoicing and accounting data | 10 years | Italian tax law (D.P.R. 633/1972) |
| AML documentation | 10 years | Legislative Decree 231/2007 |
| Website technical logs | 12 months | Security and performance monitoring |
| Newsletter / consent data | Until consent withdrawn + 12 months | Consent-based processing |
You may exercise the following rights at any time by contacting luca@ltboutiqueadvisory.com. We will respond within 30 days (GDPR Art. 12):
If you are based in another EU/EEA country, you may also contact your local supervisory authority.
This website uses no profiling or marketing cookies. Only strictly necessary technical cookies may be used for website functionality. Should additional cookies be introduced in the future, this policy will be updated and a consent mechanism implemented in line with Italian DPA guidelines (Provvedimento del 10 giugno 2021).
We implement appropriate technical and organisational security measures, including encrypted communications (HTTPS/TLS), access controls, confidentiality obligations for all professionals handling your data, and secure storage practices proportionate to data sensitivity.
Our services are directed exclusively at adults (18+). We do not knowingly collect personal data from minors. If we become aware that data from a minor has been collected, we will delete it promptly.
This Privacy Policy may be updated periodically. The current version, with its effective date, will always be published on this page. For material changes, we will notify active clients directly.