Privacy

The data controller is MISTATION S.R.L., with registered office at Via Antonio Gambacorti Passerini 2, 20900 Monza (MB), Italy, VAT number IT14842310964. For any question about your data, write to info@oracapitaneo.com.

Browsing data

When you open a page, the servers that host the site record some technical data: IP address, date and time, the page requested, browser and operating system. They are needed to run the site and keep it secure.

Analytics, only with your consent

If you accept analytics cookies, Google Analytics 4 collects how you use the site: the pages you open, where you come from, your type of device and browser, and the city or region you connect from. Google Analytics 4 does not store IP addresses, and we have turned off Google Signals, which links data to Google accounts.

Marketing, only with your consent

If you accept marketing cookies, the Meta Pixel records the pages you visit on the site and sends them to Meta, with a browser identifier. It measures ORA’s campaigns on Instagram and Facebook and lets us show our ads to people who have visited the site.

Your cookie choices

When you choose in the banner, a technical cookie remembers your choice and CookieYes keeps a record of it: the date, the categories accepted or declined and a random identifier. They let us respect your choice and prove it.

Data you send us

If you write to us or call us, we use the data you give us to reply.

Analytics and marketing start only if you accept them in the cookie banner. Without your choice, or if you decline, they stay off. The site has no forms that collect data.

• To run the site and keep it secure: our legitimate interest (Art. 6(1)(f) of Regulation (EU) 2016/679, GDPR).
• For analytics and marketing: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code, Legislative Decree 196/2003). You can withdraw it at any time from “Cookie preferences” at the bottom of every page; withdrawal applies from then on.
• To remember and prove your cookie choices: a legal obligation (Arts. 6(1)(c) and 7(1) GDPR).
• To answer your requests: it is necessary to act on what you ask us (Art. 6(1)(b) GDPR).
• To meet legal obligations, where they apply (Art. 6(1)(c) GDPR).

Browsing data are needed to visit the site. Everything else is optional: if you decline analytics and marketing, the site works just the same.

• Vercel Inc., which hosts the site, as data processor (Art. 28 GDPR). Vercel is based in the United States and participates in the EU-U.S. Data Privacy Framework. For transfers outside the European Economic Area it also relies on the European Commission’s Standard Contractual Clauses.
• Google Ireland Limited, for Google Tag Manager, the tool that loads the site’s services, and for Google Analytics 4, as data processor. Data may reach Google LLC in the United States, which participates in the EU-U.S. Data Privacy Framework.
• Meta Platforms Ireland Limited, for the Meta Pixel. For collecting and sending the data from the site, MISTATION S.R.L. and Meta are joint controllers (Art. 26 GDPR); what Meta does with the data afterwards is decided by Meta, as controller, under its own privacy policy. Data may reach Meta Platforms, Inc. in the United States, which participates in the EU-U.S. Data Privacy Framework.
• CookieYes Limited, in the United Kingdom, which runs the cookie banner and the record of choices, as data processor. The United Kingdom has an adequacy decision from the European Commission.
• The people at MISTATION S.R.L. authorised to process them.
• Public authorities, only when the law requires it.

Data are not disclosed to the public and not sold.

Browsing data

Briefly, normally one day. They are kept longer only when needed to investigate abuse or a crime.

Cookies

The duration of each cookie is on the Cookies page.

Analytics

Google Analytics 4 keeps the data for 14 months, then deletes it.

Marketing

Meta keeps the data under its own terms.

The record of your choices

Up to 5 years, so that consent can be proven.

Your messages

As long as needed to reply and handle the request, then deleted, unless the law requires otherwise.

• You can ask at any time to see, correct or delete your data, to restrict its use, or to receive it in a readable format.
• You can also object to its processing (Arts. 15–22 GDPR).
• You can withdraw your consent to analytics and marketing at any time from “Cookie preferences”: withdrawal does not affect what happened before (Art. 7(3) GDPR).
• Write to info@oracapitaneo.com: we reply within 30 days.
• If you believe your data are not handled correctly, you can lodge a complaint with the Italian Data Protection Authority, www.garanteprivacy.it (opens in a new tab).

No decision about you is taken by automated means.

The site leads to other sites, such as Instagram or maps, only when you click. From then on, those sites’ policies apply.

We will update this policy when the site changes, for example before online booking opens or a new service is added.

Last updated: 13.11.2026.