This notice explains what personal data My Villa collects through myvilla.la (the "Site"), why we collect it, on which legal basis, who processes it on our behalf, how long we keep it and which rights you have. It is written to satisfy the EU General Data Protection Regulation (GDPR), the UK GDPR and the California Consumer Privacy Act (CCPA/CPRA) notice-at-collection requirements, in plain English.
The controller of your personal data is My Villa, the Los Angeles practice of IT'S Architecture.
For any privacy question or request, write to info@myvilla.la. We answer from that same address.
Briefing and contact forms. When you request a private briefing we ask for your first name, email address and three quick choices (type of project, timeline, how you found us). Optionally you may add your last name, phone number, the location of your site, who referred you, a short message, and whether you would like occasional insights from us. The form also records technical context that helps us understand where a request comes from: the page you submitted it from, the page you arrived on, the referring site and any campaign parameters in the address (utm_*, and the click reference some advertising platforms add, such as ChatGPT's oppref). These parameters are kept in your browser for up to 30 days, only so that a request you send later can be attributed to the campaign that brought you here; they contain no personal data and are not kept if you decline analytics cookies. The form contains a hidden anti-spam field that real visitors never see or fill.
Email. If you write to us, we keep the correspondence, including your address and anything you choose to share.
AI assistant (when active). If the Site offers a chat assistant, it is clearly labelled as automated. What you type is used to answer you and may be reviewed by our team to improve answers and, if you ask for a briefing, to prepare it. Please do not type sensitive information into it.
Analytics, with your consent where required. With Google Analytics 4 we measure pages viewed, approximate location (city level), device and browser type, the referring site and interactions with buttons and forms (for example that a form was started or submitted, never what you typed into it). IP addresses are not stored by Google Analytics 4. See section 8.
Server logs. Our hosting providers keep standard access logs (IP address, time, requested page, user agent) for security and operations.
We do not collect financial information, government identifiers or special categories of data through the Site, and we ask you not to send them.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Answering your briefing request, scheduling a call and preparing a feasibility read of your site | Form data, correspondence | Steps at your request prior to a contract (art. 6(1)(b)) |
| Following up on an open request a small number of times, and keeping a record of the conversation | Form data, correspondence, notes | Legitimate interest in responding to enquiries we received (art. 6(1)(f)) |
| Sending occasional insights on insurable building in California | Name, email | Your consent, given by ticking the box; withdrawable at any time (art. 6(1)(a)) |
| Classifying and prioritising requests (for example by area and timeline) with software assistance, always reviewed by a person before any decision | Form data | Legitimate interest (art. 6(1)(f)); no solely automated decision with legal or similarly significant effect |
| Measuring how the Site is used and improving it | Analytics data | Consent in the EEA, UK and Switzerland (art. 6(1)(a)); legitimate interest elsewhere, with opt-out |
| Security, spam prevention and legal compliance | Logs, honeypot field | Legitimate interest and legal obligation (art. 6(1)(c) and (f)) |
California residents. The categories above correspond to "identifiers", "commercial information" and "internet activity" under the CCPA. We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use it for profiling that produces legal or similarly significant effects.
We do not sell, rent or trade personal data. We use the following service providers, each bound by a data processing agreement or equivalent terms:
We may also disclose data when the law requires it, or to professional advisers bound by confidentiality.
My Villa's team works between Los Angeles and Europe, and several providers above are in the United States. Where data leaves the EEA, the UK or Switzerland we rely on the European Commission's Standard Contractual Clauses, and, for providers certified under it, on the EU-U.S. Data Privacy Framework (including its UK and Swiss extensions). You can ask us for details of the safeguard that applies to a given provider.
You can ask us to delete your data earlier at any time (section 7).
Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, to withdraw consent at any time (without affecting what was done before), and to lodge a complaint with a supervisory authority. California residents additionally have the right to know, to delete, to correct, to opt out of sale or sharing (we do neither) and not to be discriminated against for exercising these rights.
To exercise any right, email info@myvilla.la from the address you used with us, or tell us how we can verify it is you. We answer within one month (GDPR) or 45 days (CCPA), and we never charge for a first request. You may use an authorised agent under the CCPA; we will ask for proof of the authorisation.
The Site uses Google Analytics 4, which sets first-party cookies (_ga, _ga_*) to recognise a browser across visits and to measure use of the Site. We use Google's Consent Mode:
Your choice is stored in your browser's local storage (key myvilla_cookie_consent) and in a session value that remembers where you arrived from during a visit; neither is sent to us unless you submit a form. Google Fonts may set its own technical cookies. You can also block cookies entirely in your browser settings; the Site works without them.
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale or sharing of personal information, which we do not do in any case, and as a decline of analytics cookies for that browser. Browsers' older Do Not Track setting has no agreed meaning; we honour it in the same way as GPC on this Site.
The Site is served over HTTPS. Form submissions travel encrypted to Formspree and to our own request endpoint. Access to the mailbox and the tools that hold requests is limited to the My Villa team, protected by two-factor authentication, and the records live outside the public website. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
The Site is not intended for anyone under 16 and we do not knowingly collect data from children. If you believe a child has sent us data, tell us and we will delete it.
We update this notice when our practices or the law change, and we show the date at the top. Material changes to how we use data already collected will be announced on this page before they take effect.
My Villa
Email: info@myvilla.la
Website: myvilla.la