Privacy Policy

This notice describes how the personal data of users who browse this website and contact the property are processed, pursuant to Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (Privacy Code) as amended by Legislative Decree 101/2018.

1. Data controller

2. Categories of data processed

• Browsing data — the IT systems that operate this website acquire, in the course of their normal functioning, certain data whose transmission is implicit in the use of the Internet (IP address, access logs, technical data about browser and device, technical cookies). This information is required for the operation and security of the site and is not collected in order to identify users.
• Data provided voluntarily by the user — name, contact details and content of messages sent spontaneously by email, phone or WhatsApp to request information or availability.
• Booking data — bookings are handled through the PayTourist engine (a third-party provider, reached via an external link from this site): the data required for the booking and the stay (identity, contact and payment details) are processed in accordance with the provider’s privacy notice, as well as by the Controller for the management of the contractual relationship.

3. Purposes and legal bases of processing

• Responding to enquiries — legal basis: the legitimate interest in replying to the data subject’s requests and, where applicable, the consent expressed by spontaneously sending the enquiry (Art. 6(1)(b) and (f) GDPR).
• Managing bookings and stays — legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).
• Website operation and security — legal basis: the Controller’s legitimate interest (Art. 6(1)(f) GDPR).
• Compliance with legal obligations — for example tax obligations and public-security requirements (guest registration) — legal basis: legal obligation (Art. 6(1)(c) GDPR).

4. Recipients and external processors

Data may be processed, on behalf of the Controller or as independent controllers, by the following providers:

• PayTourist — booking engine and related obligations (tourist tax, guest registration);
• Google (Google Ireland Ltd) — Google Maps service for the interactive map, activated only after consent to third-party cookies;
• Vercel Inc. — website hosting.

Some providers may process data outside the European Union: in such cases the transfer takes place with adequate safeguards pursuant to Articles 44 et seq. GDPR (adequacy decisions or Standard Contractual Clauses approved by the European Commission). Data are not disseminated and are not subject to automated decision-making.

5. Retention period

Data are kept for no longer than is necessary for the purposes for which they were collected: correspondence for the time needed to reply, booking data for the duration of the relationship and the applicable legal obligations (tax and public security), technical logs for the hosting provider’s technical retention times.

6. Rights of the data subject

Under Articles 15-22 GDPR, data subjects have the right to access their data, to have them rectified or erased, to restrict processing, to object to processing and to receive their data in a structured format (data portability), as well as to withdraw any consent given at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, simply write to bebcalaluna@tiscali.it or to the certified address pintoriluigi20@pec.it.

7. Complaints to the supervisory authority

Data subjects who believe that the processing infringes the GDPR have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it), without prejudice to any other administrative or judicial remedy.

8. Updates

This notice may be updated: the version published on this page, with its date, is the one in force. For the use of cookies, please see the Cookie Policy.