DATA CONTROLLER
The Data Controller of personal data is Stefania Merzagora (Ama’Ca Dulza), with registered address at Via delle Frazioni 22A, 22010 Laglio (CO), Italy. Phone: +39 375 635 8968. Certified email (PEC): [email protected]
TYPES OF DATA PROCESSED
The Data Controller processes personal data provided by Guests and website users, including, by way of example: first name, last name, email address, phone number, identity document details (and related personal data), residential address, stay details (dates, number of guests, special requests), data related to the tourist tax, and data necessary for payment management.
Payment data are processed through external providers (e.g. Stripe) in accordance with their respective terms and privacy policies.
PURPOSES OF PROCESSING
Personal data are processed exclusively for purposes related to the stay and booking management, and in particular for:
- management of the booking and communications with the Guest;
- execution of the tourist rental agreement;
- compliance with legal obligations related to hospitality (registration with Alloggiati Web and ISTAT);
- management of payments and tourist tax;
- assistance to the Guest during the stay;
- handling of any requests, complaints, disputes or legal claims.
In the absence of specific consent, data are not used for marketing or newsletter purposes.
LEGAL BASIS FOR PROCESSING
Processing is based on:
- performance of pre-contractual measures and of the contract (booking and stay);
- compliance with legal obligations to which the Data Controller is subject (e.g. communications to Police authorities, ISTAT, fiscal obligations);
- legitimate interest of the Data Controller in managing and protecting the relationship (e.g. security, handling complaints/disputes), within the limits allowed by law.
METHODS OF PROCESSING AND TOOLS USED
Processing is carried out using IT and organizational tools suitable to ensure security and confidentiality.
Kross Booking (including Guest Portal) is used for booking management and online check-in.
OneDrive is used for data storage and operational management.
NAVIGATION DATA, COOKIES AND ANALYTICS TOOLS
The website and the booking system (booking engine) are based on third-party platforms (e.g. Squarespace and Kross Booking). During navigation and use of the booking system, technical data may be collected (e.g. IP address, device identifiers, browser information) and cookies or similar technologies may be used to:
- ensure the proper functioning of the website and booking system;
- analyse performance and usage in an aggregated form;
- improve content, services and user experience.
Where required by applicable law, non-technical cookies and analytics/marketing tools are activated only with the user’s prior consent via dedicated banners or settings.
The use of non-technical cookies is based on user consent, where required. For more details, please refer to the Cookie Policy of the website.
DISCLOSURE OF DATA TO THIRD PARTIES
Data may be disclosed to third parties acting as data processors or independent controllers, including:
- competent public authorities (e.g. Police, ISTAT, Municipality) for legal obligations;
- technical providers necessary for service delivery (Kross Booking, Squarespace, OneDrive, Stripe and related providers) for purposes related to the booking and stay;
- professionals/consultants and appointed parties, strictly within the limits necessary (e.g. administrative management or legal protection in case of disputes).
DATA TRANSFERS OUTSIDE THE EU
Some providers used (e.g. cloud services, web platforms and payment systems) may involve the transfer or storage of data outside the European Economic Area. In such cases, transfers are carried out in compliance with the GDPR, on the basis of appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, adequacy decisions, or other equivalent legal mechanisms provided by applicable law.
DATA RETENTION PERIOD
Data relating to bookings, stays, contracts and related obligations are retained for the time necessary to fulfill the above purposes and, in any case, for a maximum of 10 years from the end of the stay, in compliance with fiscal/accounting obligations and standard legal limitation periods.
Data collected for Alloggiati Web and ISTAT are retained for the periods required by applicable law.
At the end of the retention periods, data will be deleted or anonymized.
VIDEO SURVEILLANCE
For security reasons, motion-activated cameras are installed in outdoor areas (garden and patio/terrace). Indoor areas are not monitored. Image processing is carried out in compliance with Regulation (EU) 2016/679 and is based on the legitimate interest of the Data Controller in ensuring property security.
DATA SUBJECT RIGHTS
The data subject may exercise the rights provided by Articles 15 et seq. of the GDPR, including: access to personal data, rectification, erasure (within legal limits), restriction of processing, objection (where applicable), data portability, as well as the right to withdraw consent at any time (where processing is based on consent).
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).
Requests may be sent to the Data Controller using the contact details indicated in section 1.
UPDATES
This privacy notice may be updated. The version published on the website shall be considered the current version.