Privacy notice
Important: this notice is a template aligned with the delivered static site. Before publication, insert the real controller, hosting and booking-system details and the actual retention periods.
1. Controller
DA COMPLETARE PRIMA DELLA PUBBLICAZIONE: full legal name, registered office, tax/VAT number, company register, telephone and e-mail. Privacy contact and DPO, if appointed: DA COMPLETARE PRIMA DELLA PUBBLICAZIONE.
2. Data processed
- technical browsing and security logs;
- data sent through forms, e-mail or telephone, including name, contact details, stay dates, guests and requests;
- booking and payment data only when external services are connected and disclosed here.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Enquiries and quotations | Pre-contractual steps requested by the user, GDPR Art. 6(1)(b). |
| Booking and stay management | Contract performance, Art. 6(1)(b). |
| Tax, accounting and public-security duties | Legal obligation, Art. 6(1)(c). |
| Website security and legal claims | Legitimate interests, Art. 6(1)(f). |
| Marketing | Separate consent only, Art. 6(1)(a). The delivered site includes no newsletter or profiling. |
4. Requirement to provide data
Required data are necessary to answer or process a request.
5. Security and retention
Appropriate measures must be applied. Actual periods must be verified with the controller and hosting provider. Enquiries should be kept only as necessary; contracts and tax records for statutory periods; technical logs for a limited security period.
6. Recipients
Authorised staff and processors such as hosting, maintenance, e-mail, PMS, booking and payment providers. Actual list: DA COMPLETARE PRIMA DELLA PUBBLICAZIONE.
7. International transfers
The delivered site loads no third-party fonts, analytics or maps. Any future non-EEA provider requires an updated notice and valid transfer mechanism.
8. Rights
Users may request access, correction, erasure, restriction, portability, objection and withdrawal of consent where applicable, and may complain to the competent supervisory authority.
9. Children
Booking requests must be made by adults. Children’s data are processed only when needed for the stay and supplied by a responsible adult.
10. Updates
Update this notice whenever forms, suppliers, cookies, booking systems or purposes change.