Privacy Policy

Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) – Last updated: 22/09/2026

1) Data Controller

2) Rights of the data subject

The user may exercise at any time the rights set out in Articles 15-22 of the GDPR: access to their data, rectification, erasure, restriction of processing, objection to processing based on legitimate interest, portability (where applicable), and withdrawal of consent, without affecting the lawfulness of processing carried out before the withdrawal.

Requests may be sent to podererondinaio@gmail.com, indicating “Exercise of Privacy Rights” in the subject line. The Data Controller will respond within one month of receiving the request.

It is always possible to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

3) Purpose of this notice

This notice describes how personal data collected through the website podererondinaio.it is processed during browsing and through the “Contact” form. Information about cookies is set out in the Cookie Policy.

4) Categories of data processed

• Data provided voluntarily through the “Contact” form or by email: name, email address, phone number and content of the message.
• Technical browsing data necessary for the operation and security of the website: IP address, browser type (user-agent), date and time of the request, page requested, referring page, and outcome of the request, recorded in the server's technical logs.
• Statistical data collected through Google Analytics 4, only with prior consent: pages visited, duration of the visit, approximate city-level location, and device information (type, brand and model, operating system, browser, screen resolution).
• Data transmitted to Google via Google Maps, only with prior consent: IP address, browser type, page visited and interactions with the map.
• Booking data: first name, last name, email, phone number, stay dates, number of guests and payment details, if the user chooses to check availability or complete a booking through the Krossbooking widget on the site.
• Data transmitted via WhatsApp: the user's phone number and the content of exchanged messages, if the user chooses to contact the Data Controller through the buttons that open a WhatsApp conversation on the site.

5) Purposes and legal bases

• Responding to user requests sent through the “Contact” form or by email.
  Legal basis: performance of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).
• Operation, maintenance and security of the website.
  Legal basis: the Data Controller's legitimate interest in ensuring the website's operation and security (Art. 6(1)(f) GDPR).
• Usage statistics (Google Analytics 4), in aggregate form.
  Legal basis: user consent (Art. 6(1)(a) GDPR).
• Display of the interactive map (Google Maps) on the Reserve page, to show the property's location.
  Legal basis: user consent (Art. 6(1)(a) GDPR).
• Handling availability requests and bookings: the site integrates the Krossbooking booking engine, which allows users to check room availability and complete a booking.
  Legal basis: performance of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).
• Managing contacts via WhatsApp: the site includes buttons that open a WhatsApp conversation with the Data Controller.
  Legal basis: performance of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).

6) Nature of data provision

Providing browsing data is necessary for the technical operation of the site. Providing data through the contact form is optional, but without it the Data Controller cannot respond to the request. Consent to statistical tools and to the map is optional and may be withdrawn at any time: refusal does not prevent browsing the site.

7) Contact form

The “Contact” form is configured without internal storage: submitted data is deleted from the site upon submission and is not saved in the database, but forwarded by email to the Data Controller.

8) Cookies

The site uses the iubenda platform to manage consent, with preventive blocking of Google Analytics 4 and Google Maps until consent is given. All information on cookies and how to change or withdraw consent is provided in the Cookie Policy.

9) Krossbooking booking engine

The site integrates the Krossbooking booking engine (Krossbooking S.r.l.). If the user checks availability or makes a booking, the data entered is processed by Krossbooking in accordance with its own privacy notice. The widget does not install its own cookies: it has been technically verified that it does not set cookies or make tracking calls until the user takes an explicit action.

10) Contact via WhatsApp

The site includes buttons that open a WhatsApp conversation with the Data Controller. In this case, the processing of data (phone number and content of messages) takes place directly on WhatsApp, in accordance with the privacy notice of WhatsApp Ireland Limited, and not through the website.

11) Data recipients

Data is disclosed exclusively to the following parties, acting as data processors (Art. 28 GDPR) or as independent data controllers:

• SiteGround Spain S.L. — website hosting;
• Google Ireland Limited — Google Analytics 4, usage statistics, with prior consent;
• Google Ireland Limited / Google LLC — Google Maps, map display, with prior consent; for data collected through the map, Google acts as an independent data controller;
• Krossbooking S.r.l. — handling availability requests and bookings;
• WhatsApp Ireland Limited — handling contacts initiated by the user via the WhatsApp buttons;
• iubenda S.r.l. — management and recording of cookie consent;
• the Data Controller's email service provider — receiving requests sent through the form or by email;
• competent authorities, in the cases provided for by law.

Data is not disclosed or transferred to third parties for commercial or marketing purposes.

12) Hosting

13) Transfers outside the EU

The use of the above services (Google Analytics 4 and Google Maps) involves the transfer of data to the United States. Such transfers take place in compliance with Articles 44 et seq. of the GDPR, on the basis of Google LLC's adherence to the EU-US Data Privacy Framework and the Standard Contractual Clauses adopted by the European Commission.

14) Automated decision-making and profiling

The site does not use automated decision-making processes or profiling activities on the part of the Data Controller. Google Analytics 4 is used for aggregate visit tracking only, with preventive blocking until the user gives consent.

15) Data retention

• Requests sent through the contact form or by email: deleted from the site upon submission; emails received are retained for the time necessary to handle the request and in any case not longer than 24 months. If the request leads to an engagement, the necessary data is retained for the duration of the relationship and subsequently for 10 years, as required by Italian tax and accounting obligations (Art. 2220 of the Italian Civil Code).
• Google Analytics 4 statistical data: retained according to the retention settings configured on the property; Google Analytics cookies have a maximum duration of 2 years.
• Technical logs: retained by the hosting provider for security purposes only, in accordance with its own policy.

16) Changes to this notice

This notice may be updated following regulatory, technical or organizational changes. The updated version is published on this page with an indication of the last update date.