Privacy Policy

1. DATA CONTROLLER

The Data Controller is the entity that determines the purposes and means of processing personal data.

---

2. TYPES OF DATA COLLECTED

2.1 Data provided voluntarily by the user

Through the contact form on the website, we collect the following personal data provided voluntarily:

• First and Last Name
• Email address
• Requested stay dates (check-in and check-out)
• Number of guests
• Message (optional)

2.2 Automatically collected data

During browsing on the site, the following technical data are automatically collected:

• IP address (in anonymized form)
• Browser type and device used
• Pages visited and time spent
• Geographic origin (country/city)
• Operating system

This data is collected through Google Search Console exclusively for technical analysis and website improvement purposes.

2.3 Cookies

The site uses technical cookies necessary for operation. For more information, see the Cookie Policy.

---

3. PROCESSING PURPOSES AND LEGAL BASIS

3.1 Management of booking and information requests

Data processed: Name, email, stay dates, number of guests, message
Purpose: To respond to availability and booking requests sent through the contact form
Legal basis: User consent (Art. 6, par. 1, lett. a GDPR) and pre-contractual measures (Art. 6, par. 1, lett. b GDPR)
Retention period: 2 years from the date the request was sent

3.2 Tax and accounting compliance

Data processed: Personal and contact data provided during booking
Purpose: Fulfillment of tax, accounting and administrative obligations required by law
Legal basis: Legal obligation (Art. 6, par. 1, lett. c GDPR)
Retention period: 10 years (period required by Italian tax law)

3.3 Technical analysis and website optimization

Data processed: Anonymous browsing data (anonymized IP address, browser type, pages visited)
Purpose: Statistical analysis to improve technical performance and user experience
Legal basis: Legitimate interest of the Controller (Art. 6, par. 1, lett. f GDPR)
Retention period: 26 months (Google Search Console)

---

4. PROCESSING METHODS

Personal data is processed using computer and/or telematic tools, with logic strictly related to the indicated purposes and, in any case, in such a way as to guarantee the security and confidentiality of the data itself.

4.1 Security measures adopted

• HTTPS encryption for all communications between browser and server
• Anti-spam protection via hCaptcha on the contact form
• Limited access to data only for authorized personnel
• Regular backups to prevent data loss
• Firewall and anti-intrusion systems

---

5. DATA RECIPIENTS

Personal data may be communicated to the following entities, acting as external Data Processors:

5.1 Web3Forms (Contact form management service)

Provider: Web3Forms LLC
Purpose: Technical management of contact form submissions
Server location: United States (compliant with Privacy Shield / Standard Contractual Clauses)
Privacy Policy: https://web3forms.com/privacy

When you submit the contact form, your data is transmitted to Web3Forms and subsequently forwarded to our email. Web3Forms does not permanently store data.

5.2 Google Search Console (Technical analysis)

Provider: Google LLC
Purpose: Analysis of technical performance of the site in search results
Data processed: Anonymous browsing data (search queries, clicks, impressions)
Server location: United States/EU (compliant with Privacy Shield / Standard Contractual Clauses)
Privacy Policy: https://policies.google.com/privacy

Google Search Console collects aggregated and anonymous data on the site's performance in search results. Individual identifiable users are not tracked.

5.3 Hosting provider and technical services

Provider: Netsons s.r.l.
Registered office: Via Resistenza, 2B - 20068 Peschiera Borromeo (MI), Italy
Purpose: Website hosting and related technical services
Server location: Italy (EU datacenter)
Privacy Policy: https://www.netsons.com/privacy

5.4 Accountant/Tax consultant

For mandatory tax and accounting compliance, data may be communicated to our accountant/tax consultant, bound by professional secrecy.

---

6. EXTRA-EU DATA TRANSFER

Some service providers used (Web3Forms, Google) may transfer data outside the European Economic Area (EEA). In such cases, the transfer takes place in compliance with the following guarantees:

• Standard Contractual Clauses (SCC) approved by the European Commission
• Privacy Shield certification (for US providers)
• Adequacy decisions of the European Commission

The Controller guarantees that extra-EU transfers take place in full compliance with Art. 44-49 of the GDPR.

---

7. DATA SUBJECT RIGHTS

As a data subject, you have the right to:

7.1 Right of access (Art. 15 GDPR)

Obtain confirmation of the existence or otherwise of personal data concerning you and receive a copy of the same.

7.2 Right to rectification (Art. 16 GDPR)

Obtain the rectification of inaccurate data or the completion of incomplete data.

7.3 Right to erasure (Art. 17 GDPR - "Right to be forgotten")

Obtain the erasure of your personal data, except for legal obligations that require their retention (e.g. tax data).

7.4 Right to restriction (Art. 18 GDPR)

Obtain the restriction of processing of your data in certain circumstances.

7.5 Right to data portability (Art. 20 GDPR)

Receive data in a structured, commonly used and machine-readable format, and transmit it to another controller.

7.6 Right to object (Art. 21 GDPR)

Object to the processing of your data for reasons related to your particular situation.

7.7 Withdrawal of consent (Art. 7 GDPR)

Withdraw consent at any time, without prejudice to the lawfulness of processing based on consent given before the withdrawal.

How to exercise your rights

To exercise your rights, you can send a request to:

We will respond within 30 days of receiving the request.

---

8. COMPLAINT TO THE DATA PROTECTION AUTHORITY

You have the right to lodge a complaint with the competent supervisory authority (Italian Data Protection Authority) if you believe that the processing of your data violates the GDPR.

---

9. CHANGES TO THE PRIVACY POLICY

This Privacy Policy may be modified over time to comply with new regulations or changes to the services offered.

We invite you to periodically consult this page to stay updated. The date of the last update is indicated at the top.

---

10. COOKIE POLICY

The website www.ladimoradipeppe.it uses exclusively technical cookies necessary for the proper functioning of the site. We do not use profiling or tracking cookies for advertising purposes.

10.1 What are cookies

Cookies are small text files that visited sites send to the user's terminal, where they are stored to be retransmitted to the same sites on the next visit.

10.2 Cookies used

Below is a detailed table of all cookies used by the site:

Third-party cookies

The site uses third-party services that may set cookies. Details below:

Important notes:

• Necessary technical cookies do not require prior consent (Art. 122 Italian Privacy Code)
• hCaptcha is loaded only when the user interacts with the contact form
• Google Maps is loaded only if present on the page and may require additional consent
• Google Fonts and Bootstrap CDN are essential technical cookies for site operation

10.3 Cookie management

You can disable cookies directly from your browser by following the instructions:

• Chrome: Cookie management Chrome
• Firefox: Cookie management Firefox
• Safari: Cookie management Safari
• Edge: Cookie management Edge

Note: Disabling technical cookies may compromise proper site navigation.

---

11. CONTACT

For any questions or clarifications regarding this Privacy Policy or the processing of your personal data, you can contact us at:

---

Effective date: December 6, 2024
Version: 1.0