Privacy Policy

This policy, provided pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, describes how personal data of those who visit the website lagualdavecchia.it, contact us, or stay at our facility are processed.

1. Data Controller

• Controller: Podere La Gualda Vecchia di Bruna Carvalho
• Address: Via Castagnetana, 55 – 56040 Monteverdi Marittimo (PI)
• VAT Number: 14441531002
• Email: info@lagualdavecchia.it
• Phone: +39 349 596 5855

The Data Controller has not appointed a Data Protection Officer (DPO) as it is not required to do so.

2. What data we process

• Navigation data: the IT systems that operate the site acquire, during normal use, some technical data (IP address, browser type and operating system, date and time of the request, visited page). These are used solely to ensure the functioning and security of the site and are stored in the server logs for the strictly necessary period.
• Data provided through contact forms: name, email, phone number, and the content of the message you send us to request information or availability.
• Data for booking and stay: personal and contact details, dates of stay, number of guests, payment details (handled by payment gateways, not stored on the site), and any special requests. Upon arrival, the identification document details of guests, which the law obliges us to collect.
• Data provided for events and experiences: if you contact us for weddings, retreats, massages, or other experiences, the data necessary to organize them.

We do not request or process special categories of data (e.g., health data). If you choose to voluntarily provide them (e.g., allergies or accessibility needs), we will only use them to fulfill your request.

3. Why we process data and on what legal basis

• Responding to requests for information and quotes – legal basis: pre-contractual measures requested by the data subject (Art. 6.1.b GDPR).
• Managing bookings, stays, and experiences – legal basis: performance of a contract (Art. 6.1.b GDPR).
• Complying with legal obligations: communication of guest details to the Public Security Authority (Art. 109 TULPS, Alloggiati Web portal), statistical communications on tourist flows, tourist tax where applicable, tax and accounting obligations – legal basis: legal obligation (Art. 6.1.c GDPR).
• Ensuring site security and preventing abuse (e.g., automatic spam submissions) – legal basis: legitimate interest of the Data Controller (Art. 6.1.f GDPR).

The site does not use your data for profiling activities and does not send newsletters or promotional communications without your explicit consent.

4. Provision of data

Providing the data requested in the contact forms and for booking is optional, but without them, we cannot respond to your request or confirm your stay. Providing the data required by law for guests is mandatory.

5. How we process data and for how long

Data are processed using IT and paper tools, with security measures adequate to prevent loss, unlawful use, or unauthorized access. We store them:

• contact requests not followed by a booking: up to 24 months from the last interaction, then they are deleted;
• booking data and accounting documents: for 10 years, as required by civil and tax law;
• identification document data: only for the time necessary for communication to the Public Security Authority; we do not retain copies beyond what is required by law;
• technical server logs: for the limited period set by the hosting provider, unless necessary to investigate cybercrimes.

6. To whom we communicate data

Data are not disseminated or sold. They may be processed, only for the indicated purposes, by:

• suppliers who help us manage the site and the business, appointed as Data Processors: site and email hosting (Hostinger), online booking system (Beddy), consultants for the technical management of the site;
• booking platforms (e.g., Booking.com or Airbnb), if you book through them: in that case, their respective policies also apply;
• accountants, banks, and payment gateways, for accounting and payment processing;
• public authorities, when required by law (Police Headquarters via Alloggiati Web, bodies for tourist statistics, Municipality for tourist tax, Revenue Agency).

7. Third-party services integrated into the site

Some pages display content provided by third parties, who may receive your IP address and browser technical data when the page is loaded:

• Google Maps (Google Ireland Ltd.) – interactive map to indicate the facility's location. Google Privacy Policy.
• Trustindex – widget displaying Google reviews for the facility. Trustindex Privacy Policy.
• Beddy – module to check availability and book online.
• WhatsApp, Instagram, YouTube – links only: no data is transmitted to these services until you click on the link.

For details on cookies used by these services, consult the Cookie Policy.

8. Transfer of data outside the European Union

Some providers (e.g., Google) may process data outside the European Economic Area. In such cases, the transfer is based on an adequacy decision by the European Commission (EU-US Data Privacy Framework) or Standard Contractual Clauses approved by the Commission.

9. Your rights

At any time, you can ask the Data Controller, by writing to info@lagualdavecchia.it:

• access to your data and a copy thereof (Art. 15);
• rectification of inaccurate or incomplete data (Art. 16);
• erasure of data, unless their retention is required by law (Art. 17);
• restriction of processing (Art. 18);
• portability of the data you have provided to us (Art. 20);
• to object to processing based on legitimate interest (Art. 21);
• to withdraw consent previously given, without prejudice to the lawfulness of the processing prior to withdrawal.

We will respond within 30 days. If you believe that the processing of your data violates the GDPR, you can lodge a complaint with the Italian Data Protection Authority.

10. Minors

The site is not intended for children under 14 years of age, and we do not knowingly collect their data through online forms. Data of minors staying with their family are provided by parents and processed only for legal obligations.

11. Automated decision-making

We do not make decisions based solely on automated processing, including profiling.

12. Changes to this policy

We may update this policy to adapt it to regulatory changes or new site services. The current version is always the one published on this page.

---

Last updated: October 19, 2026