Privacy notice

Controller

The controller is Francesca Mainieri, tax code MNRFNC57S62H501Z, Via De Gasperi 106, 19017 Riomaggiore (SP), Italy. Contact: phone +41 79 409 8165, email fmainieri1957@gmail.com. Use the same details to exercise your rights.

What we process

We process the data you send us, plus the minimum technical data needed to run the site.

• Booking request: name, email, phone, dates, number of adults and children, pets, apartment, optional note.
• Contact form: first name, last name, phone, email, message.
• If a booking is confirmed and stored in the back office: the same data, amount, estimated arrival time, extra services, booking code.
• Technical data: session and CSRF cookies, session IP and user-agent, and an anti-spam token if enabled.

Purposes and legal bases

We do not run marketing, profiling or list-selling.

• Answering booking and contact requests — GDPR art. 6.1.b (pre-contractual steps).
• Concluding and managing the stay once we confirm a booking — GDPR art. 6.1.b (contract).
• Legal duties if the stay takes place (for example guest-registration and tax rules) — GDPR art. 6.1.c.
• Site security and spam prevention (session, CSRF, Cloudflare Turnstile if enabled) — GDPR art. 6.1.f.
• Defence if a dispute arises — GDPR art. 6.1.f.

Recipients

Request data goes to the mailboxes used to handle it. The public site does not use advertising platforms or third-party analytics.

• Francesca Mainieri, via the work mailbox fmainieri@bluewin.ch (Swisscom, Switzerland).
• The technical collaborator who maintains the site, via pietropetrocchi@protonmail.com (Proton AG, Switzerland), as a processor for support and request handling.
• The website hosting provider, for delivery of the site and technical logs.
• Cloudflare, Inc., only if Turnstile is enabled, for form anti-spam (token and IP address).

Transfers outside the EEA

Bluewin and Proton are based in Switzerland, which has an EU adequacy decision. Cloudflare is based in the United States: if Turnstile is enabled, the transfer uses Cloudflare’s standard contractual clauses and safeguards. We do not transfer data for marketing.

Retention

• Contact and booking requests by email: as long as needed to reply and, if no contract follows, no longer than 24 months.
• Confirmed bookings in the database: for the stay and then for statutory periods (in Italy, usually up to 10 years for tax records). Soft-deleted back-office records are kept only as long as needed to avoid operational mistakes, then erased.
• Website sessions: 120 minutes of inactivity.
• Server logs: according to the host’s policy, usually a few weeks.

Your rights

You can ask the controller, without unnecessary formality, to:

• access your data and get a copy (art. 15);
• rectify inaccurate data (art. 16);
• erase it, where the law allows (art. 17);
• restrict processing (art. 18);
• receive it in a structured format, where applicable (art. 20);
• object to processing based on legitimate interest (art. 21).

Write to fmainieri1957@gmail.com with your name, the email used in the request, and what you are asking. We reply within one month, extendable by two months for complex requests.

Complaint

If you believe the processing is unlawful, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), Piazza Venezia 11, 00187 Rome.

Is the data required?

Required form fields are needed so we can get back to you. If you omit them, we cannot handle the request. Optional fields (notes, arrival time, extra services) can be left blank.

Automated decisions

There is no automated decision-making with legal effects on you. Turnstile, if enabled, is only an anti-spam check on the form.

Special category data (art. 9)

We do not ask for health data. Do not write allergies, medical conditions or other health information in the notes: if you need to mention them for the stay, do so later by phone or on site. Any such data received by mistake is used only to handle the request and then deleted, unless the law requires otherwise.

Cookies

The site uses technical cookies only. Details are in the cookie policy. No consent banner is required for those cookies.

Changes

If we change tools or purposes, we update this page and the date at the top.