Privacy notice

Who handles your data

The data controller is Francesca Mainieri, who manages Estate Riomaggiore. This notice covers estateriomaggiore.com and communications relating to stays, under Article 13 of Regulation (EU) 2016/679 (GDPR).

What information we collect

• Stay enquiries: name, email address, telephone number, apartment, arrival and departure dates, numbers of adults and children, pets, parking request and free-text message. The enquiry also includes the form language and the page from which it is submitted, without address query parameters.
• Direct contact: contact details and the content of messages you send by email or share by telephone.
• Confirmed bookings: information needed to manage your stay, communications and contractual, tax and legal obligations. Additional information required for these obligations is collected at the relevant stage.
• Browsing and security: IP address, technical browser information, server requests, session data and anti-spam verification signals.

Required form fields are necessary to process your enquiry. Without them the form cannot be submitted; you can still contact us by email or telephone. Additional notes are optional: please avoid including documents, health information or other sensitive details that are not necessary.

Why we use it and the legal bases

• Replying and arranging a stay: checking availability, communicating prices and conditions, and managing a booking. Legal basis: precontractual steps you request and performance of a contract (art. 6.1.b GDPR).
• Mandatory requirements: meeting obligations that apply to a confirmed stay, including tax and public-safety requirements. Legal basis: legal obligation (art. 6.1.c GDPR).
• Website security: preventing spam, automated submissions and abuse. Legal basis: legitimate interest in protecting the website and communications (art. 6.1.f GDPR).
• Protecting legal rights: retaining necessary documentation in the event of a dispute. Legal basis: legitimate interest in establishing, exercising or defending legal claims (art. 6.1.f GDPR).

Acknowledging this notice in the form is not marketing consent. Submitting an enquiry does not automatically confirm a booking.

Who may receive the information

Enquiries are emailed to the controller and the collaborator supporting enquiries and the website. The following providers may process data for their respective services:

• InMotion Hosting: website hosting, infrastructure and technical services. Provider privacy policy.
• Bluewin / Swisscom and Proton: email services for the mailboxes receiving enquiries. Correspondence sent to the Gmail contact address also uses Google’s email service.
• Cloudflare: Turnstile anti-spam protection for forms.

For confirmed stays, necessary information may also be provided to professionals assisting with administrative requirements and to competent authorities where required by law. Enquiry data is not published on the website.

How anti-spam protection works

Turnstile loads when you open the enquiry form. Cloudflare processes technical signals, including IP and browser information, to distinguish people from bots. The server sends Cloudflare the verification token and IP; it does not send the enquiry fields to this service.

Cloudflare states that it acts as a processor for website protection and as a controller for improving Turnstile. See its specific privacy notice. This check is not an automated decision about your booking; you can also contact us by email or telephone.

Providers and international transfers

Hosting, email and anti-spam services may involve processing outside the European Economic Area, including Switzerland and the United States. Using an international provider does not mean that all data is stored in a single country.

Switzerland is covered by a European Commission adequacy decision. For other transfers, providers describe safeguards in their agreements: see the InMotion Hosting Data Processing Addendum and Cloudflare’s transfer information, which include standard contractual clauses where applicable. You can ask the controller for information about safeguards relating to the processing of your data.

How long we keep it

• Enquiries that do not result in a booking: emails and enquiry data for a maximum of 24 months after the last contact, except for documentation needed to meet a legal obligation or address a dispute.
• Confirmed stays: for the time needed to manage the contract and, for documents subject to tax or administrative retention obligations, for the periods required by applicable law. These obligations do not justify retaining every item of stay data indiscriminately.
• Technical data and security logs: for the time necessary to operate the services, diagnose problems and handle possible abuse, according to the settings of the services used. Website cookie durations are listed in the cookie notice.

The 24-month period concerns Estate Riomaggiore’s handling of enquiries; provider notices describe their own processing and retention periods.

Your rights and how to exercise them

Where Articles 15–22 GDPR apply, you can request access and a copy of your data, rectification, erasure, restriction and portability; you can object to processing based on legitimate interests. These rights may have limits, for example where a legal obligation requires retention.

Write to the privacy contact shown on this page and describe your request. Where necessary to prevent unauthorised access, we may request information to verify your identity. The usual response period is one month, extendable by a further two months in the cases allowed by the GDPR, with notification of the extension and its reasons.

You can lodge a complaint with the Italian Garante per la protezione dei dati personali or the competent authority in your country. The website does not use enquiry data for automated decisions producing legal or similarly significant effects.

Cookies, external links and updates

The website uses technical cookies and does not integrate Google Analytics, AdSense, advertising pixels or profiling tools. Photos, fonts and video are served by the website; the map is an external link. If you open Google Maps, Instagram or a booking platform, that service’s privacy information applies.

This notice is updated when website functionality or data processing changes. The date at the top identifies the text version.

Cookieless Matomo statistics

We measure page views using Matomo at analytics.pietropetrocchi.it, website ID 3. This configuration uses no analytics cookies, User ID, cross-site linking, session recordings or form data. Browser feature detection is disabled. Page addresses are sent without query parameters or fragments; only the origin of a referring website is sent.

The analytics service technically receives the IP address and masks it before recording it in Matomo; recognition identifiers are randomized for each request. Statistics are used to evaluate website content, without advertising profiling or persistent visitor recognition. The script is not loaded when a browser signals Do Not Track or Global Privacy Control, or on enquiry and confirmation pages.

Statistics do not include names, email addresses, telephone numbers, stay dates or messages entered in the form. For information about the management and retention of statistics or to exercise your rights, contact Francesca using the details in this notice.