Privacy Policy

1. Data Controller

2. Types of Data Collected

This website collects the following categories of personal data, either provided directly by the User or collected automatically during browsing:

Data provided voluntarily by the User

• First and last name
• Email address
• Telephone number
• City, postal code and province of residence
• Content of messages sent through the contact form
• Data communicated via WhatsApp Business (first name, last name, telephone number, chat content, profile picture)

Data collected automatically

• Usage data (pages visited, session duration, actions performed)
• IP address
• Browser type and operating system
• Device used
• Approximate location data (based on IP)
• Session and browsing statistics
• Cookies and tracking tools (see the Cookie Policy)

3. Methods and Place of Processing

Personal data is processed using automated tools for the time strictly necessary to achieve the purposes for which it was collected. Processing takes place at the Data Controller's premises and, for services provided by third parties, at the premises of the respective providers.

Data may also be processed outside the European Economic Area (EEA), in particular in the United States, by providers that are certified or that adopt standard contractual clauses approved by the European Commission.

4. Purposes of Processing

The data collected is processed for the following purposes:

5. Third-Party Services

The website makes use of the following services provided by third parties, each with its own privacy policy:

6. Legal Basis for Processing

The processing of personal data is based on the following legal grounds pursuant to the GDPR (EU Reg. 2016/679):

• Consent of the data subject (Art. 6(1)(a)) for sending communications and for the use of analytical and profiling cookies.
• Performance of a contract (Art. 6(1)(b)) for managing booking requests and the services requested.
• Legal obligation (Art. 6(1)(c)) to comply with the tax and administrative obligations required by law.
• Legitimate interest (Art. 6(1)(f)) for website security, fraud protection and service improvement.

7. Data Retention Period

Personal data is retained for the time strictly necessary to achieve the purposes for which it was collected, and in any case:

• Contact form data: up to 24 months from receipt, unless it is necessary to follow up on contractual relationships.
• Analytical data (Google Analytics): 26 months (GA4 default setting), configurable by the Data Controller.
• Technical cookies: for the duration of the session or as indicated in the Cookie Policy.
• Data for tax/accounting obligations: 10 years under Italian law.

Upon expiry of the retention periods, the data is deleted or irreversibly anonymised.

8. Rights of the User

Pursuant to Articles 15–22 of the GDPR, the User has the right to:

• Access obtain confirmation of processing and a copy of their personal data.
• Rectification request the correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten") request the deletion of data in the cases provided for by law.
• Restriction of processing obtain the suspension of processing in certain cases.
• Portability receive their data in a structured, machine-readable format.
• Objection object to processing based on legitimate interest or for direct marketing purposes.
• Withdrawal of consent at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise these rights, the User may contact the Data Controller at info@bblapiazzettaischia.it. The Data Controller will respond within 30 days of receiving the request.

9. International Data Transfers

Some of the providers listed in point 5 (in particular Google LLC, Cloudflare Inc., Meta Platforms Inc.) are based in the United States. The transfer of data to these countries takes place in compliance with the safeguards provided for by the GDPR, in particular:

• Standard Contractual Clauses (SCC) approved by the European Commission;
• Certification under the EU-US Data Privacy Framework, where applicable.

10. Contacts and Updates

For any questions regarding this Privacy Policy or to exercise your rights:

The Data Controller reserves the right to amend this policy at any time, giving notice to Users through the website. Users are therefore invited to consult this page periodically.

See also: Cookie Policy