Privacy & cookies

Who is responsible for your data

The data controller is Agriturismo S.Andrea S.S., VAT no. 02554490546, based in Frazione Colpalombo, 06024 Gubbio (PG), Italy. For questions or requests about your data, email Federico@agriturismosantandrea.com or call +39 366 160 9059. Federico and Marta handle guest enquiries and hospitality.

We receive data directly from you, from the person arranging the group booking, or from the booking platform used, such as Booking.

Why we use your data

• Enquiries and bookings: your name, contact details, dates, group composition and relevant correspondence help us reply, provide a quote and arrange your stay. Our legal basis is taking steps at your request before a contract or performing that contract (GDPR Article 6(1)(b)).
• Legal obligations: information needed to identify guests, report to the authorities and meet tax requirements is processed to comply with the law (Article 6(1)(c)).
• Security and legal rights: technical data and, when needed, records relevant to complaints or disputes are processed for our legitimate interest in protecting the service and our rights (Article 6(1)(f)), with due regard for individuals’ rights.
• Embedded map: the Google Maps connection is enabled only with your consent (Article 6(1)(a)), as explained below.

We do not send promotional messages or offer a newsletter. Providing information for an enquiry is optional, but we need the essential details to reply or arrange your stay. Information required by law is necessary to meet hospitality obligations. Please do not send identity documents or sensitive information with a simple enquiry.

Availability calendar and contact links

The calendar shows available or unavailable dates without guest names or booking details. The dates you select remain within the page and can be included in a WhatsApp enquiry. Opening the link transmits this information to the WhatsApp service; you then choose whether to send the message in the app.

The website does not take payments or automatically confirm bookings. Email, WhatsApp, Gmail, Booking and directions links open external services. Information sent through them is also subject to their privacy notices. The Gmail button is simply an alternative way to email us.

Cookies, maps and browsing data

We have not added advertising cookies, marketing pixels or profiling tools to the website’s code. Photos, logos and fonts are served by this website. Our code does not save calendar selections or map choices in cookies or persistent browser storage.

Technical security cookie: the Cloudflare infrastructure uses __cf_bm on the visited domain to identify harmful automated traffic. It is necessary to protect the service and expires after 30 minutes of continuous inactivity. Processing may also take place in the United States. See the cookie documentation and Cloudflare privacy policy.

Google Maps is disabled initially. The “Allow and load Google Maps” button authorises the external content to load. Google receives your IP address and browser information and may use cookies depending on its settings and your sign-in status. Before choosing, you can read Google’s privacy policy and cookie information.

You can remove the map using “Disable the map” below it in the Location section. Your choice applies to the current page and is not remembered on later visits. Disabling the map does not delete data or cookies already received by Google; you can also manage cookies in your browser settings. Directions links are available without loading the embedded map.

Hosting: this website uses OpenAI Sites. The platform processes technical request data, such as IP address, browser, requested page and service logs, for delivery and security, and provides visit and visitor counts. We use overall counts to understand website usage and improve its content, based on our legitimate interest in evaluating use of the service (Article 6(1)(f)). We do not use them for personalised advertising. Platform processing is separate from the features we added to these pages. For operations where OpenAI acts as an independent controller, its privacy policy describes purposes, legal bases, retention criteria and rights.

Recipients and international processing

Federico and Marta handle data through contact and booking channels and, when necessary, paper notes. Recipients may include hosting, email and messaging providers, the booking platform used, professional advisers engaged for legal obligations or protecting rights, and competent authorities where required by law. Guest data is not published on the website.

Providers act as processors when handling data on our behalf, or as independent controllers for their own purposes. Under the Business service used, OpenAI’s processing on behalf of its customer is governed by its Data Processing Addendum. For customers in the European Economic Area, the agreement identifies OpenAI Ireland Ltd.

Some providers may process data outside the European Economic Area; we do not claim that all data stays in Italy or the EU. OpenAI’s terms provide for applicable transfer mechanisms, including adequacy decisions and standard contractual clauses; Google describes its transfers in its privacy policy. You can contact us for information about safeguards for data processed on our behalf and how to obtain a copy.

How long data is kept

• Enquiries that do not become bookings: reviewed within 12 months of the last meaningful contact, removing information no longer needed unless an enquiry is still open.
• Practical messages and notes: reviewed within 12 months after the stay, removing what is no longer needed. Confirmations, agreements and mandatory records follow the rules for their category.
• Tax, contractual and mandatory records: for the period required by the rules applying to the document and, where necessary, applicable periods for protecting legal rights. Disputes may require relevant material to be kept until resolution and for subsequent applicable periods.
• Identity-document copies collected for Alloggiati Web: the rule is to delete them once the data has been transmitted to the public-security authorities. Reporting receipts are separate and must be kept for five years.
• Hosting technical data: according to the provider’s criteria, for as long as needed for service delivery, security, legal obligations and dispute management, as described in OpenAI’s policy and terms. The 12-month review period for messages does not apply to these logs.

Your rights

Where the GDPR provides, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent without affecting the lawfulness of earlier processing. Legal record-keeping obligations may limit erasure.

Email Federico@agriturismosantandrea.com. We respond within GDPR time limits, normally one month; if a legally permitted extension is needed, we explain why. You can complain to the Italian Garante per la protezione dei dati personali or the competent authority where you live or work. We do not make decisions about your stays using solely automated decision-making.