Privacy Policy
This privacy policy describes how the personal data of users who visit the website www.aguabnb.it and of those who contact the property are processed.
1. Data Controller
The Data Controller is:
- Agua Fria di Franceschelli Enrico & C. S.A.S.
- VAT number: 01737820538
- Website: www.aguabnb.it
- Email: aguafriasas@gmail.com
- Phone: +39 336 271 737
- Registered office: Via Garibaldi 15, 58100 Grosseto (GR), Italy
- CIR: 053011BBI0007
- CIN: IT053011B4C9WWG9DZW
2. Types of data collected
The website collects the following categories of data:
- Browsing data: the computer systems and software procedures used to operate this website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (for example IP addresses, browser type, operating system, date and time of the visit). This data is recorded solely in the server log files of the hosting provider (Aruba S.p.A.) for technical and security purposes.
- Data provided voluntarily by the user: when you contact the property by email, phone or WhatsApp, you voluntarily provide your contact details (e.g. name, email address, phone number) and any data contained in your message (e.g. stay dates, availability requests).
- Cookies and similar technologies: see section 5 below.
The website is an informational showcase site: it does not feature an online booking form, nor a database or any system for storing user data. Requests are made exclusively through the direct contact channels indicated above (email, phone, WhatsApp), and the related data is handled by the Controller through those tools, not on the website.
The processing of the data of guests staying at the property (e.g. mandatory registration with the public security authorities) is covered by a specific privacy notice, which is also provided at check-in.
3. Purposes and legal basis of the processing
| Purpose | Legal basis |
|---|---|
| Responding to requests for information and availability and managing contacts with potential guests. | Performance of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR). |
| Ensuring the correct operation and security of the website. | Legitimate interest of the Controller (Art. 6(1)(f) GDPR). |
| Loading third-party content (Google Maps map) subject to the user's consent. | Consent of the data subject (Art. 6(1)(a) GDPR). |
| Complying with legal obligations (e.g. tax, administrative). | Legal obligation (Art. 6(1)(c) GDPR). |
4. Methods of processing
Data is processed using electronic and/or manual tools, according to logic strictly related to the stated purposes and, in any case, in such a way as to guarantee the security and confidentiality of the data, in compliance with Article 32 of the GDPR. Appropriate technical and organisational measures are adopted to prevent unauthorised access, loss or unlawful use of the data.
5. Cookies and third-party services
The website does not install any first-party cookies, whether technical or profiling. Third-party cookies may be installed only with the user's explicit consent, solely when loading the Google Maps map described below. For this reason, the website does not require a cookie banner.
The typographic fonts and graphic libraries (Bootstrap and its icons) are hosted directly on our website: loading them does not involve any requests to third-party servers nor the transfer of the user's IP address.
The website relies on the following third-party services, activated only following an action by the user:
- Google Maps (Google Ireland Ltd. / Google LLC) — used to show the location of the property. The map is not loaded automatically: it is displayed only after an explicit action by the user (clicking on the placeholder), in compliance with the guidelines of the Italian Data Protection Authority (Garante). Only following such consent may third-party cookies be installed by Google and the user's IP address transferred.
- WhatsApp (Meta Platforms Ireland Ltd.) — if the user chooses to contact the property through the dedicated link, they are redirected to the WhatsApp service, which is subject to that provider's privacy policy.
For more information on the processing of data by these parties, please refer to their respective privacy policies.
6. Recipients of the data
Personal data may be processed by persons authorised by the Controller and, where necessary, disclosed to:
- the provider of the website hosting service: Aruba S.p.A. (Via San Clemente 53, 24036 Ponte San Pietro - BG, Italy), acting as a data processor pursuant to Article 28 GDPR;
- the providers of the third-party services indicated in section 5, acting as independent controllers or data processors;
- professionals, consultants and competent authorities, where required by law.
The data is not subject to dissemination.
7. Transfer of data outside the EU
Some of the third-party service providers (in particular Google and Meta) may transfer data to countries located outside the European Economic Area. In such cases, the transfer takes place on the basis of the appropriate safeguards provided for in Articles 44 et seq. of the GDPR, such as the standard contractual clauses adopted by the European Commission or adequacy decisions.
8. Data retention period
Personal data is kept for the time strictly necessary to achieve the purposes for which it was collected:
- contact details provided for information requests are kept for the time necessary to handle the request and, in the event that no booking is made, for a period not exceeding 24 months;
- data processed for legal obligations is kept for the periods provided for by the applicable legislation;
- browsing data is kept for the period strictly necessary for the website's security purposes.
9. Rights of the data subject
As a data subject, you have the right to exercise, within the limits and under the conditions set out in Articles 15-22 of the GDPR:
- the right of access to your personal data;
- the right to rectification of inaccurate or incomplete data;
- the right to erasure of data ("right to be forgotten");
- the right to restriction of processing;
- the right to data portability;
- the right to object to the processing;
- the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.
To exercise your rights, you may write to the Controller at the email address aguafriasas@gmail.com.
10. Complaint to the supervisory authority
If you believe that the processing of your personal data is carried out in breach of the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the Member State in which you habitually reside or work.
11. Changes to this privacy policy
The Controller reserves the right to modify or update this privacy policy at any time, including in order to bring it into line with any regulatory changes. Changes will be published on this page together with the date of the last update.