1. Data Controller

Pursuant to Regulation (EU) 2016/679 (“GDPR”), the Data Controller is:

Enrico COLUZZI
Strada per Rancolfo 7 – 06134 Perugia (PG), Italy
Email: info@tenutalabicocca.com
Phone: +39 347 1330685

2. Types of data processed

The Controller processes the following categories of personal data:

a) Data provided by the user

• Name and surname
• Email address
• Phone number
• Message content

b) Booking-related data (if applicable)

• Personal identification data
• Stay information
• Billing data

c) Browsing data

• IP address
• System logs
• Device and browser info
• Cookie data

3. Purpose and legal basis

Purpose	Legal basis
Respond to inquiries	Art. 6(1)(b) GDPR
Manage bookings	Art. 6(1)(b) GDPR
Legal compliance	Art. 6(1)(c) GDPR
Website security	Art. 6(1)(f) GDPR
Analytics	Art. 6(1)(f) GDPR
Marketing (if applicable)	Art. 6(1)(a) GDPR

4. Processing methods

Data are processed using electronic tools with appropriate technical and organizational measures ensuring:

• security
• integrity
• confidentiality

 

5. Nature of data provision

Providing data is:

• mandatory for requests and bookings
• optional for marketing

Failure to provide data may prevent service delivery.

6. Data retention

Data are retained:

• inquiries: up to 12 months
• bookings: up to 10 years (legal obligations)
• marketing: up to 24 months
• technical data: as required

7. Data recipients

Data may be shared with:

• hosting providers
• IT service providers
• administrative/tax consultants
• booking platforms
• authorities

All recipients are bound by confidentiality obligations.

8. Data transfer outside EU

Transfers outside the EU comply with GDPR Articles 44–49 using:

• adequacy decisions
• Standard Contractual Clauses (SCC)

9. Data subject rights

Users may exercise rights under Articles 15–22 GDPR:

• access
• rectification
• erasure
• restriction
• objection
• data portability

Complaints can be filed with the Data Protection Authority.

info@tenutalabicocca.com

10. Cookies

The website uses:

• technical cookies
• analytics cookies
• third-party cookies (if any)

See Cookie Policy for details.

 

11. Security measures

The Controller adopts appropriate measures under Art. 32 GDPR, including:

• access control systems
• periodic backups
• protection against unauthorized access

12. Updates

This Privacy Policy may be updated at any time.