Skip to content

Privacy Policy

Last updated: 11 October 2026

This notice explains how we process the personal data of people who visit www.buongiornoelisa.it, send us an enquiry or book a stay at Villa Elisa, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003.

1. Data controller

Andrea Renzini
Villa Elisa – Via Mura Vecchie 36/38, 06038 Spello (PG), Italy
Email: info@buongiornoelisa.it – Phone: +39 335 375819

The controller has not appointed a Data Protection Officer (DPO), as this is not mandatory for its activity.

2. What data we process, why and on what legal basis

a) Enquiries

If you contact us through the form on the Contacts page, by email or by phone, we process the data you provide: name, email address, phone number, arrival and departure dates and the content of your message.

Purpose: to answer your enquiry and send you a quote.
Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
Retention: for as long as needed to handle the enquiry and in any case no longer than 24 months after the last contact, unless it leads to a booking.

b) Bookings

To book on the website we ask for your first name, last name, email and, optionally, phone number and address; we also record the details of your stay (dates, accommodation, number of guests, amounts).

Online payments are handled by PayPal: card or account details are entered directly on PayPal’s systems and are never visible to or stored by us. We only receive confirmation of the payment outcome.

Purpose: to manage your booking, your stay and payments.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations, e.g. tax and accounting (Art. 6(1)(c) GDPR).
Retention: for the duration of the relationship and, for tax and accounting records, 10 years (Art. 2220 of the Italian Civil Code).

c) Legal obligations related to your stay

On arrival, Italian law requires us to record the details of an identity document for each guest and to transmit them to the police through the “Alloggiati Web” service (Art. 109 T.U.L.P.S.). We also process the data needed for official tourism statistics.

Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR). Providing this data is mandatory: without it we cannot host you.
Retention: as required by the applicable laws; data transmitted to the police is not kept by us beyond what the law requires.

d) Browsing data

The server hosting the website automatically records some technical data (IP address, date and time, pages visited, browser), which is needed for the website to work and to keep it secure.

Legal basis: the controller’s legitimate interest in the security of the website (Art. 6(1)(f) GDPR).
Retention: for the period set by the hosting provider and strictly necessary for the security of the website, unless needed to investigate offences.

e) Cookies, advertising and third-party content

The website uses technical cookies required for it to work and – only with your consent – third-party tools: Google Tag Manager and Google Ads (measuring the effectiveness of advertising campaigns) and Google Maps (map on the Contacts page).

Legal basis: consent (Art. 6(1)(a) GDPR), which you can give, refuse or withdraw at any time from the banner or from the “Cookie preferences” link at the bottom of every page. Details are in the Cookie Policy.

3. Whether providing data is mandatory

Data marked as required in the forms is needed to answer your enquiry or manage your booking: without it we cannot proceed. All other data is optional.

4. Who we share data with

Data is processed by the controller and by persons authorised by the controller. It may be shared with:

  • providers processing data on our behalf, appointed as processors (Art. 28 GDPR): Aruba S.p.A. (website hosting and email) and those providing technical maintenance of the website;
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., for payments, acting as an independent controller;
  • Google Ireland Ltd, for the services listed in section 2.e, only if you have given consent;
  • tax and accounting advisors, for legal obligations;
  • public authorities (police, municipality, statistical bodies, tax authority) where required by law.

Data is never published or sold.

5. Transfers outside the European Union

Some providers (in particular Google and PayPal) may transfer data to the United States. These transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or, where that does not apply, on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR).

6. Your rights

At any time you can ask the controller, by writing to info@buongiornoelisa.it, for:

  • access to your data and a copy of it (Art. 15);
  • correction of inaccurate data (Art. 16);
  • erasure (Art. 17) or restriction of processing (Art. 18);
  • portability of the data you provided to us (Art. 20);
  • objection to processing based on legitimate interest (Art. 21);
  • withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal.

We reply within one month of your request. If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of your country of residence.

7. Security

We take appropriate technical and organisational measures to protect data against loss, unauthorised access or misuse, including an encrypted (HTTPS) connection to the website and restricted access to the administration area.

8. Changes

This notice may be updated. The current version is always published on this page, together with the date of the last update.

WhatsApp