Last updated: 20 September 2026

1. Data Controller

2. Data collected and purposes of processing

2.1 Website browsing

For cookies and other tracking tools (technical, functional, analytics, marketing/profiling), please refer in full to the Cookie Policy, which describes the providers, purposes, retention periods and consent management procedures in detail.

2.2 Information requests, contacts and bookings

The website contact form is provided by Cognito Forms, a service operated by Cognito LLC. Data entered in the form (first and last name, email address, telephone number if provided) is transmitted directly to the Cognito Forms platform for processing and forwarding the request to the Data Controller. For information on the processing of data by Cognito Forms, please refer to their Privacy Policy.

2.3 Online bookings via booking widget

The online booking widget is provided by widget.booking-engine.it (Persefone Booking Engine). For information on Persefone's role in relation to the processing of data collected through the widget and how such data is processed, please refer to their Privacy Policy. The widget is loaded on the website only after consent has been given to the "functional" category (see Cookie Policy).

3. Disclosure of data and recipients

The data collected may be disclosed, strictly within the limits necessary for the purposes indicated above, to:

The data is not made publicly available or sold to third parties for their own commercial purposes.

4. Transfers of data to non-EU countries

Some of the providers listed in section 3 have offices or infrastructure outside the European Union: this applies to Google (for services activated with consent, where applicable) and Cognito LLC (Cognito Forms, for the website contact form). Where such providers are certified under the EU-U.S. Data Privacy Framework — the mechanism recognised by the European Commission as providing adequate protection for transfers of data to the United States — the transfer is carried out on that basis; otherwise, or for processing not covered by such certification, the transfer is based on the European Commission's Standard Contractual Clauses (Articles 44 et seq. GDPR). Please refer to the Cognito Forms Privacy Policy for details of the safeguards adopted by this provider.

5. Data retention

Data collected in connection with a booking is retained for the duration of the contractual relationship and subsequently for the period required by tax and accounting obligations (normally 10 years, pursuant to Article 2220 of the Italian Civil Code) and for the ordinary limitation period applicable to rights (Article 2946 of the Italian Civil Code, 10 years). Data collected for simple information requests that do not result in a booking is retained for the time necessary to handle the request, unless a different retention period is required by law. For details of the retention periods relating to cookies and tracking tools, please refer to the Cookie Policy.

6. Provision of data

Providing the data necessary to respond to an information request or manage a booking is optional, but failure to provide such data makes it impossible to process the request. Providing data relating to non-essential cookies (functional, analytics, marketing) is always optional and may be withdrawn at any time, without affecting the ability to access the main content of the website.

7. Processing methods and security

Data is processed using electronic systems and, where necessary, paper-based means, according to procedures strictly related to the purposes indicated and, in any case, in a manner that ensures the logical and physical security of the data, adopting technical and organisational measures appropriate to the risk. The website is published exclusively over HTTPS, with an encrypted connection between the user's browser and the server; data is also protected through periodic backups managed by the hosting provider (Aruba S.p.A.).

8. Data subject rights

At any time, you have the right to ask the Data Controller, where provided for by applicable law, to:

• access your personal data (Art. 15 GDPR);
• rectify inaccurate data or complete incomplete data (Art. 16 GDPR);
• erase your data, where provided for by law (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a portable format, where technically feasible (Art. 20 GDPR);
• object to processing based on legitimate interest (Art. 21 GDPR);
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7.3 GDPR) — for cookies, through the "Cookie preferences" panel accessible from the "Manage cookies" link at the bottom of every page;
• lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) if you believe that the processing of your data violates applicable law.

To exercise these rights, you can write to info@pensionezioattilio.com or use the contact details indicated in section 1. The Data Controller will respond to requests without undue delay and in any event within the time limits established by applicable law.

9. Changes to this privacy notice

This privacy notice may be updated over time, for example following changes in legislation or the introduction of new services/providers. The date of the latest update is indicated at the top of the page. In the event of substantial changes concerning cookies or tracking tools, the cookie banner will be displayed again to obtain new consent, as described in the Cookie Policy.

10. Cookie Policy

For the detailed list of cookies, tracking tools, purposes, providers and preference management procedures, please consult the Cookie Policy, which forms an integral part of this privacy notice.