Privacy Policy
Information notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended. It describes how we process data collected through the pre-sale website and the booking process.
Data controller
The data controller is Villa Serra Sibillini Retreat (contact: info@villaserrasibillini.it, Tel. +39 339 6661857). Personal data are processed in accordance with Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.
Data processed and purposes
Identity and contact data (first name, last name, email, mobile), booking data (dates, amount) and payment data handled by Stripe (customer and tokenised payment method identifiers; the full card number is not stored on our servers). Purposes: booking and payment management, confirmation emails, legal/tax obligations, and any damage deposit charge within 7 days of check-out.
Legal basis
Performance of the stay contract and related pre-contractual measures (Art. 6.1.b GDPR); legal obligations (Art. 6.1.c); legitimate interest in protecting the property against ascertained damage (Art. 6.1.f), respecting the data subject's rights. The consent given at booking documents informed acceptance of the deposit clause.
Deposit and payment method
The payment method is stored securely by Stripe so that, only if damage to the property or furnishings is ascertained, a charge of up to €500 can be made within 7 days of check-out. After that window, the method is no longer used for this purpose. No automatic charges are made without damage.
Browsing data, analytics and marketing
With your explicit consent via the cookie banner, we may process browsing data and technical identifiers (cookies, advertising IDs, interaction events) through Google Tag Manager, Google Analytics 4 and, where enabled, Google Ads. Purposes: measure site and campaign performance, understand page usage and optimise the pre-sale. Legal basis: consent (Art. 6.1.a GDPR), withdrawable at any time via «Manage cookies» in the footer or browser settings. Before consent, no analytics/marketing tracking script is loaded (preventive blocking and Consent Mode). Details on types and management: see the Cookie Policy.
Recipients and transfers
Data may be shared with: Stripe (payments); Google Ireland Limited / Google LLC (Tag Manager, Analytics and, if active, Ads) as measurement and advertising service providers; the hosting provider; and, where needed, tax/legal advisors. Some providers may process data outside the EEA with appropriate safeguards (e.g. standard contractual clauses).
Retention
Booking data are retained as needed to manage the stay and meet legal (tax/accounting) obligations. Payment method references for the deposit are retained until the charge window ends (7 days after check-out) and no longer than needed for any disputes. Analytics/marketing data remain subject to the providers' policies and the cookie durations in the Cookie Policy; consent can be withdrawn at any time.
Data subject rights
You may exercise rights of access, rectification, erasure, restriction, portability and objection, and withdraw tracking consent, by writing to info@villaserrasibillini.it. You may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it). For cookie preferences use «Manage cookies» in the site footer.