Privacy policy
1. Data controller
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR"), the controller of personal data is:
- Business name: Il Giardino dei Pini (Bed & Breakfast)
- Address: Via Filette, 11, 84047 Capaccio Paestum (SA), Italy
- Email: info@ilgiardinodeipini.it
2. Data processed
2.1 Browsing data
In the course of their normal operation, the computer systems running this website acquire certain data whose transmission is implicit in the use of internet communication protocols, such as IP address, browser type, operating system, pages visited, time of access and referring page. This data is used solely to ensure the security and proper technical functioning of the website.
2.2 Data provided by the user
- Contact form and email: first name, last name, email address, telephone number (optional) and the content of the message.
- WhatsApp: if you choose to contact us through the WhatsApp buttons on the website, including to send a booking request with dates and number of guests pre-filled, we process your telephone number, profile name and the content of your messages.
- Booking: personal and contact details, dates of stay, number of guests, any special requests and the data needed for payment, collected through the Amenitiz booking platform.
- Check-in: the identity document details of guests required by law for reporting to the police (Questura) and the data needed to apply the tourist tax.
2.3 Cookies and Google Maps
The website uses only technical cookies. The Google Maps map on the Contact page is loaded only after the user clicks. For details, please refer to the Cookie policy.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|
| Replying to requests for information, quotes and booking requests (contact form, email, WhatsApp) | Pre-contractual steps taken at the request of the data subject (para. 1(b)) | For as long as needed to reply; messages are then deleted within 24 months, unless the request leads to a booking |
| Managing the booking and the stay, including service communications (confirmations, pre-arrival information) | Performance of the contract and pre-contractual steps (para. 1(b)) | For the duration of the contractual relationship; accounting records for 10 years |
| Reporting guest details to the police through the Alloggiati Web portal (Art. 109 TULPS) | Legal obligation (para. 1(c)) | For the period required by public security legislation |
| Applying and paying the tourist tax to the Comune of Capaccio Paestum, and mandatory statistical reporting on tourist arrivals | Legal obligation (para. 1(c)) | For the period required by tax and statistical legislation |
| Invoicing and tax and accounting obligations | Legal obligation (para. 1(c)) | 10 years (Art. 2220 of the Italian Civil Code) |
| Security and proper technical functioning of the website (browsing data) | Legitimate interest of the controller (para. 1(f)) | No longer than 6 months, unless needed to investigate unlawful activity |
The controller does not send newsletters or promotional communications and does not carry out profiling.
4. Whether providing data is mandatory
Providing the data required for the booking and for legal obligations, in particular identity document details at check-in, is mandatory: without it, the booking cannot be concluded and the stay cannot take place. Providing data through the contact form, email or WhatsApp is optional, but necessary to receive a reply.
5. Recipients and processors
Data may be processed on behalf of the controller, within the limits of their respective functions, by the following parties, acting as processors under Art. 28 GDPR where applicable:
- Amazon Web Services (AWS): website hosting on servers located in the European Union (Frankfurt region, eu-central-1).
- Amazon Simple Email Service (Amazon SES): sending of the website's transactional emails, in the EU region.
- Amenitiz: online booking system; bookings are made on its platform.
- Any advisers engaged for accounting and tax obligations.
The following act as independent controllers under their own policies:
- WhatsApp Ireland Limited (Meta group), if you contact us via WhatsApp: the WhatsApp privacy policy for the European Economic Area applies.
- Google Ireland Limited, only if you choose to load the Google Maps map on the Contact page: see the Cookie policy.
- Public authorities receiving data by law: the police (Alloggiati Web), the Comune of Capaccio Paestum (tourist tax) and the tax authorities.
Personal data is never sold, rented or exchanged with third parties for marketing purposes.
6. Transfers outside the EU
The website and the transactional emails are hosted in the European Union. Some providers belonging to groups based in the United States (such as Amazon, Meta and Google) may also process data outside the European Union: in that case the transfer complies with Chapter V of the GDPR, on the basis of the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework or of the standard contractual clauses adopted by the Commission (Art. 46 GDPR).
7. Rights of the data subject
Under Articles 15 to 22 of the GDPR, you have the right to:
- Access (Art. 15): obtain confirmation as to whether personal data concerning you is being processed and, if so, access to that data and a copy of it.
- Rectification (Art. 16): obtain the rectification of inaccurate personal data concerning you and the completion of incomplete data.
- Erasure (Art. 17): obtain the erasure of personal data concerning you, in the cases provided for by the GDPR.
- Restriction of processing (Art. 18): obtain the restriction of processing in the cases provided for by the GDPR.
- Data portability (Art. 20): receive the personal data concerning you in a structured, commonly used and machine-readable format and transmit it to another controller.
- Objection (Art. 21): object at any time, on grounds relating to your particular situation, to processing based on the controller's legitimate interest.
To exercise these rights, you may send a written request to info@ilgiardinodeipini.it.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia, 11 – 00187 Rome, website: www.garanteprivacy.it.
8. Changes to this policy
The controller may amend this policy at any time and will publish the updated version on this page. Please consult it periodically.
Last updated: November 2026