Personal data

Privacy notice

Controller and contact details

Data controller: Gianni Villoresi, Via Sassaia di Rigutino 23, 52100 Arezzo (AR), Italy. For personal data enquiries: info@villacampodifiore.it. Telephone: +39 348 8228393.

Data collected

The form collects your name, email, type of enquiry (stay or private event), requested dates, number of guests or attendees, message and, if you choose to say, how you heard about the villa. It also records the submission date, enquiry reference and date you acknowledged the conditions and privacy notice. Do not include health data, identity documents or other unnecessary information in your message.

The server processes the technical data necessary for operation and security. A temporary limit on the number of requests helps prevent abuse; form data is not included in application logs.

Purposes and legal bases

The data is used to respond to enquiries and carry out pre-contractual steps requested by the guest. Service security is protected on the basis of the legitimate interest in preventing abuse. If a stay is confirmed, further processing for contractual and administrative obligations is explained as part of the booking. The optional answer about how you heard about the villa is used only to understand, in aggregate, which communication channels work; it is not used for profiling. The website does not send newsletters or use the form for marketing.

Processing methods and recipients

Requests are stored in a database and accessed by the data controller through a restricted area. Hosting providers and any email providers process data according to their respective contractual roles.

Aruba S.p.A. has been selected to host the website and MySQL database, with data centres in Italy according to information published by the provider. This location refers to the hosting of the website and database; external services reached through links and the email service used by the user apply their own privacy notices.

Retention

The policy approved by the data controller provides for all requests submitted through the form to be retained for 12 months from receipt and subsequently deleted from the website database, including requests that resulted in a stay. Backups containing these data have a maximum retention period of 30 days from their creation. Contractual and tax data needed for a confirmed stay are managed separately from the requests database, for the periods applicable to the respective obligations.

Providing data and your rights

Name, email, dates and number of guests are necessary to handle your enquiry; the message and how you heard about the villa are optional. You may request access, rectification, erasure, restriction, objection and portability in the cases provided by law, by writing to the controller's contact address.

You may contact the Italian Data Protection Authority. No automated decisions with legal effects on individuals are made.

Last updated: 19 October 2026