# Privacy policy _Last updated: [DATA_AGGIORNAMENTO]_ This notice describes how we process the personal data of users who visit the website visitcasamicciola.com (the “Site”) and use its contact form, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the “Italian Privacy Code”). ## 1. Data controller The data controller is [TITOLARE], with registered office at [INDIRIZZO_TITOLARE], tax code/VAT number [CF_PIVA_TITOLARE], email [[EMAIL_PRIVACY]](mailto:%5BEMAIL_PRIVACY%5D), PEC (certified email) [PEC_TITOLARE]. ## 2. Data protection officer The Data Protection Officer (DPO), where appointed, can be contacted at [CONTATTI_DPO]. ## 3. Data processed ### Browsing data During their normal operation, the computer systems and software procedures that run the Site collect certain data whose transmission is implicit in the use of Internet communication protocols: IP addresses, browser type and operating system, addresses of the resources requested, time of the request and server response code. This data is used to ensure that the Site works correctly and securely and to establish liability in the event of computer crimes. ### Data provided voluntarily by the user When users fill in the contact form or write to the email addresses shown on the Site, the data they enter is processed (for example, name, email address, any telephone number and the content of the message). Please do not include special categories of data (Article 9 GDPR) in your message unless strictly necessary. ### Cookies and similar technologies The Site uses necessary technical cookies and, only with your consent, analytics cookies. Full details are provided in the [Cookie policy](https://visitcasamicciola.com/en/cookie-policy/). ## 4. Purposes and legal bases - **Operation and security of the Site** (browsing data): the controller’s legitimate interest and, for public bodies, the performance of a task carried out in the public interest (Article 6(1)(f) and (e) GDPR). - **Replying to requests for information** sent via the form or by email: the performance of pre-contractual measures or of a task carried out in the public interest relating to the tourism promotion of the area (Article 6(1)(b) and (e) GDPR). - **Site usage statistics**, only with the user’s consent given via the cookie banner (Article 6(1)(a) GDPR). Consent may be withdrawn at any time. - **Compliance with legal obligations** and the establishment or defence of legal claims (Article 6(1)(c) and (f) GDPR). ## 5. Provision of data Providing the data requested in the contact form is optional, but the fields marked as mandatory are necessary for us to reply to your request. Consent to analytics cookies is freely given, and refusing it does not prevent you from browsing the Site. ## 6. Processing methods and recipients Data is processed electronically by authorised and trained staff, using appropriate technical and organisational measures to ensure its security. It may be processed, as data processors under Article 28 GDPR, by technical service providers: Site hosting and maintenance ([FORNITORE_HOSTING]), email service ([FORNITORE_EMAIL]) and, subject to consent, the analytics service ([STRUMENTO_ANALYTICS]). Data is not disclosed to the public or passed on to third parties for marketing purposes. ## 7. Transfers outside the EU Data is processed within the European Union. Should a provider involve a transfer to third countries, this will take place only on the basis of a European Commission adequacy decision or other safeguards provided for in Articles 44 et seq. of the GDPR. ## 8. Retention - Browsing data and technical logs: up to [GIORNI_LOG] days, unless needed to investigate unlawful acts. - Requests sent via the form or by email: for as long as necessary to handle the request and in any case no longer than [MESI_CONTATTI] months from the last communication, unless retention is required by law. - Statistical data: for the period stated in the Cookie policy. ## 9. Data subject rights Data subjects may at any time exercise the rights provided for in Articles 15–22 of the GDPR: access, rectification, erasure, restriction of processing, portability, objection and withdrawal of consent, without affecting the lawfulness of processing based on consent before its withdrawal. Requests should be sent to [[EMAIL_PRIVACY]](mailto:%5BEMAIL_PRIVACY%5D). Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, [www.garanteprivacy.it](https://www.garanteprivacy.it)). ## 10. Changes This notice may be updated; the current version is always published on this page together with the date of the last update.