Privacy Policy

1. Data Controller

The Data Controller of the personal data collected through this website is:

2. Categories of personal data processed

Different categories of personal data may be collected through the website depending on the services used by the user.

Browsing data

The IT systems and software procedures used to operate this website may automatically collect certain technical information, including IP address, browser type, device used, operating system, date and time of access, pages visited and other technical information required for the proper operation and security of the website.

Data voluntarily provided by users

When a user contacts the property through forms, email, telephone or other communication channels, personal data such as name, surname, email address, telephone number and any information contained in the message may be processed.

Booking data

Depending on the configuration of the booking service, the online booking system may request information including:

• name and surname;
• email address;
• telephone number;
• arrival and departure dates;
• number of adult and minor guests;
• room or accommodation requested;
• any requests or information voluntarily entered by the user.

3. Purposes and legal bases of processing

Personal data is processed only for specific purposes and on the basis of the lawful grounds provided by Regulation (EU) 2016/679.

Enquiries and availability requests

Personal data is used to respond to enquiries submitted by users, check accommodation availability and provide quotations and information concerning a possible stay.

The legal basis is the performance of pre-contractual measures taken at the request of the data subject pursuant to Article 6(1)(b) GDPR.

Booking and management of the stay

Personal data is used to register and manage bookings, communicate with guests, organise their stay and provide the requested accommodation services.

The legal basis is the performance of a contract or pre-contractual measures requested by the data subject.

Compliance with legal obligations

Certain personal data may be processed in order to comply with obligations imposed on accommodation providers by applicable legislation, including administrative, tax and accounting obligations and obligations relating to the communication of guest identification details to the competent authorities.

The legal basis is compliance with a legal obligation pursuant to Article 6(1)(c) GDPR.

Security and protection of legal rights

Certain personal data may be processed where necessary to ensure the security of the website, prevent unlawful or fraudulent use and establish, exercise or defend the Data Controller's legal rights.

The legal basis is the legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR.

Marketing communications

Should newsletters or marketing services be introduced in the future, promotional communications sent by email, SMS or similar means will only be carried out in the circumstances and in accordance with the procedures permitted by applicable law.

Any consent required for marketing purposes will be separate from the processing necessary to manage a booking and may be withdrawn at any time.

4. Booking and privacy consent

Processing of personal data strictly necessary for an availability request or booking does not require the user's consent, as such processing is necessary to take steps at the request of the data subject and to perform the contractual or pre-contractual relationship.

Any checkbox confirming that the user has read this Privacy Policy therefore serves only to acknowledge receipt and review of the information provided and does not constitute consent to processing necessary for the booking.

5. Provision of personal data

Providing the personal data marked as mandatory in enquiry or booking forms is necessary in order for the property to process the user's request.

Failure to provide the information required may make it impossible to respond to the enquiry or complete the booking.

Any data requested for additional or optional purposes will be clearly identified as such.

6. Guest data and identity documents

During the stay, the property is required to identify its guests and communicate the identification details of accommodated persons to the competent authorities in accordance with applicable Italian law, including Article 109 of the Italian Consolidated Law on Public Security (TULPS).

Identification data is processed solely to the extent necessary to comply with these legal obligations.

Any copies or images of identity documents acquired exclusively for identification purposes and compliance with legal obligations will not be retained beyond the time necessary to complete the relevant legal requirement, unless a specific provision of law requires further retention.

7. Processing methods and security

Personal data is processed using electronic systems and, where necessary, paper-based procedures, in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation.

The Data Controller adopts technical and organisational measures appropriate to the level of risk in order to protect personal data against loss, destruction, alteration, unauthorised access or unlawful disclosure.

Access to personal data is permitted only to persons who require such access in order to perform their respective duties.

8. Recipients of personal data

Personal data may be processed by or disclosed, strictly within the limits necessary for the purposes described in this Privacy Policy, to the following categories of recipients:

• authorised personnel and collaborators of the property;
• web hosting and IT infrastructure providers;
• email service providers;
• providers or developers of booking management systems, where they have access to personal data;
• technical support, maintenance, security and backup service providers;
• professionals and advisers where necessary for administrative, tax or legal purposes;
• public authorities, police authorities and public bodies where required by law.

Where required, service providers processing personal data on behalf of the Data Controller are appointed as Data Processors pursuant to Article 28 GDPR.

Personal data is not publicly disclosed.

9. Transfers outside the European Economic Area

Certain IT service providers or third-party tools that may be used by the website could involve the processing of personal data outside the European Economic Area.

Where this occurs, personal data will be processed in accordance with Articles 44 et seq. GDPR, including, where applicable, on the basis of adequacy decisions, Standard Contractual Clauses or other safeguards recognised by applicable data protection law.

Further information may be requested from the Data Controller using the contact details provided in this Privacy Policy.

10. Data retention periods

Personal data is retained for no longer than is necessary for the purposes for which it was collected.

• Enquiries or availability requests that do not result in a booking: normally for up to 12 months after the request has been completed, unless further retention is necessary for the protection of legal rights.
• Booking and accommodation data: for the period necessary to manage the contractual relationship and thereafter for the time required to comply with legal obligations and protect the Data Controller's rights.
• Administrative, accounting and tax documentation: for the periods required by applicable legislation, including up to 10 years where provided by law.
• Data processed for public security obligations: for the periods required by the applicable legal provisions.
• Copies of identity documents acquired exclusively for guest identification purposes: only for the period strictly necessary to complete the legal requirement that justified their acquisition, unless otherwise required by law.
• Technical and security data: for the period strictly necessary for the operation, security and protection of the website, unless longer retention is required in connection with investigations or cybersecurity incidents.

11. Cookies and similar technologies

The website may use technical cookies necessary for its operation and, where present, cookies or similar technologies provided by third parties for statistical, functional or marketing purposes.

Cookies and other technologies that are not strictly necessary are used, where required by law, only after the user's consent has been obtained through the website's preference management system.

For detailed information about the cookies used by the website, their purposes, duration and the methods available for managing consent, please refer to the Cookie Policy .

12. Personal data relating to other guests

Where a user provides personal data concerning another person, for example another guest included in the booking, the user declares that they are authorised to provide such information and undertakes, where necessary, to inform the relevant data subject about the processing of their personal data.

The Data Controller processes such information solely for the purposes of managing the booking, the stay and the related legal obligations.

13. Minors

The booking service is intended for adults.

Personal data relating to minors that may be provided in connection with a booking is processed only to the extent necessary to manage the stay and comply with applicable legal obligations.

14. Automated decision-making and profiling

Personal data processed for the purposes described in this Privacy Policy is not subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject.

The booking system may automatically perform technical operations such as checking availability, calculating the duration of the stay or managing booking dates. Such operations do not constitute profiling of the user within the meaning of the GDPR.

15. Data subject rights

In the circumstances provided by Regulation (EU) 2016/679, data subjects may exercise the rights granted under Articles 15 et seq. GDPR.

In particular, the data subject may request:

• confirmation as to whether or not personal data concerning them is being processed;
• access to their personal data;
• rectification of inaccurate or incomplete personal data;
• erasure of personal data where permitted by law;
• restriction of processing;
• data portability, where applicable;
• objection to processing in the circumstances provided by the GDPR;
• withdrawal of any consent previously given, without affecting the lawfulness of processing carried out before withdrawal.

Requests may be sent to: info@beblegrotte.com .

16. Right to lodge a complaint

A data subject who believes that the processing of their personal data infringes applicable data protection law has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), without prejudice to any other available administrative or judicial remedy.

17. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time, including as a result of changes in applicable legislation, changes to the services offered or the introduction of new tools or website functionalities.

The updated version will be published on this page together with the date of the latest revision.