Privacy Policy.

1. Data controller

This is the data controller’s contact address, separate from the apartment address shown on the Location page.

2. Data that may be processed

• Technical browsing data: requesting a page transmits information to the server, such as your IP address, the requested resource and browser information. Depending on its configuration, the hosting service may record this information in technical logs for website operation and security.
• Email enquiries: your email address, any name you provide, your message and stay information you voluntarily share, such as dates and the number of guests.
• WhatsApp enquiries: if you choose to message Alessandro at +39 348 712 7604, he receives your phone number, the name or other profile information made available by the service, and the messages you voluntarily send. These details are used to reply and manage stay enquiries on the pre-contractual or contractual basis described below. Email is available as an alternative.
• Cookie preferences: the website uses one localStorage record named residence-cookie-consent to remember your choices for technical, analytics and marketing categories, the choice version and its save and expiry dates on your device. It contains no user identifier, is not an HTTP cookie and is not sent by the website code to the controller or third parties. Optional categories are prepared, but no analytics or marketing tools are currently installed.
• Demonstration form: the fields on the Contact page are not submitted to the controller through the website, and the submit button is disabled. The website code does not store entered information in cookies, localStorage or sessionStorage. Any autofill features depend on your browser.

Please do not send identity documents, health data or other particularly sensitive information in simple availability enquiries. Any processing necessary for a confirmed stay will be accompanied by the relevant information.

3. Purposes and legal bases

• Replying to enquiries and managing stay-related communications: taking steps at your request before entering into a contract, or performing a contract where applicable, under Article 6(1)(b) GDPR.
• Ensuring operation, security and abuse prevention: the controller’s legitimate interest in protecting the website and communications under Article 6(1)(f) GDPR, with respect for your rights.
• Remembering and applying your choices: storing the preference is technically necessary to manage the choices requested by you and does not depend on consent to optional categories. For any personal data processed for this operational purpose, the legal basis is Article 6(1)(f) GDPR.
• Any future optional analytics or marketing tools: only after updating the notices and obtaining prior consent under Article 6(1)(a) GDPR, which may be withdrawn at any time. These tools are not currently installed: selecting a category does not activate any service.
• Meeting legal obligations, where applicable: Article 6(1)(c) GDPR. Any retention necessary to establish, exercise or defend a legal claim is based on legitimate interest, within the limits of the law.

The website does not use data for profiling, personalised advertising or newsletters, and does not make solely automated decisions producing legal or similarly significant effects.

4. Providing your data

Sending an email is voluntary. Without contact details and essential information about your enquiry, it may not be possible to reply or check availability. Marketing consent is not required to receive a response to a stay enquiry.

5. Retention

Enquiry data is retained for the time needed to reply and manage any follow-up communication. Once it is no longer needed, it is deleted, except where legal obligations or documented needs to establish, exercise or defend a legal claim require retention for the applicable period.

Any technical log retention depends on hosting configuration and must be limited to operational and security needs. You can contact the controller to learn about the retention periods actually applied to your data.

The device preference is valid for six calendar months from saving and is shared across all Italian and English pages of the same origin in the same browser. Expiry, clearing site data or using another browser requires a new choice; a new consent version also requires a new choice. If localStorage is blocked, the choice applies only to the current page: reloading or navigating to another page will require a new choice.

6. Recipients and security

Data is processed by the controller and, as necessary, authorised persons and technical service providers, such as hosting and email providers. Providers processing data on the controller’s behalf are subject to Article 28 GDPR. Competent authorities may receive data when required by law. Enquiry data is not published or sold.

Processing uses organisational and technical measures appropriate to the risks. The website does not integrate behavioural analysis tools or third-party advertising scripts. Using providers that involve transfers outside the European Economic Area requires compliance with the conditions and safeguards in Chapter V GDPR.

7. Cookies and external services

The WhatsApp icon is a plain link to wa.me, not an embedded widget: visiting this website does not load WhatsApp scripts or automatically send data to that service. Clicking opens WhatsApp, where the WhatsApp Privacy Policy applies, including its terms on processing and data transfers. The prefilled text is only a suggestion: you may edit it and decide whether to send it. Clicking does not automatically send a message or provide consent to promotional communications.

Information about technical storage and the choice panel is available in the Cookie Policy, also linked from the panel. With JavaScript, you can reopen “Cookie preferences” from the footer or the button below to reject optional categories, change or withdraw your choice. Without JavaScript, legal notices and navigation links remain accessible and optional services remain inactive. The panel does not open automatically on the four Italian/English legal pages, allowing you to read them before choosing.

Links to Google Maps, travel services and tourist portals open external websites only when you choose to follow them. There are no embedded maps or other external content, and this website makes no automatic requests to Google before consent. External services apply their own privacy notices and cookie settings; a choice on this website does not constitute consent on an external website.

8. Your rights

In the cases and within the limits set out in Articles 15–22 GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Send requests to info@residenceletortore.it. The controller normally responds within one month, subject to the extensions and identity checks permitted by Article 12 GDPR.

You may also lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority, and pursue other remedies provided by law.

9. Updates to this notice

This page will be updated if processing or services change, particularly before activating the contact form, booking tools, analytics or embedded third-party content. Before introducing optional trackers, providers, purposes, cookie or other technology names and lifetimes, and any transfers will be disclosed. The consent version will be updated to request a new choice, with services blocked until consent is given.