1. Controller
Provisional notice: the controller is the company established in Italy that operates THE CALABRIAN STAY. Its company name, legal form, registered office, Codice Fiscale, Partita IVA, Registro Imprese/REA, PEC and legal representative will be inserted as soon as the details are provided.
Provisional privacy contact: Agostino Signoretta
Email: info@thecalabrianstay.com
This notice must be completed with the final company details before the legal review is closed.
2. Principles and legal bases
Personal data is processed lawfully, fairly, transparently, for specified purposes and with data minimisation and storage limitation. The legal bases used are pre-contractual or contractual steps, legal obligations, legitimate interests in security and website operation and, where required, consent.
3. Hosting and server logs
The website is hosted by Vercel. IP address, date and time, requested URL, referrer, browser, device and technical security data may be processed to deliver the website, prevent abuse and diagnose errors. The legal basis is Article 6(1)(f) GDPR. Logs are retained according to technically necessary periods and the provider’s settings.
4. Stay enquiries
We process name, email address, optional telephone number, message, requested period, number of guests, language and technical request data to check availability, prepare an offer and take pre-contractual steps. The legal basis is Article 6(1)(b) GDPR. If a contract follows, data may also be processed for administrative, tax, accounting and public-security obligations.
5. Partnership enquiries
We process name, email address, optional telephone number, message, language and technical data to assess and respond to a collaboration proposal. The legal basis is Article 6(1)(b) GDPR for pre-contractual requests or Article 6(1)(f) GDPR for managing business relationships.
6. Newsletter and double opt-in
The newsletter requires separate, voluntary consent. We process the email address, language, registration source, registration and confirmation time and technical evidence needed to document the double opt-in. The legal basis is Article 6(1)(a) GDPR. Delivery and contact management are handled through Resend. Consent may be withdrawn at any time through the unsubscribe link or by email.
7. Google Maps and Common Ninja
Google Maps, provided by Google Ireland Limited, and the reviews module supplied by Common Ninja Ltd. are blocked by default. They load only after express consent to external content. The IP address, browser information, visited page and other technical data may then be transferred to the respective providers. The legal basis is Article 6(1)(a) GDPR together with Article 122 of the Italian Privacy Code.
8. Google Analytics 4
Google Analytics 4, provided by Google Ireland Limited, loads only after separate consent to the Analytics category. It measures visits, acquisition source, engagement time, viewed sections and funnel steps leading to successful stay enquiries, partnership enquiries and newsletter confirmations. Online identifiers, the IP address and technical data about the browser, device, page, referrer and interactions may be processed. Names, email addresses, telephone numbers and message content are not sent to Google Analytics. Advertising features, Google Signals and ad personalisation are disabled, and advertising consent remains denied. The legal basis is Article 6(1)(a) GDPR together with Article 122 of the Italian Privacy Code. Consent can be withdrawn at any time through “Privacy settings”.
9. Recipients and processors
Data may be disclosed to strictly necessary technical providers, particularly Vercel for hosting and infrastructure, Resend for email and newsletters and, only after the relevant consent, Google for Analytics and Maps and Common Ninja for reviews. Data is disclosed to advisers, authorities or public bodies only where required by law or necessary to protect legal rights.
10. International transfers
Technical providers may process data outside the European Economic Area. Transfers take place only on the basis of an adequacy decision, standard contractual clauses or another mechanism permitted by Chapter V GDPR. Common Ninja states that it is headquartered in Israel, a country covered by an EU adequacy decision.
11. Retention
Enquiry data is retained for as long as needed to respond, manage negotiations or contracts and comply with legal duties. Without a contract, it is deleted or anonymised once no longer required. Newsletter data is processed until withdrawal; evidence of consent may be retained as long as necessary to demonstrate lawful processing and defend legal claims. The Google Analytics property is configured with a 2-month retention period for user-level and event-level data. Privacy preferences remain stored in the browser until changed or deleted by the user.
12. Required and optional data
Fields marked as required are necessary to handle the request. Without them, the request cannot be submitted or answered. Telephone number and free-text message are optional unless the form states otherwise. Newsletter registration is always voluntary and separate from a stay enquiry.
13. Rights and complaints
Individuals may request access, rectification, erasure, restriction, portability and objection and may withdraw consent for the future. Requests can be sent to the email address above. A complaint may be submitted to the Garante per la protezione dei dati personali or another competent EU supervisory authority.
14. Automated decision-making
No decisions based solely on automated processing with legal or similarly significant effects are made, and no automated profiling of users is carried out.
15. Language and last updated
The Italian privacy notice is authoritative. This English translation is provided for information. Last updated: 27 July 2026.