Privacy Policy
This Privacy Policy explains how Castrum di Serravalle collects, uses and protects the personal data of users visiting https://www.castrumdiserravalle.com, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Italian data protection legislation.
1. Data Controller
The Data Controller is Ada Claudia Marcantonio, operating under the name Castrum di Serravalle.
Address: Via Roma 21, 31029 Vittorio Veneto (TV), Italy
Email: info@castrumdiserravalle.it
Telephone: +39 348 4238334
For any questions concerning the processing of personal data or the exercise of your rights under the GDPR, please contact the Data Controller using the email address provided above.
2. Personal Data Collected
The website may collect and process the following categories of personal data:
- Browsing data: IP address, browser type, operating system, device information, access times, pages visited and technical information necessary for website operation and security.
- Information voluntarily provided: name, surname, email address, telephone number and information submitted through contact forms or other communication channels.
- Newsletter information: email address, subscription details, preferences and consent records.
- Booking information: details necessary to manage availability requests, accommodation bookings and related services.
- Analytics data: information about website usage collected through analytics tools, subject to consent where required.
3. Purposes and Legal Bases for Processing
3.1 Contact Forms — Contact Form 7
The website uses Contact Form 7 to allow visitors to request information about rooms, accommodation, weddings, events and experiences.
Information submitted through contact forms is processed to respond to enquiries and manage any related requests.
Legal basis: taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR), or legitimate interests in responding to non-contractual enquiries (Article 6(1)(f) GDPR), where applicable.
3.2 Newsletter — Brevo
The website uses Brevo to manage newsletter subscriptions and send email communications about news, events, initiatives, experiences and offers from Castrum di Serravalle.
Subscription is voluntary and based on the user’s consent.
Data processed: email address, subscription and consent information and, where the relevant Brevo features are enabled, data concerning email delivery, openings and interactions.
Purpose: managing subscriptions and sending requested communications.
Legal basis: consent (Article 6(1)(a) GDPR).
Users may withdraw their consent at any time by clicking the unsubscribe link included in emails or by contacting the Data Controller.
Personal data is retained for the duration of the subscription, subject to any additional retention necessary to demonstrate consent and its withdrawal or comply with legal obligations.
Provider information: Brevo Privacy Policy.
3.3 Website Analytics — Google Analytics 4
The website uses Google Analytics 4, a service provided by Google, to analyse website traffic and understand how visitors interact with its content and features.
Google Analytics may process page views, session information, browser and device data, and identifiers associated with analytics cookies.
Purpose: analysing website usage and improving website content and functionality.
Legal basis: consent (Article 6(1)(a) GDPR).
Analytics cookies are subject to the visitor’s preferences collected through the Complianz consent banner.
Users may change or withdraw their consent at any time through the consent management feature available on the website.
3.4 Google Tag Manager
The website uses Google Tag Manager to manage the loading of analytics tools and related scripts.
The service may process technical information necessary for its operation.
Analytics tools managed through Google Tag Manager remain subject to their respective consent requirements.
3.5 Cookie Consent Management — Complianz
The website uses Complianz to display the cookie banner, collect user preferences and manage consent for cookies and similar technologies.
Purpose: managing privacy preferences and supporting compliance with applicable legal requirements.
Legal basis: compliance with legal obligations, where applicable (Article 6(1)(c) GDPR).
Detailed information about cookies, their purposes and retention periods is available in the website’s Cookie Policy.
3.6 Maps — OpenStreetMap and WP Go Maps
The website uses OpenStreetMap through WP Go Maps to display maps and geographical information relating to Castrum di Serravalle.
Loading maps may involve transmitting IP addresses and other technical information to the providers of the relevant map resources.
Purpose: providing geographical information and helping visitors find the property.
The processing of strictly necessary technical data may be based on legitimate interests in providing the requested service (Article 6(1)(f) GDPR), where applicable. Any access to information on the user’s device requiring consent is subject to the appropriate authorisation.
3.7 Reviews — Trustindex
The website uses Trustindex to display reviews published on Google.
Loading the review widget may involve requests to external services and the processing of technical browsing information.
Purpose: displaying guest reviews and providing information about the property.
The processing of necessary technical data may rely on legitimate interests in presenting information about the property, where applicable. Any non-essential technologies requiring consent are activated only under the conditions established by applicable legislation.
3.8 Online Bookings — Amenitiz
The website includes links to the external Amenitiz platform, used to check availability, request information and make reservations.
Accessing this external platform may involve providing personal information necessary to manage accommodation bookings, subject to the privacy information supplied by the relevant parties.
Where Castrum di Serravalle receives personal data relating to a booking, such data is processed to manage the guest relationship and comply with applicable contractual and legal obligations.
Legal basis: performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR) and compliance with legal obligations (Article 6(1)(c) GDPR).
3.9 Website Security
Technical browsing data may be processed to ensure website security, prevent unauthorised access, combat spam and misuse, and maintain the proper functioning of website services.
Legal basis: the Data Controller’s legitimate interests in maintaining system security (Article 6(1)(f) GDPR), where applicable, and compliance with legal obligations.
4. Nature of Data Provision
Providing the personal information required by contact and booking forms is necessary to process enquiries and provide requested services.
Failure to provide the required information may prevent us from responding to a request or completing a booking.
Newsletter subscription and consent to analytics cookies are optional. Refusing consent does not prevent normal use of the website.
5. Recipients of Personal Data
Personal data may be processed by the Data Controller, authorised personnel and service providers necessary for website operation and business activities.
Depending on the processing carried out, these may include hosting providers, IT service providers, email communication platforms, analytics services, map providers and booking platforms.
Such parties operate under their respective data protection roles, including as data processors under Article 28 GDPR where applicable.
Personal data is not indiscriminately disclosed or sold to third parties for independent advertising purposes.
6. International Data Transfers
The use of certain external service providers may involve transferring or accessing personal data from countries outside the European Economic Area.
Where such transfers occur, they must comply with Articles 44 and following of the GDPR, relying on applicable safeguards such as adequacy decisions or Standard Contractual Clauses, where relevant.
Users may request further information about applicable transfers and safeguards by contacting the Data Controller.
7. Data Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected, according to the following criteria:
- Contact enquiries: for the time required to respond and, subsequently, where necessary for record-keeping or the protection of legal rights.
- Bookings and accommodation: throughout the contractual relationship and subsequently for periods required by applicable tax, administrative and statutory limitation rules.
- Newsletter: until consent is withdrawn or the user unsubscribes, subject to limited retention of consent and withdrawal records where necessary.
- Analytics data and cookies: according to the retention periods and settings of the relevant services, as described in the Cookie Policy.
- Technical and security data: for the period strictly necessary for security purposes and compliance with applicable legal obligations.
At the end of the applicable retention periods, personal data is deleted or anonymised unless further retention is required by law.
8. Data Subject Rights
Under Articles 15–22 of the GDPR, users may exercise the following rights, where applicable:
- Access to their personal data.
- Rectification of inaccurate information.
- Erasure of personal data.
- Restriction of processing.
- Objection to processing.
- Data portability.
- Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Requests can be sent to:
Users also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): www.garanteprivacy.it.
9. Links to External Websites
The website may contain links to external services and platforms, including Instagram, WhatsApp and Amenitiz.
When users access these services, any processing carried out directly by their respective operators is governed by the relevant privacy policies.
10. Cookie Policy
The website uses essential cookies and, with prior consent, analytics cookies.
For information about the technologies used and how to manage preferences, please refer to the Castrum di Serravalle Cookie Policy.
Users may change their preferences through the Manage Consent feature available on the website.
11. Data Security
The Data Controller implements technical and organisational measures appropriate to the nature of the personal data and the risks associated with processing, to protect against unauthorised access, loss, alteration or unlawful disclosure.
12. Changes to This Privacy Policy
This Privacy Policy may be updated to reflect changes in website services, data processing activities or applicable legislation.
The updated version will be published on this page, together with the date of the latest revision.