Privacy policy

Last updated: 17 October 2026

In case of differences, the Italian text prevails.

This policy explains how Luigi Egidio Notarstefano (“we”) processes the personal data of people who visit villalucialucera.it, make a booking or contact us, as required by Article 13 of Regulation (EU) 2016/679 (GDPR).

Data controller

Luigi Egidio Notarstefano
Email: martinanotarstefano98@gmail.com
Phone: +39 328 4282645

What data we process

Browsing data: IP address, browser and device type, pages visited, date and time. It is collected automatically by the systems that run and protect the website.
Form data: arrival, departure, number of guests and name.
WhatsApp messages: your number, your profile name and what you write to us, including attachments.
Emails and phone calls: your email address or number, and what you write or tell us.
Booking data: name and contact details of the person booking, dates of stay and number of guests; on arrival, details from the guests' identity documents, which the law requires of us.

In your messages, include only what is needed for your request: no health data or other special categories of data, such as religious beliefs or political opinions.

Why we use your data and on what legal basis

For each use we state the legal basis, that is, the point of Article 6(1) GDPR that allows it.

Replying to your requests and, if you ask, preparing a quote or an offer for you: pre-contractual steps taken at your request (point b).
Managing the contract that arises from the request: performance of a contract (point b).
Managing the booking and the stay: performance of a contract (point b). Reporting guests' details to the police (Questura, Article 109 of the Italian Consolidated Law on Public Security) and, where required, to the Region and the Municipality for statistics and the tourist tax: legal obligation (point c).
Replying to other messages, such as a report or a job application: legitimate interest in replying to people who write to us (point f).
Meeting legal obligations, such as tax and accounting ones: legal obligation (point c).
Protecting the website from abuse and automated programs: legitimate interest in security (point f).
Counting visits in aggregate form, with Cloudflare Web Analytics: legitimate interest in understanding how the website is used (point f). The tool stores nothing on your device, creates no profiles and does not track individual visitors.
Asserting or defending a legal right: legitimate interest (point f).

Required and optional data

Giving us your data is your choice; without the data we need, however, we cannot reply to you.

In the form you must fill in arrival, departure and number of guests; the other fields are optional.

Booking data and the guests' documents are necessary: without them, we cannot confirm the booking or welcome the guests.

When we ask for your consent, giving it is optional: if you say no, the website and the service still work.

How and for how long we keep your data

We process data electronically and, when necessary, on paper. Only authorised people can see it, and we protect it with appropriate security measures.

The website has a password-protected private area, from which Luigi Egidio Notarstefano updates the content. Website visitors do not access it and do not receive its cookies.

Browsing data is kept by the website's hosting provider for as long as security requires, under its own rules.
Requests and messages that do not lead to a contract are kept for as long as needed to reply and follow up the negotiation, and in any case for no more than 6 months after the last contact.
To protect the form and the private area from abuse, the website briefly keeps, for 48 hours at most, a fingerprint of the IP address calculated with a secret key, which does not contain the address in readable form.
If the request leads to a contract, we keep the data for its whole duration and then for 10 years, as the law requires for accounting and tax records (Article 2220 of the Italian Civil Code).
Identity document details are needed for the mandatory report to the police (Questura): we keep them only for as long as the law requires.

Who receives the data

The data is never sold or made public. Only the following may receive it, each within the scope of their role:

people authorised by Luigi Egidio Notarstefano, who are bound by confidentiality;
OnlinePerTutti.com (T.H.K. Consulting Limited, Hong Kong), which built and manages the website: it processes data on our behalf, only for the technical management of the website;
Cloudflare, Inc. (United States), which hosts and protects the website and provides the technical tools described on this page: it processes data on behalf of OnlinePerTutti.com, as its supplier;
WhatsApp Ireland Limited, if you message us on WhatsApp: it processes messages as an independent controller (WhatsApp privacy policy);
our accountant and other advisers, banks and public authorities, when required by law or by the contract.

Data outside the European Union

Some of the suppliers listed are based outside the European Union, for example in the United States, and may process part of the data there. They do so with the safeguards set out in the GDPR (Articles 44–46):

for US companies that participate in the EU-U.S. Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795);
in other cases, the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914).

OnlinePerTutti.com (T.H.K. Consulting Limited) is based in Hong Kong, which has no adequacy decision from the European Commission. The data is stored on the systems of the suppliers listed above: T.H.K. Consulting Limited accesses it only for the technical management of the website, on our behalf.

For information on these safeguards, or a copy of them, write to martinanotarstefano98@gmail.com.

Your rights

At any time you can ask us:

to see your data and get a copy (access, Article 15 GDPR);
to correct or complete it (rectification, Article 16);
to erase it when it is no longer needed or the law does not require us to keep it (erasure, Article 17);
to restrict its use (restriction, Article 18);
to receive it in a machine-readable format, to take it elsewhere (portability, Article 20);
to object to the use of your data based on our legitimate interest and, at any time, to its use for marketing purposes (objection, Article 21).

If you have given us your consent, you can withdraw it whenever you like: withdrawal does not affect what we did before (Article 7(3)).

To exercise your rights, write to martinanotarstefano98@gmail.com. We reply within one month. In more complex cases this can be extended by two further months: if so, we tell you within the first month (Article 12(3)).

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22).

Complaint to the Garante

If you believe your data is being processed in breach of the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it (Article 77 GDPR).

Which cookies and similar tools the website uses, and how you can manage them, is explained in the cookie policy.

Changes to this policy

This policy may change, for example if the website adds a feature or a law changes. The version in force is always this page, with the date at the top.