Privacy policy

1. Data controller

The data controller is SALIMAR di Lucini Boris, VAT no. 01588620912, contactable at [email protected].

2. Categories of data processed

We process the identification and contact data provided by the data subject for booking purposes or when requesting information (name, surname, email address, telephone number, booking details), together with technical browsing data collected automatically by the website. Payment card data is processed directly by the payment service provider and is neither collected nor stored by the controller.

3. Purposes and legal bases

Data is processed for the following purposes: performance of the contract and of pre-contractual measures requested by the data subject, including managing the booking and delivering the service (Art. 6(1)(b) GDPR); compliance with tax, accounting and other legal obligations (Art. 6(1)(c)); the controller's legitimate interest in website security, aggregate usage statistics and the establishment, exercise or defence of legal claims (Art. 6(1)(f)).

With the data subject's free and optional consent (Art. 6(1)(a) GDPR), the email address may be used to send offers, news and discounts about the controller's services, including through third-party advertising platforms (for example Google Ads – Customer Match), which receive the address in hashed form for matching purposes only. Consent is collected separately, is not required in order to book and may be withdrawn at any time by writing to [email protected] or via the link in every communication; withdrawal does not affect the lawfulness of processing carried out beforehand. Without such consent, communications relate exclusively to the booking made.

4. Nature of the provision of data

Providing the data indicated as necessary is a requirement for entering into and performing the contract; refusal makes it impossible to proceed with the booking.

5. Categories of recipients

Data may be disclosed to providers of services ancillary to the controller's activity — in particular in the areas of payment services, booking management, email and hosting services, and website delivery and security — appointed as processors under Art. 28 GDPR, as well as to tax and accounting advisers and to the competent authorities in the cases provided for by law. Data is not sold or transferred to third parties for commercial purposes. An up-to-date list of appointed processors is available on request to the controller.

6. Transfers to third countries

Where providers process data outside the European Economic Area, the transfer takes place on the basis of an adequacy decision of the European Commission or of the Standard Contractual Clauses referred to in Art. 46 GDPR.

7. Retention period

Data is kept for as long as strictly necessary for the stated purposes and, in particular: booking data for the duration of the contractual relationship and, for tax and accounting obligations, for ten years; contact requests for the time needed to handle them; statistical data for a limited period and in aggregate form.

8. Data subject rights

The data subject has the rights set out in Articles 15-22 GDPR, namely access, rectification, erasure, restriction of processing, data portability and objection, which may be exercised by writing to [email protected]. The right to lodge a complaint with the Italian Data Protection Authority under Art. 77 GDPR remains unaffected.

9. Automated decision-making

The controller does not carry out processing based on automated decision-making, including profiling, producing legal effects or similarly significantly affecting the data subject.

10. Cookies and similar technologies

The website uses only storage technologies necessary for its operation and first-party statistical tools, with no profiling cookies and no third-party advertising tools.

11. Changes

The controller may update this policy; the version in force is published on this page with the date of last update.