Legal information
Privacy Policy
Last updated: 14 September 2026
This notice is issued pursuant to articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter the "GDPR") and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the Italian "Personal Data Protection Code"). It describes precisely how Dépendance Villanita processes the personal data of visitors to the website www.dependancevillanita.com, of those who contact us for information or bookings, and of those who stay at the property.
We have chosen to write a notice that reflects the reality of this website: we do not use profiling cookies, we do not use statistics or traffic-analysis systems, we do not use social network pixels, we have no online contact forms and we do not load any resource from third-party domains. What follows describes exactly the few processing activities that genuinely take place.
1. Data controller
The data controller is Anita Festino — Italian tax code FSTNTA78S57Z103H — who lets the holiday accommodation Dépendance Villanita, Via Polignano 116, Castellana Grotte (BA), postcode 70013, Italy — CIN IT072017C200084773.
Contact details for any matter relating to the protection of personal data: email dependancevillanita@gmail.com, phone and WhatsApp +39 340 262 1558.
2. Data Protection Officer (DPO)
The controller has not appointed a Data Protection Officer, as the mandatory conditions set out in art. 37 of the GDPR do not apply: the property is not a public authority, does not carry out core activities requiring regular and systematic large-scale monitoring of data subjects, and does not process special categories of data on a large scale. For any request concerning personal data you may contact the controller directly using the details given in point 1.
3. Categories of personal data processed
a) Browsing data (technical logs). The computer systems and software procedures used to operate the website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols: the IP address of the device used, browser type and operating system (user agent), date and time of the request, URL of the resources requested, server response code, volume of data transferred, and any referring page. This data is generated and stored by the hosting provider and is not used by the controller to identify users, nor cross-referenced with other information.
b) Data provided voluntarily by the user. The site contains no contact form. If you choose to write or call us using the published contact details (email, phone, WhatsApp), we will process the data you provide us spontaneously: name, email address, phone number, dates and details of the desired stay, number of guests and — where relevant for pricing or extra beds — their ages, as well as any other information contained in your message.
c) Guest data during booking and stay. Personal details, identity or recognition document details, nationality, contact details, arrival and departure dates, and data needed for invoicing and collection of the tourist tax. Full detail is given in point 5.
d) Language preference. If you select a language from the site menu (Italian or English), your browser saves an entry called fm-lang locally on your device, via localStorage, with the value it or en. This is technical data with no identifying content, which is not transmitted to our servers or to third parties and serves only to show you the site in the language you chose on future visits. Full detail is in the Cookie Policy.
e) Data that may be communicated by third parties. If you book through an online booking platform (for example Booking.com), we receive from that platform the data needed to manage the booking: name, contact details, stay details and, where applicable, payment data. In this case art. 14 of the GDPR applies, and the categories of data are those the platform transmits to the property under its own contractual terms and its own privacy notice.
4. Purposes of processing, legal bases and retention periods
4.1 Provision and security of the site. Browsing data is processed to allow the pages to be viewed, to ensure the stability of the service and to protect the infrastructure from misuse (attacks, malicious automated traffic). Legal basis: the controller's legitimate interest under art. 6(1)(f) of the GDPR in the security and proper functioning of its own website. Technical logs are kept by the hosting provider for the time strictly necessary for these purposes, generally no more than a few days, and are not downloaded, archived or reprocessed by us. The only exception to this rule concerns the investigation of computer crimes, where data may be requested by the judicial authority.
4.2 Responding to requests for information and availability. The data you send us by email, phone or WhatsApp is processed to respond to your request, check room availability and prepare a quote. Legal basis: performance of pre-contractual measures taken at the data subject's request under art. 6(1)(b) of the GDPR. Retention: if the request is not followed by a booking, the data is kept for a maximum of 12 months from the last contact, unless you ask us to delete it sooner.
4.3 Managing the booking and the stay. We process the data needed to confirm the booking, welcome you, provide the services requested (extra beds, transfers) and manage any changes or cancellations. Legal basis: performance of the hospitality contract under art. 6(1)(b) of the GDPR. Retention: for the duration of the relationship and thereafter for the periods required by accounting, tax and standard limitation legislation.
4.4 Legal obligations. We process data to fulfil the public security, statistical, tax and accounting obligations described in point 5. Legal basis: compliance with a legal obligation to which the controller is subject, under art. 6(1)(c) of the GDPR. Retention: for the periods set by the respective legislation, in particular 10 years for accounting records and tax documents under art. 2220 of the Italian Civil Code and tax legislation.
4.5 Defence of rights. In the event of disputes, damages or breaches, data may be processed to establish, exercise or defend a right in court or out of court. Legal basis: legitimate interest under art. 6(1)(f) of the GDPR. Retention: for the duration of the dispute and until the expiry of the relevant appeal periods.
4.6 Language preference. Locally saving your chosen language responds to an explicit request from you and is essential to provide the service in the mode you requested. It therefore falls among the tools that are strictly necessary under art. 122 of Legislative Decree 196/2003 and does not require consent. The data remains on your device until you clear your browser's browsing data.
We do not carry out direct marketing activities. We do not send newsletters, we have no contact lists for promotional purposes, and we do not use your data to offer you commercial deals, except at your own specific request.
5. Processing of guest data: the property's statutory obligations
Guests staying at Dépendance Villanita are subject to certain processing activities that the property is legally required to carry out. Your consent is not required, because the legal basis is compliance with a legal obligation (art. 6(1)(c) of the GDPR); refusal to provide the data means we cannot host you.
5.1 Notification to the police headquarters (Questura) via the Alloggiati Web portal. Under art. 109 of Royal Decree 773 of 18 June 1931 (the Consolidated Public Security Laws — TULPS) and the Ministerial Decree of 7 January 2013, operators of accommodation establishments must personally identify every guest by means of an identity document and report guests' personal details to the locally competent police headquarters, via the State Police's "Alloggiati Web" portal, within 24 hours of arrival (within 6 hours for stays shorter than 24 hours). The data reported is: first and last name, sex, date and place of birth, nationality, type, number and place of issue of the document, arrival date and length of stay. Recipient: the Ministry of the Interior — State Police, which processes the data as an independent controller. A copy of the guest registration form is kept by the property for the periods required by public security legislation.
5.2 Statistical survey of tourist movements. Under Legislative Decree 322/1989 and Puglia regional legislation, the property must transmit monthly data on arrivals and overnight stays as part of the statistical survey coordinated by ISTAT (the Italian National Institute of Statistics) and included in the National Statistical Programme, through the SPOT system of the Puglia Region's Destination Management System, run by the Puglia Regional Tourism Agency Pugliapromozione (ARET). The data transmitted is aggregated and anonymous as regards guests' identity (number of arrivals and stays, origin, room type, length of stay) and does not allow individuals to be identified.
5.3 Tourist tax. The Municipality of Castellana Grotte applies a municipal tourist tax. As the party responsible for collecting the tax, the property gathers and retains the data needed for its collection, reporting and annual declaration to the Municipality (number of nights per guest, any documented grounds for exemption, issue of a named receipt). Legal basis: legal obligation under art. 4 of Legislative Decree 23/2011 and the applicable municipal regulation. Further information is in the Legal Notice.
5.4 Tax and accounting obligations. Issuing receipts and invoices, accounting records, communications to the Italian Revenue Agency, and document retention under Presidential Decree 633/1972, Presidential Decree 600/1973 and art. 2220 of the Italian Civil Code.
5.5 Special categories of data. We do not ask for or record health-related data. Should you spontaneously provide us with information of this kind — for example, to request an accessible room or to document an exemption from the tourist tax — such data will be processed solely to fulfil your request or to comply with the tax obligation, based on your explicit consent (art. 9(2)(a) of the GDPR) or the legal obligation, and will be deleted as soon as it is no longer needed.
6. No resources loaded from third-party domains
When you open a page of this site, your browser connects exclusively to the domain www.dependancevillanita.com. All resources needed for display — style sheets, scripts, images and typefaces — are hosted on that same domain.
In particular, the typefaces Cormorant Garamond, EB Garamond and Jost are installed directly on our server as woff2 files and called by the site's style sheet. They are not fetched from Google Fonts or from any other external distribution network: the pages make no requests to the domains fonts.googleapis.com and fonts.gstatic.com.
The practical consequence, and the reason we adopted this configuration, is that while simply browsing the site, no data concerning you is communicated to external providers. Your IP address is not transmitted to any third party: it remains known only to the hosting provider, which processes it as a data processor on our behalf within the limits described in points 4.1 and 8.
The site also embeds no content from third parties: no interactive map, no video, no social widget, no externally loaded review system, no advertising network, no statistics or traffic-analysis service. The only connections to third parties are those you choose to activate by clicking a link, as described in the following point.
7. Third-party services activated only at your initiative
As clarified in point 6, the site embeds no widgets, interactive maps, videos or social buttons that load third-party content when the page opens. Instead, it contains simple hyperlinks, which are activated only if you voluntarily choose to click them:
WhatsApp — the "Message us on WhatsApp" buttons open the wa.me domain and then the WhatsApp application. From that point, processing of the conversation data is also governed by the privacy notice of WhatsApp Ireland Limited (Meta group), which acts as an independent controller with regard to the messaging service's metadata. The content of the message you send us is processed by us in accordance with point 4.2 of this notice.
Google Maps — the "Get directions on Google Maps" link leads to Google's navigation service, which will process your data as an independent controller under its own privacy notice. No map is embedded in our pages.
Airbnb — the “Read all the reviews on Airbnb” link leads to the property’s listing on the platform operated by Airbnb Ireland UC, which will process your data as an independent controller under its own privacy notice. No platform content is embedded in our pages and no review is loaded from their servers: the texts you read in the “Reviews” section are copied statically into our pages.
Phone and email — the tel: and mailto: links open, respectively, the phone app and the mail client on your device. No data is sent until you decide to call or send the message.
We invite you to review the respective providers' privacy notices before using these services. The controller is not responsible for the processing carried out by such parties.
8. Data recipients and processors
Personal data is not disseminated and is not sold to third parties for commercial purposes. It may be communicated exclusively to the following parties, each within their own remit:
Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) and its European affiliates, as data processor under art. 28 of the GDPR, as the provider of the Cloudflare Pages hosting service, the content delivery network (CDN), and infrastructure security and protection services. Cloudflare processes the technical logs described in point 3(a). The relationship is governed by Cloudflare's Data Processing Addendum, which incorporates the Standard Contractual Clauses approved by the European Commission.
Ministry of the Interior — State Police, as independent controller, for the mandatory reporting referred to in point 5.1.
Puglia Region and the Puglia Regional Tourism Agency Pugliapromozione (ARET), as well as ISTAT, as independent controllers, for the statistical survey referred to in point 5.2.
Municipality of Castellana Grotte, as independent controller, for matters relating to the tourist tax referred to in point 5.3.
Italian Revenue Agency and other public bodies, as independent controllers, for tax and fiscal obligations.
The property's tax and accounting advisor, acting as data processor or independent controller depending on their professional role.
Online booking platforms (for example Booking.com B.V.), as independent controllers, limited to bookings made through their channels and in accordance with the notices they provide to users.
As stated in point 6, Cloudflare is the only external provider that processes data during simple browsing of the site: no other party receives data as a result of a page being opened. The other recipients listed above are involved only during the booking and stay stages.
An up-to-date list of data processors may be requested at any time by writing to the controller's contact details.
9. Transfer of data to third countries
The processing activities described normally take place within the European Economic Area. The only transfer to a third country that may occur as a result of browsing the site is the one connected to Cloudflare's services (hosting and content delivery network), a company based in the United States of America, and to the countries in which its sub-processors operate. Since the typefaces are hosted on our own domain, as stated in point 6, there is no longer any transfer of data to Google connected with browsing.
The transfer is supported by the appropriate safeguards set out in Chapter V of the GDPR, in particular:
a) Adequacy decision. On 10 July 2023 the European Commission adopted the adequacy decision on the EU-U.S. Data Privacy Framework: transfers to US organisations that adhere to the Framework and are actively certified are made to a country deemed to offer an adequate level of protection, under art. 45 of the GDPR. Cloudflare states that it adheres to the Framework. The decision remains in force as of the date this notice was last updated; for transparency we note that it is subject to a pending legal challenge before the Court of Justice of the European Union, following which this notice will be updated if necessary.
b) Standard Contractual Clauses (SCCs). As a further and independent safeguard, our relationship with Cloudflare is governed by the Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914, supplemented by the additional technical and organisational measures put in place by the provider, under art. 46(2)(c) of the GDPR. This safeguard operates independently of the adequacy decision and would continue to have effect even if that decision were to lapse.
This provision does not cover any transfers made by third-party services that you voluntarily choose to activate by clicking the links described in point 7: in that case, the relevant providers act as independent controllers, under their own privacy notices.
You may ask the controller for information about the safeguards adopted and a copy of the relevant documentation by writing to the contact details given in point 1.
10. Nature of data provision
Browsing the site. Providing browsing data is implicit in the use of Internet protocols and cannot be avoided if you wish to view the pages.
Requests for information. Providing data is optional; failure to provide it simply means you will not receive a reply or a quote.
Booking and stay. Providing the data needed to enter into and perform the hospitality contract, and to comply with legal obligations, is mandatory: without it, we cannot confirm the booking or host you at the property.
Language preference. Providing this data is optional and only happens if you actively select a language; otherwise the site will simply be displayed in the language of the page you opened.
11. No automated decision-making or profiling
The controller does not carry out any automated decision-making, including profiling, as referred to in art. 22(1) and (4) of the GDPR. No profiles of users or guests are produced, no scores are assigned, and no decision that produces legal effects or similarly significantly affects individuals is taken in a solely automated way.
12. Data subject rights
In relation to the processing described, you may exercise the following rights, recognised under articles 15-22 of the GDPR, at any time:
Right of access (art. 15). To obtain confirmation as to whether your data is being processed, to access that data and information about the purposes, recipients, retention period and origin of the data, and to receive a copy of the data processed.
Right to rectification (art. 16). To obtain, without undue delay, the correction of inaccurate data and the completion of incomplete data.
Right to erasure — the "right to be forgotten" (art. 17). To obtain the deletion of data when it is no longer needed, when you withdraw a consent on which the processing was based, or when you successfully object to the processing. This right cannot be exercised over data that we are required to retain by law (in particular the data referred to in point 5).
Right to restriction (art. 18). To obtain the restriction of processing in the cases provided for, for example while the accuracy of contested data is being verified.
Right to data portability (art. 20). To receive, in a structured, commonly used and machine-readable format, the data processed on the basis of consent or contract by automated means, and to transmit it to another controller.
Right to object (art. 21). To object at any time, on grounds relating to your particular situation, to processing based on the controller's legitimate interest.
Right to withdraw consent (art. 7(3)). Where processing is based on consent, to withdraw it freely at any time, without affecting the lawfulness of processing carried out before the withdrawal.
How to exercise your rights. Simply send a request, even an informal one, to the email address dependancevillanita@gmail.com or by post to Dépendance Villanita, Via Polignano 116, Castellana Grotte (BA), 70013. To allow us to identify you, we may ask for some additional information. We will reply without undue delay and in any event within one month of receiving the request, extendable by a further two months in cases of particular complexity, of which we will notify you. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests, in particular because of their repetitive nature.
13. Right to lodge a complaint with the supervisory authority
If you believe that the processing of your personal data breaches applicable legislation, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), under art. 77 of the GDPR, or to bring proceedings before the competent judicial authority under art. 79 of the GDPR.
Authority contact details: Garante per la protezione dei dati personali — Piazza Venezia n. 11, 00187 Rome — switchboard +39 06 696771 — fax +39 06 69677 3785 — email protocollo@gpdp.it — certified email (PEC) protocollo@pec.gpdp.it — website www.garanteprivacy.it.
14. Security measures
The controller adopts technical and organisational measures appropriate under art. 32 of the GDPR and proportionate to the nature and scale of the processing: the site connection is protected by the HTTPS/TLS protocol, access to devices and mailboxes is restricted and protected by credentials, paper documentation is kept in a location not accessible to the public, and access to data is limited to authorised personnel who have received instructions under art. 29 of the GDPR. No security measure can, however, guarantee the absolute inviolability of computer systems.
15. Data relating to minors
The site is not aimed at minors and does not knowingly collect data from minors through its pages. Data of minors staying at the property is processed solely for the legal obligations referred to in point 5 and for the performance of the contract, and is provided by parents or those exercising parental responsibility.
16. Changes to this notice
The controller reserves the right to update this notice to reflect regulatory changes, decisions of supervisory authorities or changes to the technical services used. The version in force is always the one published at this address, with the date of last update shown at the top. We invite you to check this page periodically.
For any queries about the content of this notice, you can write to us at the email address dependancevillanita@gmail.com: we will be glad to reply.