Privacy Policy

Last updated: February 2026

1. Data Controller

2. Personal Data We Collect

📋 Bookings and Communications

• Identification data: Name, surname, email, phone, identity document
• Stay data: Check-in and check-out dates, number of guests, specific preferences
• Billing data: Address, tax code/VAT number (if requested)
• Purpose: Booking management, service communications, tax obligations
• Legal basis: Contract execution, compliance with legal obligations
• Mandatory: Required to provide the service

📊 Website Navigation

• Technical data: IP address, browser type, device, operating system
• Behavioural data: Pages visited, time spent, links clicked
• Geolocation data: Country of origin (via IP)
• Purpose: Site improvement, security, statistical analysis
• Legal basis: Consent (via cookie banner), legitimate interest
• Mandatory: Optional (you can refuse analytical cookies)

⚖️ Legal Obligations

• Registration data: Identity document details for public security registration (Italian law, art. 109 T.U.L.P.S.)
• Legal basis: Compliance with legal obligations
• Mandatory: Required by law for all accommodation facilities

3. Cookies

We use the following cookies:

• Technical/necessary cookies: Essential for the website to function correctly (session, preferences). Always active.
• Analytical cookies: Google Analytics (GA4) — only loaded after your explicit consent. Used to understand how visitors use the site.

You can manage your cookie preferences at any time via the "Manage Cookies" button in the footer.

4. How We Use Your Data

• Processing and managing bookings
• Sending booking confirmations and service communications
• Complying with legal obligations (public security registration)
• Improving our website and services (only with consent)
• Responding to enquiries and requests

5. Data Sharing

Your data may be shared with:

• Smoobu — booking management platform (data processor under DPA)
• Google LLC — analytics services (only with consent, EU data processing)
• Public authorities — mandatory registration for public security purposes
• Booking platforms — Booking.com, Airbnb etc., for bookings made through those channels

6. Your Rights (GDPR)

Under the GDPR you have the right to:

• Access — obtain confirmation of whether your data is being processed and access a copy
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — restrict the processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise your rights, contact us at: cagliariessence@libero.it. We will respond within 30 days.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante Privacy).

7. Data Retention

• Booking data: 10 years (Italian tax and civil law obligations)
• Public security registration: 5 years
• Analytics data: 14 months (Google Analytics default retention)
• Communications: 2 years from last contact

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction, including: secure HTTPS connections, limited staff access, and regular security reviews.

9. Contacts