Privacy and cookie notice

1. Who processes your data

The data controller is Casa Vacanze Giusi di Giuseppina Fedel, Via dello Stadio 7, fraz. Miola, 38042 Baselga di Piné (TN), Italy. The property is identified by CIN IT022009C236N22HE9 and CIPAT (CIR) 022009-AT-021992. Day-to-day management is handled by Lorenzo Mercurio Fedel.

For any question about this notice or your data, write to info@casavacanze-giusi.it or call +39 348 460 5688. We have not appointed a Data Protection Officer, as the law does not require one in our case.

2. What we collect and why

We only collect what we need, for reasons we can explain:

• Booking: first and last name, email, phone, stay dates, number of guests, approximate arrival time, whether you arrive by car and any notes. We need these to manage the booking and welcome you: without them we cannot confirm the stay. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Payment: you enter your card on Stripe's pages, not ours. We only receive the payment outcome, the amount and the transaction reference. Legal basis: performance of the contract and tax obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
• Confirmation email and PDF receipt: they contain the summary of your stay and are sent after payment. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Reviews: name, period of stay, ratings and comments, plus your email if you choose to leave it. We publish a review only if you tick the box, and we can remove it at any time at your request. Legal basis: consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
• Server logs: IP address, date and time, requested page and browser type, recorded automatically by the hosting provider for security and diagnostics. Legal basis: our legitimate interest in keeping the site working and secure (Art. 6(1)(f) GDPR).
• Messages you send us by email or phone: we keep them to reply and to manage your stay. Legal basis: performance of the contract and legitimate interest (Art. 6(1)(b) and 6(1)(f) GDPR).

We take no automated decisions about you and we do not profile you. We neither buy nor sell contact lists and we will not write to you for advertising.

3. Cookies and browser storage

This site uses no profiling cookies, no third-party statistics, no social buttons and no advertising. That is why there is no cookie banner: the only tools in use are technical and strictly necessary, and by law they do not require consent.

In detail:

• cg_test — technical cookie used only by the host to test the booking flow without real payments. It lasts 24 hours, cannot be read by JavaScript and is never created during a normal visit.
• casa-giusi-booking — browser session storage (not a cookie): it holds the dates you picked between step one and step two of the booking. It disappears when you close the tab.
• cg_admin_pw — browser session storage, present only in the host's private panel.

Fonts and images are served from our own domain: while browsing these pages your browser does not contact any third-party server. When you move on to payment you are on Stripe's pages, which use their own cookies under their own notice.

4. Who we share data with

Your data is never made public. It is processed on our behalf, as processors, only by the providers we need to run the service:

• Vercel Inc. — website hosting and server logs; requests from European visitors are served from the Frankfurt region.
• Neon Inc. — the database holding bookings and reviews. The database is located in the European Union, in the Frankfurt region (eu-central-1).
• Stripe Payments Europe Ltd. (Ireland) and Stripe Inc. (USA) — card payment collection and management.
• Resend (US) — delivery of confirmation emails and notifications.
• Booking.com — if you book through that channel, your data reaches us from there. The calendar we exchange with Booking contains only occupied dates, no personal data.
• Tax and accounting advisers, for invoicing and record-keeping obligations.

We also pass guest data to the authorities where the law requires it: the guest declaration to the Questura within 24 hours of arrival (Art. 109 of the Italian Consolidated Public Security Act) and statistical reporting to the Autonomous Province of Trento. Identity documents are checked at check-in, not through this website.

5. Transfers outside the European Union

Booking data is stored in Europe. Some of the providers listed above are nevertheless based in the United States and may access it from their systems for technical support. These transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the providers' certification under the EU-US Data Privacy Framework, together with the security measures set out in the respective data processing agreements.

You can ask us for a copy of the safeguards in place by writing to info@casavacanze-giusi.it.

6. How long we keep it

• Paid bookings and related accounting records: 10 years from the end of the year of the stay, as required by Italian civil and tax law.
• Bookings started but never completed: 12 months, then deleted.
• Published reviews: as long as consent stands; if you withdraw it, we take the review down.
• Server logs: for the retention period of the hosting provider, around 30 days.
• Emails and messages: 24 months from the last contact, unless needed for an ongoing dispute.

7. Your rights

At any time you may ask us to access your data, correct it, delete it, restrict its use, receive it in a format readable by another service (portability), or object to processing based on legitimate interest. Where processing relies on consent, you may withdraw it without affecting what happened before.

Just write to info@casavacanze-giusi.it: we reply within one month. If you believe something is wrong, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, garanteprivacy.it) or with the supervisory authority of the country where you live.

8. How we protect your data

The site runs only over an encrypted connection (HTTPS). The management panel is password protected and every request to it is verified. Card details never pass through our systems. We collect the minimum we need, so even if something goes wrong there is little to expose.

9. Children

The service is aimed at adults: the booking must be made by an adult, who is also responsible for the data of any children staying with them.

10. Changes

If we change the way we handle data we will update this page and the date at the top. Previous versions remain available on request.