Privacy Policy.

1. Data controller

This is the data controller’s contact address, separate from the apartment address shown on the Location page.

2. Data that may be processed

• Technical browsing data: requesting a page transmits information to the server, such as your IP address, the requested resource and browser information. Depending on its configuration, the hosting service may record this information in technical logs for website operation and security.
• Email enquiries: your email address, any name you provide, your message and stay information you voluntarily share, such as dates and the number of guests.
• WhatsApp enquiries: if you choose to message Alessandro at +39 348 712 7604, he receives your phone number, the name or other profile information made available by the service, and the messages you voluntarily send. These details are used to reply and manage stay enquiries on the pre-contractual or contractual basis described below. Email is available as an alternative.
• Cookie preferences: the website uses one localStorage record named residence-cookie-consent to remember your choices for technical, analytics and marketing categories, the choice version and its save and expiry dates on your device. It contains no user identifier, is not an HTTP cookie and is not sent by the website code to the controller or third parties. Optional categories are prepared, but no analytics or marketing tools are currently installed.
• Contact form: full name, email, arrival, departure, number of guests and message, together with language and technical security data. With JavaScript and only on your action, fields are sent in a same-origin HTTPS JSON POST to /api/contact.php. The server forwards them to the controller’s mailbox, info@residenceletortore.it, using PHPMailer. Private configuration selects the hosting provider’s local PHP mail() service or authenticated SMTP over SSL/TLS at mail.residenceletortore.it:465; no automatic retry via another channel takes place. Website code does not save fields in cookies, localStorage or sessionStorage; the consent preference remains the only persistent browser record. Autofill depends on your browser.
• Anti-abuse metadata: a private SQLite database stores event types and timestamps, HMAC digests of IP addresses, and HMAC digests of used tokens with their expiry. It does not store plain IP addresses, names, email addresses or form contents. The IP address received by the server is used for checks, not stored in plain form in this database; any hosting logs are separate.

Please do not send identity documents, health data or other particularly sensitive information in simple availability enquiries. Any processing necessary for a confirmed stay will be accompanied by the relevant information.

3. Purposes and legal bases

• Replying to enquiries and managing stay-related communications: taking steps at your request before entering into a contract, or performing a contract where applicable, under Article 6(1)(b) GDPR.
• Ensuring operation, security and abuse prevention: the controller’s legitimate interest in protecting the website and communications under Article 6(1)(f) GDPR, with respect for your rights.
• Remembering and applying your choices: storing the preference is technically necessary to manage the choices requested by you and does not depend on consent to optional categories. For any personal data processed for this operational purpose, the legal basis is Article 6(1)(f) GDPR.
• Any future optional analytics or marketing tools: only after updating the notices and obtaining prior consent under Article 6(1)(a) GDPR, which may be withdrawn at any time. These tools are not currently installed: selecting a category does not activate any service.
• Meeting legal obligations, where applicable: Article 6(1)(c) GDPR. Any retention necessary to establish, exercise or defend a legal claim is based on legitimate interest, within the limits of the law.

The website does not use data for profiling, personalised advertising or newsletters, and does not make solely automated decisions producing legal or similarly significant effects.

4. Providing your data

Contacting the controller by form, email or WhatsApp is voluntary. The form requires full name, email, arrival, departure and number of guests; the message is optional. The mandatory checkbox acknowledges reading this notice: the declaration is sent with the enquiry and included in the controller’s email, without a separate database archive. This is not marketing consent and does not change the pre-contractual legal basis under Article 6(1)(b) GDPR. Without essential details, it may not be possible to reply or check availability.

Submission requires JavaScript, HTTPS, PHP 8.2 or later with the required extensions, PHPMailer and ready private configuration. If unavailable, use the email shown or WhatsApp at +39 348 712 7604, also accessible without JavaScript. A positive result means only that the selected mail service accepted the message for forwarding: it does not guarantee inbox delivery or confirm a stay. With PHP mail(), subsequent transport and delivery are handled by the provider, not by a directly verified SMTP TLS connection from the script.

5. Retention

The server forwards enquiries by email and does not archive messages, names or email addresses in the website database. Correspondence received in the controller’s mailbox, including form enquiries, is retained for the time needed to reply and manage follow-up communication. Once no longer needed, it is deleted, except where legal obligations (Article 6(1)(c) GDPR) or documented needs to establish, exercise or defend a legal claim require retention for the applicable period. Deleting anti-abuse metadata does not delete mailbox correspondence.

Anti-abuse event records are deleted after one hour; token digests are deleted at the end of the token’s 30-minute validity. Deployment must include private scheduled cleanup every minute, including when there is no website traffic: with regular execution, event retention is one hour plus a delay of up to one minute, and token retention is until expiry plus a delay of up to one minute. These periods depend on the cron job actually running on the hosting service; scheduler delays or interruptions may extend them.

Any technical log retention depends on hosting configuration and must be limited to operational and security needs. You can contact the controller to learn about the retention periods actually applied to your data.

The device preference is valid for six calendar months from saving and is shared across all Italian and English pages of the same origin in the same browser. Expiry, clearing site data or using another browser requires a new choice; a new consent version also requires a new choice. If localStorage is blocked, the choice applies only to the current page: reloading or navigating to another page will require a new choice.

6. Recipients and security

CSRF protection uses an HMAC-signed token with a random nonce, bound to the IP address, valid for 30 minutes and usable once. The frontend keeps the token only in page memory, not in localStorage or sessionStorage. Issuance is stateless: no PHP session is opened and no HTTP cookies are set; the private database records the consumed token’s digest to prevent reuse. Protection includes an authorised HTTPS origin check, a hidden anti-spam field, a minimum three-second wait and technical rate limits, which are not accommodation capacity limits. Security and abuse prevention rely on Article 6(1)(f) GDPR.

Data is processed by the controller and, as necessary, authorised persons and technical service providers, such as hosting and email providers. Providers processing data on the controller’s behalf are subject to Article 28 GDPR. Competent authorities may receive data when required by law. Enquiry data is not published or sold.

Processing uses organisational and technical measures appropriate to the risks. The website does not integrate behavioural analysis tools or third-party advertising scripts. Using providers that involve transfers outside the European Economic Area requires compliance with the conditions and safeguards in Chapter V GDPR.

7. Cookies and external services

The WhatsApp icon is a plain link to wa.me, not an embedded widget: visiting this website does not load WhatsApp scripts or automatically send data to that service. Clicking opens WhatsApp, where the WhatsApp Privacy Policy applies, including its terms on processing and data transfers. The prefilled text is only a suggestion: you may edit it and decide whether to send it. Clicking does not automatically send a message or provide consent to promotional communications.

Information about technical storage and the choice panel is available in the Cookie Policy, also linked from the panel. With JavaScript, you can reopen “Cookie preferences” from the footer or the button below to reject optional categories, change or withdraw your choice. Without JavaScript, legal notices and navigation links remain accessible and optional services remain inactive. The panel does not open automatically on the four Italian/English legal pages, allowing you to read them before choosing.

Links to Google Maps, travel services and tourist portals open external websites only when you choose to follow them. There are no embedded maps or other external content, and this website makes no automatic requests to Google before consent. External services apply their own privacy notices and cookie settings; a choice on this website does not constitute consent on an external website.

8. Your rights

In the cases and within the limits set out in Articles 15–22 GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Send requests to info@residenceletortore.it. The controller normally responds within one month, subject to the extensions and identity checks permitted by Article 12 GDPR.

You may also lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority, and pursue other remedies provided by law.

9. Updates to this notice

This page will be updated if processing or services change, particularly for changes to the contact service or before introducing booking tools, analytics or embedded third-party content. Before introducing optional trackers, providers, purposes, cookie or other technology names and lifetimes, and any transfers will be disclosed. The consent version will be updated to request a new choice, with services blocked until consent is given.