LOCANDA LE PIAZZE

ACCOMMODATION · RESTAURANT · SPA · TASTINGS

WEBSITE PRIVACY POLICY

WEBSITE AND JOB APPLICANTS

Website https://locandalepiazze.com — provided pursuant to Articles 13–14 of Regulation (EU) 2016/679

Version 1.0 — July 2026

Data Controller

The Data Controller of personal data is LOCANDA LE PIAZZE SRL, VAT No. 01356390524 / Tax Code 01356390524, with its registered office at Loc. Le Piazze, 41 — Castellina in Chianti (SI) 53011 and operational headquarters at the same address, represented by its legal representative Natacha Le Cardiet Fazal Karim, contact: [email protected], PEC: [email protected], Tel. +39 0577 743192, or by ordinary mail at the registered office.

Categories of Personal Data Collected

Through the website https://locandalepiazze.com, the Data Controller may process the following categories of personal data:

Browsing data: IP addresses, access logs, device identifiers, browser, operating system and pages visited collected during normal website operation.

Data voluntarily provided through contact forms: first name, surname, e-mail address, telephone number and the content of the request.

Booking and online purchase (e-commerce) data: identification and contact details, information relating to the requested stay/service and payment data required to conclude and perform the contract.

Newsletter subscription data: e-mail address and any identification data voluntarily provided.

Cookies and similar technologies, as described in the Cookie Policy.

Job application data (CV): curriculum vitae, contact details, education, professional experience and qualifications submitted through the website, contact form or e-mail.

Purposes, Legal Basis and Data Retention

The data collected through the website are processed for the following purposes:

Website operation and IT security: legitimate interest (Art. 6(1)(f) GDPR); retained for the technically necessary period and statutory log retention periods.

Responding to contact requests: pre-contractual measures and/or legitimate interest (Art. 6(1)(b) and (f) GDPR); retained for the time necessary to manage the request.

Managing bookings and online purchases: performance of a contract (Art. 6(1)(b) GDPR); accounting and tax obligations (Art. 6(1)(c) GDPR); tax records retained for 10 years pursuant to Italian legislation.

Newsletter and promotional communications: consent (Art. 6(1)(a) GDPR); retained until consent is withdrawn.

Profiling and analytics cookies: consent provided through the cookie banner; retention periods are described in the Cookie Policy.

Recruitment and personnel selection: pre-contractual measures (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR); retained for 6 months from receipt of the application.

Recruitment and Personnel Selection

Applications received through the website, contact form or e-mail are processed exclusively for evaluating candidates and managing recruitment. Providing the requested data is necessary to assess the application.

Applicants are requested not to include special categories of personal data under Article 9 GDPR (such as health information, religious beliefs or trade union membership) unless strictly necessary. Such data, if voluntarily provided, will only be processed where legally permitted. Recruitment data are processed only by authorized personnel responsible for management and human resources and are not disclosed except where required by law.

Processing Methods and Security

Processing is carried out using electronic and IT systems according to the principle of data minimisation. Appropriate technical and organisational measures are adopted, including firewalls, antivirus software, personal access credentials, backups and a compliant cookie banner with granular consent.

Nature of Data Provision

Browsing data are collected through Internet protocols. Data required for requests, bookings and purchases are mandatory; failure to provide them makes it impossible to process the request or perform the contract. Newsletter and non-technical cookie data are optional and based on consent, which may be withdrawn at any time.

Recipients and Authorized Persons

Authorized personnel responsible for website management, bookings and administration.

External data processors pursuant to Article 28 GDPR, including website and hosting providers, booking/e-commerce platform providers, online payment providers and newsletter platforms.

Tax and judicial authorities where required by law.

Personal data are not disseminated.

Transfers to Third Countries

The Data Controller does not transfer personal data outside the European Economic Area. Certain third-party services, particularly analytics tools and social platforms, may involve transfers to third countries based on adequacy decisions or appropriate safeguards pursuant to Articles 44 et seq. GDPR.

Rights of the Data Subject

Right of access (Art. 15 GDPR).

Right to know the origin of the data and receive information about processing.

Right to rectification, updating, integration, erasure or blocking of unlawfully processed data (Arts. 16–17 GDPR).

Right to restriction of processing (Art. 18 GDPR).

Right to object (Art. 21 GDPR).

Right to withdraw consent and to data portability (Art. 20 GDPR).

Right to lodge a complaint with the Italian Data Protection Authority (Art. 77 GDPR).

To exercise these rights or request clarification, the data subject may contact the Data Controller using the contact details above or the data protection consultant.

Changes to this Privacy Notice

The Data Controller reserves the right to amend or update this Privacy Notice due to legislative changes or changes to the services offered through the website. Updates will be published on this page together with the date of revision.