Privacy Policy

Last updated: July 2026

This policy describes how the personal data of users who visit the CordiAle Suites website and use the services available on it is processed, pursuant to Regulation (EU) 2016/679 (“GDPR”) and applicable Italian law.

1. Data Controller

2. Types of data collected

The site collects the following personal data:

Data provided voluntarily by the user

By filling in the contact form, the user provides: name, surname, email address, phone number (optional) and any information contained in the message (for example, dates of stay or special requests).

Browsing data

The IT systems and software procedures that operate the site acquire, during normal operation, certain data whose transmission is implicit in the use of internet communication protocols (for example, IP addresses, request times, files requested). This data is processed by the hosting provider for the technical time strictly necessary and for security and diagnostic purposes.

Cookie

The site uses technical cookies and, subject to consent, third-party cookies. For details, please see the Cookie Policy.

3. Purposes and legal bases of processing

• Respond to requests sent through the contact form and provide quotes or information. Legal basis: response to a request from the data subject / pre-contractual measures (Art. 6.1.b GDPR).
• Ensure the operation and security of the site. Legal basis: legitimate interest of the Controller (Art. 6.1.f GDPR).
• Comply with legal obligations. Legal basis: legal obligation (Art. 6.1.c GDPR).

Room bookings are made through an external system (the TeamSystem booking engine): at that stage, data is processed according to the privacy notice provided by that service.

4. Method of processing

Data is processed using IT and electronic tools, with security measures adequate to preserve its confidentiality, integrity and availability (including the encrypted HTTPS connection). Processing is carried out by the Controller and by persons authorised by it.

5. Recipients and third-party services

To provide its services, the Controller relies on providers that may process data on its behalf (data processors) or as independent controllers:

• Hosting and contact-form handling — Netlify, Inc. (United States): hosts the site and receives the data sent through the form.
• Google Analytics, Google Maps and Google Fonts — Google Ireland Limited: anonymous usage statistics and map display (both only after consent) and provision of web fonts. See the Cookie Policy.
• Booking engine — TeamSystem: manages bookings when the user chooses to proceed.

Data is not disclosed or transferred to third parties for purposes other than those indicated.

6. Transfer of data outside the EU

Some providers (for example, Netlify and Google) may also process data outside the European Union. In such cases, the transfer takes place in compliance with the GDPR, on the basis of adequate safeguards (including the Standard Contractual Clauses approved by the European Commission).

7. Retention period

Data sent through the contact form is kept for the time needed to handle the request and any resulting correspondence, and is then deleted, unless other legal obligations apply. Browsing data is kept for the technical time strictly necessary.

8. Rights of the data subject

The user may at any time exercise the rights provided by Articles 15-22 of the GDPR: access to data, rectification, erasure, restriction of processing, objection to processing and data portability. To exercise them, simply write to cordialesuitespisa@gmail.com.

9. Complaint to the supervisory authority

Without prejudice to any other action, a data subject who believes that the processing of their data is unlawful has the right to lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali (garanteprivacy.it).

10. Changes to this policy

The Controller reserves the right to update this policy. The version published on this page is the one in force; please check it periodically.