Privacy Policy

Information on the processing of personal data pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

Last updated: 26 September 2026

This Privacy Policy describes how the personal data of users who visit the website of Agriturismo Il Moro, request information or quotations and, more generally, contact the property through the services available on the website are processed.

1. Data Controller

The Data Controller is:

Luna Bennati – Agriturismo Il Moro
Via Montecchio 301B
Loc. Pievuccia – Castiglion Fiorentino (AR)
P. IVA 02368090516

Email: info@agriturismoilmoro.com
PEC: bennatiguia@pec.it

2. Types of personal data processed

Browsing data

The IT systems and software procedures used to operate the website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols.

These data are processed to ensure the proper operation and security of the website.

Data voluntarily provided by the user

Sending communications to the addresses indicated on the website and completing the forms available on the website entail the collection of the data provided by the user and necessary to respond to the relevant requests.

Depending on the service used, data such as name, email address, contact details and other information voluntarily provided may be processed.

Data relating to stay and quotation requests

When a user requests a quotation or a proposal for a stay, the following information may be processed:

  • name and contact details;
  • requested stay dates;
  • number and characteristics of guests;
  • apartment of interest;
  • any additional requests or information provided by the user;
  • pricing information and terms contained in the proposal for the stay.

3. Purposes of processing

Personal data may be processed for the following purposes:

  • to respond to requests for information;
  • to prepare and send quotations and proposals for stays;
  • to manage communications with customers during the pre-contractual and contractual stages;
  • to manage administrative, accounting and tax requirements connected with the customer relationship;
  • to comply with legal obligations, including those relating to the registration and communication of guests’ personal details to the competent authorities;
  • to ensure the operation and security of the website;
  • subject to the data subject’s consent, to send commercial communications relating to the services offered by the property.

4. Legal basis for processing

The processing of data necessary to respond to users’ requests, prepare quotations and manage the customer relationship is based on taking steps at the request of the data subject prior to entering into a contract or on the performance of a contract, pursuant to Article 6(1)(b) of the GDPR.

Processing necessary to comply with administrative, tax, accounting and other obligations laid down by applicable law is based on Article 6(1)(c) of the GDPR.

Any processing carried out for the purpose of sending commercial communications, where applicable, is based on the data subject’s consent.

5. Methods of processing

Processing is carried out using electronic, IT or automated means and, where necessary, paper-based means.

Data are processed by the Data Controller, authorised persons and any appointed Data Processors, within the scope of their respective duties and in accordance with the instructions received.

Processing is carried out in accordance with the GDPR principles of lawfulness, fairness, transparency, purpose and storage limitation, data minimisation, accuracy, integrity and confidentiality.

Technical and organisational measures appropriate to the nature of the data processed and the purposes of the processing are adopted.

Personal data are not subject to automated decision-making.

6. Quotation requests and proposals for stays

The data entered in the quotation request form are used to handle the user’s request and prepare a proposal for a stay, where applicable.

Requests are transmitted by email and managed using the tools employed by Agriturismo Il Moro for its correspondence.

When a proposal that can be viewed through the website is prepared, a specific link intended for the requester may be generated. The relevant page may contain some of the information required for the proposal, such as the requester’s name, the stay dates, the number of guests, the proposed apartment, the price and the terms of the proposal.

These pages are not intended for publication or indexing by search engines and remain available only for the period necessary to manage the proposal.

7. Recipients of personal data

Personal data may be processed by the Data Controller, authorised persons and specifically appointed Data Processors.

Where necessary for the purposes set out in this Privacy Policy, data may also be disclosed to:

  • Public Administrations, the Police Headquarters (Questura), ISTAT (Italian National Institute of Statistics), the Tuscany Region, Public Security Authorities and other public bodies where required by law;
  • banks and insurance companies for activities connected with the services provided;
  • consultants and professionals appointed to carry out administrative, accounting, tax or legal activities;
  • providers of technical services necessary for the operation of the website, hosting and email services;
  • other public or private parties to whom disclosure is necessary to comply with contractual or legal obligations.

The list of Data Processors is available from the Data Controller upon request.

8. Disclosure of personal data

Personal data are not disseminated, except at the specific request of the data subject or where required by law or ordered by the competent authority.

9. Retention period

Data relating to contractual, administrative, accounting and tax matters are retained for the duration of the relationship and subsequently for ten years, unless longer retention is required by law or is necessary to protect the rights of the Data Controller.

Guests’ data communicated to the Public Security Authority through the Alloggiati Web system are deleted from the property’s systems after transmission, in accordance with applicable legislation. Receipts confirming successful transmission are retained for five years.

Data relating to requests for information or quotations that do not result in a contractual relationship are retained for the time necessary to handle the request and any subsequent communications.

Web pages created for viewing individual proposals for stays are retained for a limited period and subsequently deleted.

10. Provision of personal data

The provision of personal data through the website is voluntary.

However, providing the data indicated as required in the contact or quotation request forms is necessary to enable the Data Controller to respond to the request, prepare a proposal and, where applicable, perform the contractual relationship.

Failure to provide such data may therefore make it impossible to provide the requested service.

11. Cookies and third-party services

The website uses technical cookies necessary for its operation and may use services provided by third parties.

In particular, some pages of the website use Google Maps to display map content. The service is activated only after the user has given the relevant consent through the preference management system.

Detailed information on cookies and other tools used, their purposes, and how to give, refuse or change consent is available in the website’s Cookie Policy.

Preferences can subsequently be changed using the Manage consent function available on the website.

12. Transfers of personal data to third countries

Data processed directly by the Data Controller are not transferred to third countries or international organisations, except where this may be connected with the use of services provided by third parties, subject to consent where required.

For further information on the third-party services used by the website and their processing practices, please refer to the Cookie Policy and the privacy notices of the respective providers.

13. Rights of the data subject

Where applicable under Articles 15–22 of the GDPR, the data subject may exercise the rights granted by law, including the right to:

  • obtain confirmation as to whether or not personal data concerning them are being processed and access such data;
  • obtain rectification of inaccurate data;
  • obtain erasure of data where applicable;
  • request restriction of processing;
  • object to processing where applicable;
  • obtain data portability where applicable;
  • withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Requests may be addressed to the Data Controller using the following contact details:

Email: info@agriturismoilmoro.com
PEC: bennatiguia@pec.it

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if they consider that the processing of their personal data infringes applicable law.

14. Changes to this Privacy Policy

This Privacy Policy may be updated as a result of changes in legislation, technical changes or changes to the services offered through the website.

The updated version is published on this page.