Draft — complete before publishing: this is a standard template based on the data processing actually detected on the site (request forms, Google Analytics/Ads, Supabase, Resend, Kross, WhatsApp). Before it goes live it needs the exact legal entity name, VAT number, registered address and PEC of the data controller, and should be reviewed by a lawyer or the appointed DPO.
This privacy policy describes how personal data is processed for visitors of www.lesicilien.it ("the Site") and for anyone using the contact and availability-request forms, in accordance with EU Regulation 2016/679 ("GDPR") and applicable Italian data protection law.
1. Data controller
The data controller is Le Sicilien [TO COMPLETE: legal entity name, legal form and VAT number], registered at Via dei Tintori, 90133 Palermo (PA), Italy.
Contact: email lesicilienhouses@gmail.com · phone/WhatsApp +39 327 375 1480.
2. What data we collect
- Data you provide directly: name, email, phone number, desired stay dates, number of guests, notes or special requests, entered via the availability-request or extra-service booking forms on the Site.
- Browsing and cookie data: IP address, browser and device type, pages visited, time on page, traffic source, collected via Google Analytics and Google Ads only with your prior consent — see our Cookie Policy for details.
- Data shared with third parties to deliver the service: when you click a booking button, you are redirected to the third-party booking engine Kross Booking, which processes the data needed to complete the booking under its own privacy policy.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Responding to availability and booking requests submitted through the Site's forms | Pre-contractual measures at the data subject's request (Art. 6.1.b GDPR) |
| Administrative and accounting management of requests and bookings | Performance of a contract (Art. 6.1.b GDPR) |
| Sending service communications related to your request (e.g. confirmation emails) | Pre-contractual measures (Art. 6.1.b GDPR) |
| Statistical analysis of Site traffic and performance (Google Analytics) | Consent (Art. 6.1.a GDPR) |
| Measuring advertising conversions (Google Ads) | Consent (Art. 6.1.a GDPR) |
| Preventing abuse and spam on the Site's forms | Legitimate interest of the controller (Art. 6.1.f GDPR) |
4. Processing methods and retention
Data is processed with IT tools and stored on cloud infrastructure (Supabase for storing requests, Resend for sending transactional emails). Data collected through request forms is kept for as long as needed to handle the request and for any subsequent accounting/tax obligations, and in any case no longer than 10 years unless a different legal obligation applies. Browsing data collected with consent via analytics cookies is retained for the periods indicated in our Cookie Policy.
5. Sharing data with third parties
Personal data may be shared, strictly within the limits necessary for the purposes above, with the following third parties, acting as independent controllers or processors:
- Google LLC (Google Analytics 4, Google Tag Manager, Google Ads) — traffic and conversion measurement, only with consent;
- Resend — sending the email notifications generated by the Site's forms;
- Supabase Inc. — storing requests submitted through the Site's forms;
- Kross Booking — the booking engine you are redirected to in order to complete a reservation;
- Meta/WhatsApp — if you choose to contact us via the WhatsApp button on the Site, that conversation is subject to WhatsApp's own privacy policy.
6. International data transfers
Some of the providers listed in section 5 (in particular Google, Resend and Supabase) may process data outside the European Economic Area. In such cases, the transfer relies on the European Commission's Standard Contractual Clauses or other adequate safeguards under Chapter V of the GDPR.
7. Your rights
At any time you can exercise the rights granted under Articles 15–22 GDPR: access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent at any time (without affecting the lawfulness of processing carried out before withdrawal). Requests can be sent to lesicilienhouses@gmail.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.gpdp.it) or with your own national supervisory authority.
8. Cookies
The Site uses technical cookies, necessary for its operation, and analytics/marketing cookies installed only after explicit consent given through the banner shown on every page. For the detailed list of cookies used, their duration and how to manage your preferences, see our Cookie Policy.
9. Changes to this policy
The controller reserves the right to modify or update this policy at any time, including to reflect regulatory changes. Changes will be published on this page along with the last-updated date.