Privacy notice

The data controller is Casa Aroma di Gioppi Enrica, VAT IT04034600124, REA VA-397065. For any question about your data, write to info@casaaroma.eu or call 340 9733680.

The site has no forms to fill in, uses no cookies, except possibly a technical security cookie described below, and carries no advertising or profiling. If Cloudflare, which hosts the site, detects suspicious traffic, it may ask your browser for a security check and then store a technical security cookie (for example cf_clearance): it only protects the site and needs no consent.

Apart from that, all that stays on your device is your browser’s normal cache of the site’s images and files, and two pieces of technical information. The first: when you switch language from the language menu, the site saves where you were on the page in your browser’s session storage (sessionStorage), under the name casaaroma:locale-scroll, so the new page opens at the same spot. It is used only for that step: normally the new page reads it and deletes it straight away. In any case it stays in your browser, tied to that tab, and it is never sent anywhere.

The second: Cloudflare tells your browser, for 7 days, to report to Cloudflare the errors it meets while loading the site (Network Error Logging): this is to find connection problems between visitors and Cloudflare’s network. A report holds the address of the page and of the page you came from, the type of error and some technical data about the request. According to Cloudflare, the IP address is not recorded: Cloudflare derives from it only the country, the metro area and the network it comes from, and does not share the reports with third parties.

The site is run on our behalf by an external collaborator, who looks after it as our processor (Article 28 GDPR) and hosts it with Cloudflare, Inc., based in the United States. With every request Cloudflare receives technical data such as the IP address, the browser and the page requested: it needs them to deliver the pages and to protect the site from attacks, and processes them only for as long as strictly necessary. We keep no logs of the requests ourselves.

For the security of its own network, Cloudflare also processes some of this data as an independent controller, under its own privacy policy (www.cloudflare.com/privacypolicy).

The legal basis is our legitimate interest in offering a secure, working site (Article 6(1)(f) GDPR).

For the transfer of data to the United States, Cloudflare adheres to the EU-US Data Privacy Framework, recognised as adequate by the European Commission’s decision of 10 July 2023; failing that, the standard contractual clauses apply, which are part of Cloudflare’s data processing agreement: you can read a copy at www.cloudflare.com/cloudflare-customer-dpa.

For a transitional period, anyone who opens casaaroma.eu without www is first redirected to www.casaaroma.eu by Vercel Inc., based in the United States: we use this redirect on the basis of our legitimate interest in offering a site that also works without www (Article 6(1)(f) GDPR). To do so, Vercel receives the technical data of the request, such as the IP address, and processes them as a controller under its own privacy notice (vercel.com/legal/privacy-notice); for the transfer of data to the United States, Vercel adheres to the EU-US Data Privacy Framework.

To know how the site is used, we use Cloudflare Web Analytics, a service of Cloudflare, Inc., the same company that hosts the site. A small Cloudflare script in the page measures the visit: the page viewed, the page you came from, the country, the browser, the operating system, the type of device and how long the page took to load. The script uses no cookies and saves nothing on your device. Cloudflare receives the IP address with the data but discards it at its nearest data centre and does not keep it; it keeps the data of single visits for 7 days and after that only in a reduced, aggregated form, available for six months.

The legal basis is our legitimate interest in knowing how the site is used (Article 6(1)(f) GDPR). Aggregate statistics, without cookies and without identifying who visits the site, need no consent (Garante per la protezione dei dati personali, the Italian data protection authority: Guidelines on cookies and other tracking tools, 10 June 2021, section 7.2).

For the transfer of data to the United States, the safeguards described for hosting apply: Cloudflare adheres to the EU-US Data Privacy Framework.

The buttons to write to us and the site’s email address open your own email program, with a new message addressed to info@casaaroma.eu: nothing reaches us unless you send it. You can also call us on 340 9733680.

We receive only what you choose to send us: if you write, your email address and what you write; if you call, your number, unless it is withheld, and what you tell us. We use this data to reply to you and to handle your booking; the legal basis is the performance of pre-contractual steps taken at your request and, if you book, of the contract (Article 6(1)(b) GDPR).

Giving us this data is not mandatory, but without a way to reach you we cannot reply. If you book, the data for the tax documents is, however, required by law.

Emails reach our mailbox, provided by Register S.p.A., which manages it as our processor (Article 28 GDPR).

We send no newsletters or marketing messages, and we do not pass your data on to anyone for marketing purposes.

If you book a stay, we use your data to organise and manage it: the legal basis is the performance of the contract (Article 6(1)(b) GDPR).

We also use the data needed for tax and accounting documents, because the law requires it (Article 6(1)(c) GDPR).

If you book through Airbnb or Booking.com, those platforms process the booking data as independent controllers, under their own privacy policies.

In the reviews section we show some reviews that guests wrote on Airbnb, on Booking.com or directly for us. Of each we show only the first name of whoever wrote it, the month and year (of the review or, if it was written for us, of the stay), where it comes from (Airbnb, Booking.com or written for us), the title if there is one, and the text, sometimes only an excerpt, with our own translation when it is in another language. On the site, the reviews are visible to anyone who visits it.

We publish them only with the consent of the people who wrote them (Article 6(1)(a) GDPR). You can withdraw it at any time by writing to us, without affecting what was done before you withdrew it: we then remove your review from the site.

Each review stays on the site until its author asks us to remove it.

Some photos on the site show people, who appear with their consent (Article 6(1)(a) GDPR).

If you appear in a photo, you can withdraw your consent at any time by writing to us, without affecting what was done before you withdrew it: we then remove the photo from the site.

We delete enquiry emails that do not lead to a stay within 12 months of the last contact. If you do book, we keep the tax and accounting documents the law requires us to keep for at least 10 years from the last entry (Article 2220 of the Italian Civil Code).

Reviews and photos stay on the site until whoever wrote them or appears in them withdraws their consent.

The site links to Airbnb and Booking.com, to our Instagram and Facebook pages, to the Facebook page of the San Bartolomeo al Mare council’s tourist office and to the Queen Line online cookware shop. Those links take you away from this site: there, the privacy rules of whoever runs them apply.

The link to Queen Line carries a parameter (UTM) that tells the shop you came from casaaroma.eu; it holds nothing that identifies you.

At any time you can ask us for access to your data, its rectification or erasure, restriction of processing and portability (Articles 15–20 GDPR), and you can withdraw any consent you have given us. Just write to info@casaaroma.eu or call 340 9733680.

We make no automated decisions and do no profiling.

You also have the right to lodge a complaint with the Garante per la protezione dei dati personali, the Italian data protection authority (www.garanteprivacy.it).

You can object at any time, on grounds relating to your particular situation, to the processing based on our legitimate interest (Article 21 GDPR): the technical data processed for hosting, the redirect from casaaroma.eu included, and the visit statistics. Just write to us or call us at the contacts given above. We will then stop processing your data for that purpose, unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims.