Controller and contact details
The data controller is Marco Galluzzo, Cefalù (PA), Italy. For privacy questions or to exercise your rights, write to mgalluzzo@rcs.it.
The form and your communications
The form prepares an enquiry containing your name, email address, stay dates, number of guests and optional message. Entry and validation take place in your browser: this information is not submitted to a website server, and the website does not save it in a database or persistent browser storage.
The “Prepare email” button passes the details to the email app or service configured on your device. The message is sent only when you choose to send it there. Your email app and provider may handle or save the draft according to their own settings and privacy notices.
When you send an email, the controller receives its contents, the sender’s address and message metadata. If you call, the controller handles your number and the information you choose to share. Providing information is voluntary, but without contact details and information about your stay it may be impossible to answer your enquiry. The additional message is optional; identity documents, payment details and health information are not needed.
Purposes and legal grounds
Availability enquiries and communications about your stay are handled to take steps at your request before a possible contract, or to perform it: Article 6(1)(b) GDPR.
Website operation and security, abuse prevention and replies to general communications rely on the controller’s legitimate interests in keeping the website available and secure and handling contacts: Article 6(1)(f). Processing required by law relies on Article 6(1)(c).
The controller does not use data relating to this website and enquiries received through it for newsletters, advertising or commercial profiling, or for solely automated decisions with legal or similarly significant effects.
Browsing and Cloudflare
Cloudflare, Inc. hosts and delivers the website. Browsing requests involve processing your IP address and technical information, such as requested resources, times and browser information, to deliver pages and protect the network.
Cloudflare acts as a processor for data handled on the controller’s behalf and as a controller for certain processing described in its own notice. Its privacy policy and data processing agreement explain these roles.
Cookies and external services
The website does not embed visitor analytics, advertising pixels or maps. Fonts are served by the website. The website’s code does not set cookies or use localStorage or sessionStorage to save form data.
Cloudflare protections may use technical cookies, for example to remember a completed security check. Their presence and duration depend on the protections applied; Cloudflare explains their purposes and lifetimes in the documentation below.
When you open an external link, the destination service handles your visit under its own privacy notice. A link to a map does not embed that map in this website.
Who may receive data
The controller handles received enquiries. Communications pass through the email or telephone providers used by the sender and recipient; browsing data is handled by Cloudflare and its providers in their respective roles.
Data may be disclosed to authorities where required by law and, where necessary, to professional advisers for compliance or the protection of rights. The controller does not publish this data.
Transfers outside the European Economic Area
Cloudflare’s international network may involve processing outside the European Economic Area, including the United States. Its agreement describes the relevant safeguards: the EU–US Data Privacy Framework where applicable, and European Commission standard contractual clauses for transfers requiring them.
You can read the safeguards in the linked agreement or request information at mgalluzzo@rcs.it. The email service you choose on your device may also process data in other countries under its own privacy notice.
How long data is kept
The website does not retain information entered in the form. Emails actually received are kept for as long as needed to handle the enquiry and related correspondence; if a stay follows, to manage that relationship and applicable obligations. Further retention depends on legal requirements or the need to establish, exercise or defend a legal claim.
Technical data processed on the controller’s behalf is retained in connection with service delivery and the handling of security issues. Cloudflare’s own notice sets out the criteria for processing for which it acts as controller. Drafts and messages in your email app follow that service’s settings.
Your rights
Write to mgalluzzo@rcs.it to request access, correction, erasure, restriction or, where applicable, data portability. You may object to processing based on legitimate interests on grounds relating to your situation. These rights are subject to the conditions and limits in Articles 15–22 GDPR.
The controller responds without undue delay, normally within one month; any justified extension is communicated within that time. You may complain to the Italian data protection authority, the Garante, or the competent authority where you normally live, work or believe an infringement occurred.
Updates
This notice covers website browsing and the contacts described here. Any new services or processing will be accompanied by the relevant information. The update date appears at the top of this page.