Controller and contact details
The data controller is Marco Galluzzo, Cefalù (PA), Italy. For privacy questions or to exercise your rights, use the Email link below.
The form and your communications
The availability form lets you enter optional arrival and departure dates and the number of guests, initially set to two. It has no fields for your name, email address or a free-text message. Entry and validation take place in your browser: this information is not submitted to a website server, and the website does not save it in a database or persistent browser storage.
The Email and WhatsApp buttons let you open a prefilled enquiry in your chosen app or service. Opening it passes the text to that service; the enquiry reaches the property only when you press Send in that app or service. The website does not send messages automatically. Your chosen service handles the text and any drafts under its own settings and privacy notice.
When you send an email, the controller receives its contents, the sender’s address and message metadata. When you send a WhatsApp message, the controller receives its contents and the contact details made available in the conversation. Providing information is voluntary, but without contact details and information about your stay it may be impossible to answer your enquiry. Identity documents, payment details and health information are not needed.
Purposes and legal grounds
Availability enquiries and communications about your stay are handled to take steps at your request before a possible contract, or to perform it: Article 6(1)(b) GDPR.
Website operation and security, abuse prevention and replies to general communications rely on the controller’s legitimate interests in keeping the website available and secure and handling contacts: Article 6(1)(f). Processing required by law relies on Article 6(1)(c).
The controller does not use data relating to this website and enquiries received through it for newsletters, advertising or commercial profiling, or for solely automated decisions with legal or similarly significant effects.
Browsing and Cloudflare
Cloudflare, Inc. hosts and delivers the website. Browsing requests involve processing your IP address and technical information, such as requested resources, times and browser information, to deliver pages and protect the network.
Cloudflare acts as a processor for data handled on the controller’s behalf and as a controller for certain processing described in its own notice. Its privacy policy and data processing agreement explain these roles.
Cookies and external services
The website does not embed visitor analytics, advertising pixels or maps. Fonts are served by the website. The website’s code does not set cookies or use localStorage or sessionStorage to save form data.
Cloudflare protections may use technical cookies, for example to remember a completed security check. Their presence and duration depend on the protections applied; Cloudflare explains their purposes and lifetimes in the documentation below.
When you open an external link, the destination service handles your visit under its own privacy notice. WhatsApp opens only when you choose its link: the website does not embed WhatsApp widgets or tracking tools. A link to a map does not embed that map in this website.
Who may receive data
The controller handles received enquiries. Communications pass through the email or messaging services chosen by the sender and recipient, including WhatsApp when used; browsing data is handled by Cloudflare and its providers in their respective roles.
Data may be disclosed to authorities where required by law and, where necessary, to professional advisers for compliance or the protection of rights. The controller does not publish this data.
Transfers outside the European Economic Area
Cloudflare’s international network may involve processing outside the European Economic Area, including the United States. Its agreement describes the relevant safeguards: the EU–US Data Privacy Framework where applicable, and European Commission standard contractual clauses for transfers requiring them.
You can read the safeguards in the linked agreement or request information using the Email contact in this notice. Your chosen email or messaging services may also process data in other countries under their own privacy notices.
How long data is kept
The website does not retain information entered in the form. Emails and messages actually received are kept for as long as needed to handle the enquiry and related correspondence; if a stay follows, to manage that relationship and applicable obligations. Further retention depends on legal requirements or the need to establish, exercise or defend a legal claim.
Technical data processed on the controller’s behalf is retained in connection with service delivery and the handling of security issues. Cloudflare’s own notice sets out the criteria for processing for which it acts as controller. Drafts and messages in email or messaging apps follow those services’ settings.
Your rights
Use the Email link below to request access, correction, erasure, restriction or, where applicable, data portability. You may object to processing based on legitimate interests on grounds relating to your situation. These rights are subject to the conditions and limits in Articles 15–22 GDPR.
The controller responds without undue delay, normally within one month; any justified extension is communicated within that time. You may complain to the Italian data protection authority, the Garante, or the competent authority where you normally live, work or believe an infringement occurred.
Updates
This notice covers website browsing and the contacts described here. Any new services or processing will be accompanied by the relevant information. The update date appears at the top of this page.