Privacy Policy

Last updated: 2025

Privacy Policy – Ourplaces.it

This Privacy Policy is provided pursuant to Article 13 of EU Regulation 2016/679 (GDPR) and the Italian Privacy Code (Legislative Decree no. 196/2003, as amended). It describes how Ourplaces.it collects, uses, stores, and protects the personal data of users who visit the website or submit information through its contact and booking forms.

We collect only what is strictly necessary to provide our service. We never sell your personal data to third parties. You can request deletion of your data at any time by contacting us.

1. Data Controller

The Data Controller responsible for processing your personal data is:

2. Types of Personal Data Collected

We collect the following categories of personal data, depending on how you interact with our website:

  • Contact form: name, surname, email address, phone number, and any message you choose to send us.
  • Booking enquiry form: name, surname, email address, phone number, desired dates of stay, number of guests, and any special requests.
  • Newsletter subscription: email address submitted voluntarily through the subscription form.
  • Browsing data: IP address, browser type, pages visited, and timestamps — collected automatically by server systems as an inherent part of standard internet communication protocols. This data is not linked to identifiable individuals unless required for security purposes.

3. Purposes and Legal Basis of Processing

  • Responding to contact and enquiry requests — to reply to messages sent through the contact form and provide information about our apartments (legal basis: pre-contractual measures and legitimate interest — Art. 6(1)(b) and (f) GDPR).
  • Managing apartment bookings — to process booking requests, send confirmations, reminders, and any post-stay communications related to your stay (legal basis: performance of a contract — Art. 6(1)(b) GDPR).
  • Newsletter and promotional communications — only sent to users who have expressly subscribed. You may unsubscribe at any time using the link in any email or by contacting us directly (legal basis: consent — Art. 6(1)(a) GDPR).
  • Compliance with legal obligations — where required by applicable law, including tax and accounting obligations (legal basis: legal obligation — Art. 6(1)(c) GDPR).
  • Website security and technical functioning — to maintain the security and correct operation of the website (legal basis: legitimate interest — Art. 6(1)(f) GDPR).

4. Data Retention

  • Contact and enquiry data is retained for up to 24 months from the date of last contact, unless a booking is completed.
  • Booking data is retained for up to 10 years to comply with Italian tax and accounting obligations.
  • Newsletter subscriber data is retained until you unsubscribe.
  • Browsing data is retained for a maximum of 12 months for security and analytical purposes.

5. Data Sharing

Your personal data will not be sold or disclosed to third parties for commercial purposes. It may be shared only with:

  • Hosting and IT infrastructure providers (Aruba S.p.A., Italy), acting as Data Processors under Art. 28 GDPR.
  • Email delivery service providers used for contact form processing and newsletters, bound by appropriate data processing agreements.
  • Public authorities, only when legally required.

6. Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you (Art. 15).
  • Rectify any inaccurate or incomplete data (Art. 16).
  • Erase your data ("right to be forgotten") where no overriding legal obligation applies (Art. 17).
  • Restrict processing in certain circumstances (Art. 18).
  • Object to processing based on legitimate interest (Art. 21).
  • Receive your data in a portable format (Art. 20).
  • Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at info@ourplaces.it. We will respond within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

7. Security

We adopt appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our website is hosted on Aruba's servers, located in Italy.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page indicates when it was last revised. We encourage you to review this page periodically.

For any questions about this policy, please visit our Contact page.