Privacy notice
Updated 24 October 2026
This is a translation of the Italian original, which prevails in case of discrepancy.
This notice explains, pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR), how we process the personal data of people who visit this website or write to us.
1. Data controller
The data controller is Omar Peddio (tax code PDDMFR83B27F979S), based at Via Perdosu de Laccus 14, 09049 Castiadas (SU), who runs Villa Grazia together with Grazia and Lisa.
For any request about your data: info@villagraziacastiadas.it or WhatsApp on +39 340 401 2849.
2. What data we process, why and on what basis
- Requests from the contact form. First and last name, email, arrival and departure dates, number of guests and the text of the message. We use them to reply to you and, if the request goes ahead, to prepare the booking. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). Name and email are necessary in order to reply; without them we cannot receive the request. The other fields are optional.
- WhatsApp messages. If you write to us using the WhatsApp button, your number and messages are also processed by WhatsApp (Meta), which is an independent controller for the service it provides to you. We use the number and text only to reply to you (Art. 6(1)(b)).
- Technical browsing data. Like any website, the server that hosts it receives your IP address, the date and time of the request, the page requested and information about your device. This is needed to make the site work and to protect it from abuse (legitimate interest, Art. 6(1)(f)), for the time strictly necessary.
- Google map. The map loads only if you ask for it or say you accept it. In that case your browser connects to Google (see the cookie policy). Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Personal Data Protection Code (Legislative Decree 196/2003), hereinafter the "Privacy Code"), which you can withdraw at any time.
We do not use profiling or advertising cookies, we do not run visitor statistics and we do not take automated decisions. We do not collect special categories of data: please do not write them in your message.
3. Who we share the data with
- Netlify, Inc. (USA): provider of the website hosting service, as data processor.
- Resend, Inc. (USA): service that sends the form message to our mailbox, as data processor. We do not use its tools for tracking email opens or clicks.
- Mailbox provider to be confirmed where we receive and store requests.
- Advisers (for example the accountant), only if the request becomes a booking and for legal obligations.
- Google, only if you load the map (see above).
The data is never made public or sold.
4. Transfers outside the European Union
Netlify and Resend are based in the United States. The data is transferred with the safeguards provided by Articles 44-46 of the GDPR: the adequacy decision on the EU-US Data Privacy Framework and/or standard contractual clauses approved by the European Commission.
5. How long we keep the data
- Requests that do not lead to a booking: 30 days from the last contact, then we delete them.
- If the request becomes a booking: for the duration of the relationship and then for the periods required by law for accounting and tax documents (10 years, Art. 2220 of the Italian Civil Code).
- Technical browsing data: for the time strictly necessary for the security of the site.
The guest documents required by law at the time of the stay do not pass through this website and are processed under a separate notice handed over on arrival.
6. Your rights
You can ask us at any time for access to your data, rectification, erasure, restriction of processing, portability, and you can object to the processing (Arts. 15-22 GDPR). Where the processing is based on consent, you can withdraw it at any time, without affecting the processing already carried out. Write to info@villagraziacastiadas.it: we reply within one month.
If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the courts.
7. Security
The site uses a secure connection (HTTPS). Requests arrive in a mailbox whose access is restricted to the controller and to those who help with managing bookings.
8. Changes
If the services or the law change, we update this page and the date at the top.