Privacy Policy

Notice pursuant to artt. 13-14 GDPR · Last updated: April 2026

1. Data controller

The controller of the personal data collected through this website is:

Francesco Marasco
as owner of Podere Ovosodo
Via Le Pergole 12, 50032 Borgo San Lorenzo (FI), Italy
Contact email: ciao@podereovosodo.com

As this is a non-business tourist rental, no Data Protection Officer (DPO) is appointed; all requests concerning data processing can be directed to the email address above.

2. What data we process

2.1 Browsing data

The site podereovosodo.com is a static site hosted on Ionos infrastructure. When you visit the site, the Ionos web server automatically logs certain technical information necessary for the operation of the service (system logs):

• IP address of the connecting device
• Date and time of the request
• Requested URL
• HTTP status code of the response
• User agent (browser type and version, operating system)
• Referrer (originating page, where available)

This data is used exclusively for technical, security and diagnostic purposes in case of errors. It is not used to profile visitors or for marketing purposes.

2.2 Data provided voluntarily by email

If you write to us at ciao@podereovosodo.com (or reply to one of the site's CTAs that opens a new email), we process the data you decide to share with us: name, email address, content of the message, and — if you choose to provide them — any additional information such as stay dates, number of guests, preferences.

2.3 Cookies and similar technologies

The site uses technical cookies only, which do not require prior consent under article 122 of the Italian Privacy Code (Legislative Decree 196/2003) and the Italian Data Protection Authority's Guidelines of 10 June 2021. For details, see the Cookie Policy.

2.4 Data provided when booking

Bookings are made through the platforms Airbnb and Booking.com. The data necessary for the booking is processed in the first instance by the respective platforms, which act as autonomous data controllers until the data is transferred to us. At that point we become the controller for the data of the actual stay guests only.

2.5 Data collected at check-in

At check-in — as required by Italian law (Consolidated Public Security Act, art. 109 T.U.L.P.S.) — we collect from each guest:

• First name, last name, date and place of birth
• Citizenship
• Identity document details
• Arrival and departure dates

This data is transmitted to the Italian State Police's Portale Alloggiati within 24 hours of arrival, as required by law.

3. Purposes and legal basis of processing

4. Data retention periods

• Web server logs: kept by Ionos according to their standard technical policy (approximately 7-30 days, for security purposes).
• Emails received and sent at ciao@podereovosodo.com: kept for up to 2 years from the last communication, unless you request earlier deletion.
• Booking and stay data: 10 years for tax and civil obligations (artt. 2220 of the Italian Civil Code; art. 22 of Italian Presidential Decree 600/1973).
• Data communicated to the Portale Alloggiati: transmitted to the Italian State Police and retained by them according to applicable law. We keep a local copy only for the time strictly necessary to verify that the communication took place.

5. Recipients and categories of recipients

Your data may be communicated to third parties only where necessary for the purposes set out above, in particular to:

• Ionos SE (hosting of the website and email) — based in Germany, acting as data processor
• Airbnb Ireland UC and Booking.com B.V. — autonomous controllers for their respective booking platforms
• Google LLC (Gmail service via IMAP, used to read the inbox ciao@podereovosodo.com) — acting as data processor
• Italian State Police — Portale Alloggiati Web, by legal obligation
• Municipality of Borgo San Lorenzo / Unione Montana Mugello — tourist tax portal, by legal obligation
• Italian Revenue Agency (Agenzia delle Entrate) — for tax compliance
• Accountant (if appointed) — for bookkeeping

Data will never be disseminated or sold to third parties for marketing purposes.

6. Transfers of data outside the European Union

Some of the recipients listed above (in particular Airbnb and Google) may process data outside the European Economic Area. Such transfers take place in compliance with the safeguards provided by the GDPR, in particular through:

• Adequacy decisions by the European Commission, where applicable;
• Standard contractual clauses approved by the European Commission;
• Certifications such as the EU-US Data Privacy Framework, where the providers have adhered to it.

7. Your rights

As data subjects, you may exercise at any time the rights set out in articles 15-22 of the GDPR, in particular:

• Access to your personal data (art. 15)
• Rectification of inaccurate data (art. 16)
• Erasure ("right to be forgotten"), in the cases provided for (art. 17)
• Restriction of processing (art. 18)
• Portability of the data provided (art. 20)
• Objection to processing based on legitimate interest (art. 21)

To exercise these rights, write to ciao@podereovosodo.com. We will reply within 30 days of receipt.

8. Complaints to the supervisory authority

If you believe that the processing of your data violates applicable law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) — the supervisory authority of the country where the data controller is established (Piazza Venezia 11, 00187 Rome, Italy — www.gpdp.it).

9. Changes to this notice

We reserve the right to update this notice in case of regulatory changes or substantial changes to processing. Any update will be published on this page, with the new "last updated" date shown at the top.