Privacy Policy

Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) – last updated: 7 October 2026

This policy explains how we process the personal data of users who visit www.villadisorrento.it, send us an enquiry or book a stay at our property.

1. Data controller

Hotel Villa di Sorrento
Viale Enrico Caruso 6/8 – 80067 Sorrento (NA), Italy
VAT no. 01291811212
Email: info@villadisorrento.it – Tel. +39 081 8781068

2. Data we process

Browsing data

The systems running this website collect, during normal operation, some data whose transmission is implicit in the use of Internet protocols: IP address, browser type and operating system, requested pages, time of the request and server response code. This data is used to keep the website working and secure and is kept only for as long as strictly necessary, unless needed to investigate crimes.

Data you provide

When you fill in the “Information request” form, email us, message us on WhatsApp or call us, we process the data you give us: name, email, phone number, dates of stay, number of guests and the content of your message. If you have accepted marketing cookies, the form also records the campaign and page you came from.

Booking and stay data

To manage bookings and stays we process the guests' personal details, contact and payment details, identity document data and any special requests you share with us (for example dietary needs).

Cookies

For the cookies and similar technologies used on this website please see our Cookie Policy.

3. Purposes and legal bases

• Answering enquiries and quote requests – pre-contractual measures taken at your request (Art. 6.1.b GDPR).
• Managing your booking and stay – performance of a contract (Art. 6.1.b GDPR).
• Complying with legal obligations: reporting guests' details to the Italian police (Art. 109 TULPS, Alloggiati Web), tourist tax, tax and accounting obligations – legal obligation (Art. 6.1.c GDPR).
• Website security and spam protection of forms (Google reCAPTCHA) – legitimate interest (Art. 6.1.f GDPR).
• Measuring the effectiveness of promotional campaigns through marketing cookies – consent (Art. 6.1.a GDPR), which you can withdraw at any time.
• Displaying external content such as Google Maps – consent (Art. 6.1.a GDPR).
• Defending our rights in legal proceedings – legitimate interest (Art. 6.1.f GDPR).

Fields marked as mandatory in our forms are needed to answer your request or complete your booking; without them we cannot proceed.

4. How we process and keep data

Data is processed electronically and on paper by authorised staff, with security measures designed to prevent loss, misuse or unauthorised access. We keep it only as long as needed:

• enquiries not followed by a booking: up to 24 months from the last contact;
• booking, stay and invoicing data: 10 years, as required by Italian civil and tax law;
• cookies: for the duration stated in the Cookie Policy.

5. Recipients

Where necessary, data may be shared with parties acting as processors or as independent controllers:

• Aruba S.p.A. (Italy) – website and email hosting;
• Mdaweb – website development and technical maintenance;
• RoomCloud – online booking engine (booking.roomcloud.net), where you are redirected when you book;
• Google Ireland Ltd. – reCAPTCHA and Google Maps;
• WhatsApp Ireland Ltd. / Meta – if you choose to contact us on WhatsApp;
• banks and payment providers, accountants and advisers, police and public authorities where required by law.

Data is never published or sold to third parties.

6. Transfers outside the European Union

Some providers (for example Google and Meta) may process data in the United States. Such transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework or, alternatively, on the Standard Contractual Clauses approved by the Commission.

7. Your rights

You can exercise your rights under Articles 15–22 GDPR at any time: access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and withdrawal of consent without affecting the lawfulness of processing carried out before withdrawal. To do so, write to info@villadisorrento.it.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

You can change your cookie consent from Cookie settings, a link also available in the footer of every page.

8. Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects on you.

9. Links to third-party websites

This website links to external sites (Facebook, Instagram, Tripadvisor, RoomCloud, WhatsApp and others). We are not responsible for their content or for how they process data: please read their privacy policies.

10. Changes

We may update this policy, for example to reflect new legislation. The date of the latest update is shown at the top of this page.