This notice explains how personal data is processed when you visit www.agriturismotassinaia.com and send a contact or booking request, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003. The use of cookies and similar tools is described in our Cookie Policy.
1. Data controller
Via di Montefiesole 66/A, 50065 Pontassieve (FI), Italy
VAT no. 06850470482
Email: agriturismotassinaia@gmail.com • Tel. +39 349 5670429
No Data Protection Officer (DPO) has been appointed, as it is not required. For any question about your personal data, write to the email address above.
2. Personal data we process
Browsing data
The systems that run the website automatically collect some data, such as IP address, browser type and operating system, pages visited, and date and time of the request. This data is needed for the website to work and to keep it secure.
Usage and interaction data (third-party tools)
Through Google Analytics 4, Microsoft Clarity (subject to consent) and Google reCAPTCHA we process usage and interaction data: number of users, session statistics, clicks, keystrokes, mouse movements, scroll position, touch events, device motion sensor events and answers to anti-bot checks. They are described in section 7 and in the Cookie Policy.
Data you provide voluntarily
- Contact form: name, email address and the content of your message.
- Booking form: arrival and departure dates, number of guests, first and last name, email, phone number and any further information you enter in the free-text field.
- Direct communications by email or phone: the data you share on those occasions.
Data collected through cookies
Described in the Cookie Policy. Non-technical tools are activated only after you give consent.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Reply to contact requests and send quotes | Art. 6(1)(b) GDPR – pre-contractual steps taken at your request | 12 months from the last contact, if no booking follows |
| Manage the booking and the stay | Art. 6(1)(b) GDPR – performance of a contract | For the duration of the relationship, then for the legal terms |
| Legal obligations linked to the stay: communication of guest data to public security authorities, tourist tax where due, tax and accounting obligations | Art. 6(1)(c) GDPR – legal obligation | Terms set by law (tax records: 10 years) |
| Website security and abuse prevention | Art. 6(1)(f) GDPR – legitimate interest | Log retention times of the hosting provider |
| Protecting forms from spam and bots (Google reCAPTCHA) | Art. 6(1)(f) GDPR – legitimate interest | According to the provider’s policies |
| Defence of legal claims | Art. 6(1)(f) GDPR – legitimate interest | Until the limitation period expires |
| Non-technical cookies and tools (statistics with Google Analytics 4 and Microsoft Clarity, marketing with Meta Pixel) | Art. 6(1)(a) GDPR and Art. 122 Legislative Decree 196/2003 – consent | See Cookie Policy |
| Special categories of data entered voluntarily | Art. 9(2)(a) GDPR – explicit consent | As long as needed to handle the request and the stay |
4. Nature of the data provision
Fields marked as mandatory in the forms are needed to answer your request or manage the booking: without them we cannot follow up. Other fields are optional. If you stay with us, providing guests’ personal details and identity documents is required by law.
5. How we process data
Data is processed with electronic and, where necessary, paper tools, by authorised persons, with technical and organisational measures suited to protect it from unauthorised access, loss or disclosure. We do not carry out any automated decision-making that produces legal effects on you. Data collected through the forms is not used to send unsolicited marketing communications.
6. Recipients of the data
Data is not disseminated. It may be shared with the following parties, acting as processors or as independent controllers as the case may be:
- Namecheap, Inc., provider of the website building, management and hosting service (Website Builder).
- Google Ireland Limited and Google LLC (United States): email (Gmail), Google Tag Manager, Google Analytics 4 and Google reCAPTCHA.
- Microsoft Ireland Operations Limited and Microsoft Corporation (United States): Microsoft Clarity, only if you have given consent to the Statistics category.
- Public security authorities and other public bodies (for example the Questura, through the Alloggiati Web portal, and the Municipality), where required by law.
- Consultants and professionals in charge of tax, accounting and legal assistance.
- Meta Platforms Ireland Limited for the Meta Pixel described in the Cookie Policy, only if you have given consent.
7. Third-party services
| Service | Company and location | Purpose and data processed | Basis and information |
|---|---|---|---|
| Google Tag Manager | Google Ireland Limited / Google LLC – United States | Central management of the website’s tags and consent signals (Google Consent Mode v2). Usage data. | Sets no cookies. Google privacy policy |
| Google Analytics 4 | Google Ireland Limited / Google LLC – United States | Website statistics. Number of users, session statistics, usage data (with Consent Mode v2: no cookies stored without consent). | Consent. Google Analytics opt-out |
| Microsoft Clarity | Microsoft Ireland Operations Limited / Microsoft Corporation – United States | Website usage statistics, heatmaps and page interaction analysis (with sensitive data masking). | Consent. Microsoft privacy statement |
| Google reCAPTCHA | Google Ireland Limited / Google LLC – United States | Protecting forms from spam and bots. Clicks, keystrokes, mouse movements, scroll position, touch events, motion sensor events, answers to checks. | Legitimate interest. Google privacy policy |
| Meta Pixel | Meta Platforms Ireland Limited – with transfer to Meta Platforms, Inc. (United States) | Campaign measurement and advertising audiences. Pages visited and actions taken on the site. | Consent. Meta privacy policy |
8. Transfers outside the European Economic Area
Some providers, including Google LLC, Microsoft Corporation and Meta Platforms, Inc., are based or have infrastructure in the United States. Transfers take place on the basis of a European Commission adequacy decision (EU–US Data Privacy Framework) for certified recipients or, otherwise, under the standard contractual clauses approved by the European Commission.
9. Your rights
You have the right to obtain at any time:
- access to your data and a copy of it (Art. 15);
- rectification of inaccurate data and completion of incomplete data (Art. 16);
- erasure of your data (Art. 17) and restriction of processing (Art. 18);
- portability of the data you provided, in a structured and readable format (Art. 20);
- objection to processing based on legitimate interest (Art. 21);
- withdrawal of consent, without affecting the lawfulness of processing carried out before.
To exercise your rights write to agriturismotassinaia@gmail.com. We reply within one month of the request; this may be extended by two months for complex cases, with a reasoned notice. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
10. Children
The website is not directed at children under 14 and we do not knowingly collect their data through the forms. If you believe a child has provided us with data, write to us and we will delete it.
11. Changes to this notice
We may update this notice, for example if the law or the services we use change. The version in force is always the one published on this page, with the date of the last update shown at the top.