Privacy and Cookie Policy

Data Controller

The Data Controller for data collected through this website is Gianluca Borgarelli, who runs The Lodge Umbria, Strada dei Loggi, 137, 06135 Perugia (PG), Italy · VAT No. 03955370543.

Identification codes of the two units: The Loft (Sub. 10): CIN IT054039C21B036901, CIR 054039C21B036901; Ground Floor (Sub. 5): CIN IT054039C21A036901, CIR 054039C21A036901.

For any request concerning the processing of your personal data, you can write to info@thelodgeumbria.it or call +39 335 736 7719.

What Data We Collect

We collect the data you voluntarily provide by filling in the contact and booking/event request forms on the site: name, email, phone, dates of stay or event, number of guests and any preferences noted in the message.

The “Check Availability” form redirects to the Kuborental Experience (Kross Booking) booking engine, a third-party service that acts as an independent controller for the data entered directly on its platform: we invite you to review its privacy notice before completing a booking.

The “Request Information” (events) and “Booking Request” forms send the submitted data to a dedicated email address via Resend, the third-party service we use for technical email delivery: Resend receives and processes the form data (name, email, phone, dates, message) solely to deliver it to us, acting as a data processor on our behalf (Art. 28 GDPR). Resend does not use the data for its own purposes.

Providing your data is optional, but your name and email are required to answer your request: without them we cannot follow up. Phone and other details are optional.

Browsing data and hosting

The website is hosted by Vercel Inc. (hosting provider), which automatically processes technical browsing data in order to serve the pages: IP address, date and time of the request, page requested, browser and operating system. This data is necessary for the operation and security of the website (Art. 6.1.f GDPR), is not used to identify or profile you, and is kept for a limited period in the provider's technical logs.

Vercel acts as a data processor on our behalf (Art. 28 GDPR). The website does not use analytics, tracking or advertising tools.

The interactive map at the bottom of the Home page is provided by Google (Google Ireland Ltd / Google LLC), acting as an independent controller: it loads only if you choose to view it, and from that moment Google may collect technical data (including your IP address) under its own privacy policy, including transfers to the United States.

Purposes and Legal Basis of Processing

The data collected are used solely to answer information requests, manage bookings and event requests, and communicate with you about your stay. The legal basis is the performance of pre-contractual measures or of a contract to which you are a party (Art. 6(1)(b) GDPR) and, for technical browsing data, our legitimate interest in the operation and security of the website (Art. 6(1)(f) GDPR).

We do not send promotional communications, we do not use your data for purposes other than those stated, and we do not share it with third parties for marketing. We carry out no automated decision-making or profiling.

Data Retention

Information requests that do not result in a booking are kept for up to 12 months from receipt and then deleted.

Data relating to confirmed bookings are kept for as long as needed to manage the stay and, for tax and accounting records, for 10 years as required by Italian law (Art. 2220 of the Civil Code).

Transfers of data outside the European Union

Some of the providers we use — Vercel (hosting) and Resend (delivery of form emails) — are based in the United States. Data is transferred on the basis of the European Commission's adequacy decision on the EU-US Data Privacy Framework or, failing that, the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR).

Your Rights

As a data subject you have the right, at any time, to request access to your personal data, its rectification or erasure, restriction of processing and data portability, and to object to processing based on legitimate interest (Arts. 15-22 GDPR).

You can exercise these rights by writing to info@thelodgeumbria.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or with the supervisory authority of your country of residence.