Privacy Policy

Data Controller

The data controller responsible for your personal data is Villa OTIUM, Ugento (LE), Italy. For any question regarding this policy or your personal data, you can contact us at info@villa-otium.it.

Personal data we collect

We collect only the data necessary to manage your booking and to comply with our legal obligations. Depending on how you interact with us, this may include:

• Identity and contact details: first name, last name, email address, telephone number and postal address.
• Codice fiscale (Italian tax code) or equivalent identification details, which we are legally required to collect for the mandatory registration of guests with the public authorities.
• Booking information: arrival and departure dates, number of guests and any preferences or notes you provide.
• Payment-related information: we receive confirmation of payment status from our payment processor. We never collect or store your full card number, CVC or other raw card data.
• Communications: the content of messages you send to our concierge chatbot or by email, and our replies.
• Technical data: limited technical information (such as your IP address and basic log data) generated automatically when you use the website, used for security and to keep the site running.

Purposes and legal bases

We process your personal data for the following purposes and on the following legal bases under Article 6 GDPR:

• Managing your booking — to take, confirm and administer your reservation, including pre-stay and post-stay communication (performance of a contract, Art. 6(1)(b)).
• Processing payments — to collect the deposit, balance and refundable security deposit and to prevent fraud (performance of a contract and legitimate interest, Art. 6(1)(b) and (f)).
• Legal obligations — to register guests with the competent authorities, to issue invoices and to meet tax and accounting requirements (legal obligation, Art. 6(1)(c)).
• Communication and support — to answer your enquiries and operate the concierge chatbot (performance of a contract and legitimate interest, Art. 6(1)(b) and (f)).
• Security — to protect the website and our guests against fraud and misuse (legitimate interest, Art. 6(1)(f)).

Who we share your data with

We do not sell your personal data. We share it only with trusted service providers who act on our behalf as data processors, and with public authorities where required by law. Specifically:

• Stripe — our payment processor. When you pay, you are redirected to Stripe's secure hosted checkout; card details are entered directly with Stripe and are never transmitted to or stored by us. Stripe processes your name, email and payment data to complete the transaction.
• Anthropic (Claude) — provides the AI model that powers our concierge chatbot. The messages you send to the chatbot are transmitted to Anthropic to generate a response. Please avoid entering sensitive personal data into the chatbot.
• Our hosting provider — hosts the website and the booking database on secure servers on our behalf.
• Our email provider — delivers transactional and booking-related emails on our behalf.
• Public authorities — the local police/accommodation authorities and tax authorities, where we are legally required to report guest stays or financial information.

How data is disclosed

Data is disclosed to these recipients electronically, over encrypted connections (HTTPS/TLS), through the secure interfaces (APIs) provided by each service. Each processor is bound by a data processing agreement that limits the use of your data to the services they provide to us.

International data transfers

Some of our processors (such as Stripe and Anthropic) are established in or process data in the United States. Where personal data is transferred outside the European Economic Area, the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses, so that your data continues to enjoy an adequate level of protection.

Data retention

We keep your personal data only for as long as necessary for the purposes described above; when it is no longer required, it is securely deleted or anonymised:

• Booking and contact data is kept for the duration of your stay and afterwards for the period required to manage the relationship and any complaints.
• Accounting, tax and invoicing records, and the mandatory guest-registration data, are retained for the period required by Italian law (generally up to 10 years for accounting records).
• Chatbot and email correspondence is kept for as long as needed to handle your request and our legitimate interests, after which it is deleted or anonymised.

Security

We apply appropriate technical and organisational measures to protect your data, including: encryption of data in transit using HTTPS/TLS; not storing raw payment card data on our systems (card data is handled exclusively by Stripe); access controls limiting access to personal data to authorised persons; and regular review of our security practices. No system can be guaranteed to be completely secure, but we work to protect your data against unauthorised access, loss or misuse.

Your rights

Under the GDPR you have the following rights in relation to your personal data:

• Right of access — to obtain confirmation of whether we process your data and a copy of it.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to ask us to delete your data where there is no overriding legal reason to keep it.
• Right to restriction and to object — to limit or object to certain processing, including processing based on our legitimate interests.
• Right to data portability — to receive the data you provided in a structured, commonly used, machine-readable format.
• Right to withdraw consent — where processing is based on consent, at any time, without affecting prior processing.
• Right to lodge a complaint — with a supervisory authority, in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it), or the authority in your country of residence.

To exercise any of these rights, contact us at info@villa-otium.it. We will respond within the time limits set by the GDPR.

Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on this page, with the date of the last update shown above.

Contact

For any question about this Privacy Policy or the way we handle your personal data, please contact the data controller at info@villa-otium.it or by post at Villa OTIUM, Ugento (LE), Italy.