Information and transparency
Privacy Policy
Last updated: 29 September 2026
This notice explains how personal data is processed when users visit the Stella de’ Tolomei website or contact the property through the contact details provided, in accordance with Regulation (EU) 2016/679 (“GDPR”).
Data controller
The data controller is:
Stella de’ Tolomei di Francesca Fusaroli
Via Cammello 11, 44121 Ferrara
VAT No. 02151790389
CIN IT038008B4ABKEKAMQ
Email: info.tolomei@gmail.com
Phone: +39 388 123 1173
Requests concerning personal data protection and the exercise of rights under the GDPR may be sent to info.tolomei@gmail.com.
Data processed while browsing
During normal browsing, IT systems and the hosting service may collect technical data required for the operation and security of the website, such as the IP address, date and time of the request, requested page or resource, technical information about the browser or device, and the outcome of the request.
This data is processed solely to enable the website to function correctly, ensure its security, diagnose technical issues and prevent abusive or unlawful use.
The legal basis is the controller’s legitimate interest in the security, integrity and proper management of the website under Article 6(1)(f) GDPR.
The website is hosted using Hostinger services. The hosting provider may process technical data and connection logs to the extent necessary to provide, secure and manage the service.
Technical logs are retained for the period set by the hosting service configuration and, in any event, no longer than necessary for the technical and security purposes for which they are collected, unless longer retention is required for investigations, security or legal obligations.
Aggregate internal statistics
To assess the usefulness of pages and make direct contact easier, the website counts page views and clicks on WhatsApp, telephone and email links using a proprietary system in the WordPress database. Only the date, page identifier, event type and aggregate total are stored for 730 days. Individual access logs are not retained and unique visitors are not counted; a click does not mean that a booking has been completed.
The system does not record IP addresses, user agents, full URLs, query strings, referring domains or personal identifiers, and does not use analytics cookies, localStorage, sessionStorage or fingerprinting. It does not reconstruct individual journeys or send data to external analytics providers. The dashboard is restricted to authorised administrators. Requests still pass through the website server: hosting technical logs remain a separate processing activity, described above, and are not used to enrich the statistics.
The purpose is to improve the website through aggregate counts not intended to identify visitors. For any transient processing of technical data required to receive these requests, the legal basis is the legitimate interest in managing and optimising the website under Article 6(1)(f) GDPR, with data minimisation and no profiling. Counting is disabled when the browser communicates Do Not Track or Global Privacy Control.
Contact and information requests
The website does not currently include a contact form.
Users may contact Stella de’ Tolomei by telephone, email or WhatsApp using the contact details published on the website.
When a user sends a request, the data processed may include, depending on the channel used, their first and last name, telephone number, email address, message content and any additional information provided voluntarily.
For general information requests, processing is carried out to respond to the communication received and is based on the controller’s legitimate interest in managing user requests under Article 6(1)(f) GDPR.
Where a request concerns availability, a quotation or a possible booking, processing is necessary to take pre-contractual steps requested by the data subject and, subsequently, to perform any resulting contract under Article 6(1)(b) GDPR.
Providing data is voluntary. However, failure to provide the necessary information may make it impossible to respond to the request or manage a booking.
Please do not send documents, special categories of personal data or other information unnecessary for the request by email or WhatsApp, unless expressly required to meet legal obligations.
Bookings and stays
When a request becomes a booking, the necessary data is processed to manage the relationship with the guest, organise the stay, provide the requested services, handle administrative and accounting matters, and comply with obligations applying to accommodation providers.
The legal bases are:
- performance of a contract or pre-contractual steps requested by the data subject;
- compliance with legal obligations to which the controller is subject.
This notice primarily concerns the website and contacts originating from it. Where necessary, specific information may be provided for any further processing carried out in connection with the stay.
Messages sent to info.tolomei@gmail.com are handled through Google’s Gmail service.
When email is used, certain communication data is therefore also processed through the relevant service provider’s infrastructure under its applicable terms and notices.
The website contains links that allow users to voluntarily start a WhatsApp conversation with Stella de’ Tolomei.
WhatsApp is not embedded in the website: the link opens only when the user chooses to use it.
When WhatsApp is used, service usage data is also processed by WhatsApp Ireland Limited under its own privacy notice and terms.
Stella de’ Tolomei processes the content of messages received solely to respond to requests, manage any bookings and carry out activities connected with the stay.
Google Maps
The website contains a simple external link to Google Maps so that users can locate the property.
Google Maps is not embedded in the website and is not loaded automatically during normal browsing.
Only when a user chooses to open the link are they transferred to Google Maps, which processes data under its own privacy notice.
Service providers and data recipients
To the extent necessary for their respective functions, data may be processed by:
- persons authorised by the controller;
- IT and hosting service providers;
- providers of the email and messaging services used;
- administrative, accounting or professional advisers where necessary;
- public bodies and authorities where disclosure is required by law.
Providers process data in accordance with the role applicable to them under data protection law.
Personal data is not sold to third parties.
Transfers outside the European Economic Area
Some IT, email or communication service providers may process data through infrastructure located outside the European Economic Area.
Where applicable, such transfers take place using the instruments provided for in Chapter V GDPR, including European Commission adequacy decisions, standard contractual clauses or other mechanisms recognised by applicable law, in accordance with the conditions adopted by the respective providers.
Retention periods
General information requests that do not lead to a booking are normally retained for no more than 12 months from the last contact, unless longer retention is needed to manage an ongoing request or protect a right.
Data relating to bookings and stays is retained for as long as necessary to manage the relationship and subsequently for the periods required by administrative, accounting, tax or other applicable obligations.
Administrative, accounting and tax records subject to retention obligations are normally retained for 10 years, without prejudice to longer periods required by law or necessary in the event of investigations or disputes.
Data needed to protect a right may be retained until the applicable limitation periods expire or, in the event of a dispute, until it is resolved.
Copies held in backup systems may remain for the normal technical backup rotation and overwrite periods and are not used for additional purposes.
Cookies and tracking technologies
The website’s current configuration does not use profiling tools, behavioural advertising or visitor analytics systems that require the user’s prior consent.
For more information, please read the Cookie Policy.
Marketing communications
Contact details provided for enquiries or bookings are not automatically used to send newsletters or promotional communications.
If marketing activities requiring consent are introduced in future, consent will be requested separately and may be withdrawn at any time.
Automated decision-making and profiling
Data collected through the website and related contact channels is not used for decisions based solely on automated processing or for profiling users.
Data subject rights
Where provided for by the GDPR, data subjects may exercise their rights of access, rectification, erasure, restriction of processing and data portability.
Data subjects may also object to processing based on the controller’s legitimate interest.
Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
Requests may be sent to: info.tolomei@gmail.com
Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
Changes to this notice
This notice may be updated if the ways in which data is processed, the services used by the website or the applicable law change.
The date of the latest update appears at the beginning of the page.