Tasso 9

Privacy Policy

Privacy Policy – Cookie Policy

Data Controller

Nicoletta Schumeniak – Via Torquato Tasso 9, Borgo di Boccheggiano, Montieri, 58026 Grosseto (GR), Italy.

Owner’s email: nicoletta.schumeniak@gmail.com
Phone: +39 335 6340387

For any clarification, information, or to exercise the rights listed in this notice, you may contact the Data Controller using the details above.

Definitions and legal references

Personal Data (or Data)

Any information that, directly or indirectly, also in combination with any other information, including a personal identification number, allows for the identification or identifiability of a natural person.

Usage Data

Information collected automatically through this Website, including: the IP addresses or domain names of the computers used by Users who connect to this Website, the URI addresses, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s response, the country of origin, the browser and operating system features, the various time details of the visit, and details about the path followed within the Website.

User

The individual using this Website who, unless otherwise specified, coincides with the Data Subject.

Data Subject

The natural person to whom the Personal Data refers.

Data Processor (or Processor)

The natural or legal person, public authority, agency or other body that processes personal data on behalf of the Data Controller, as described in this privacy policy.

Data Controller (or Owner)

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data, including the security measures concerning the operation and use of this Website. The Data Controller, unless otherwise specified, is the owner of this Website.

This Website

The hardware or software tool by which Personal Data of Users is collected and processed.

Service

The service provided by this Website, i.e. the presentation of the Al Tasso 9 accommodation and the handling of information and booking requests.

European Union (or EU)

Unless otherwise specified, all references made within this document to the European Union include all current member states of the European Union and the European Economic Area.

Cookie

Small piece of data stored in the User’s device.

Legal references

This privacy policy relates solely to this Website, and has been prepared to fulfil the requirements set out under several legislations, including Art. 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation).

Types of Data collected

Among the Personal Data collected by this Website, on its own or through third parties, are: Cookies, Usage Data, first name, last name, email address, phone number and the check-in/check-out dates provided in a booking request.

Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically when using this Website.

Unless specified otherwise, all Data requested by this Website is mandatory. If the User refuses to provide such Data, it may be impossible for this Website to provide the Service (e.g. responding to a booking request).

Users are encouraged to contact the Data Controller if they have any doubts about which Data is mandatory.

Any use of Cookies – or of other tracking tools – by this Website or by the owners of third-party services used by this Website serves to provide the Service requested by the User, in addition to the other purposes described in this document and in the Cookie Policy.

Mode and place of processing the Data

Methods of processing

The Data Controller adopts appropriate security measures to prevent unauthorised access, disclosure, modification or unauthorised destruction of Personal Data. Processing is carried out using computers and/or IT-enabled tools, following organisational procedures strictly related to the purposes indicated. External parties carrying out technical maintenance of the Website (e.g. hosting provider, developers) may also have access to the Data, appointed as Data Processors where necessary. An updated list of Processors can always be requested from the Data Controller.

Legal basis of processing

The Data Controller processes Personal Data relating to the User if one of the following applies:

  • Users have given their consent for one or more specific purposes;
  • provision of Data is necessary for the performance of a contract with the User (e.g. handling a booking) and/or for any pre-contractual obligations thereof;
  • processing is necessary for compliance with a legal obligation to which the Data Controller is subject;
  • processing is related to a task carried out in the legitimate interest of the Data Controller or of a third party.

It is always possible to ask the Data Controller to clarify the concrete legal basis of each processing activity.

Place

The Data is processed at the Data Controller’s operating offices and in any other place where the parties involved in the processing are located. Some external services used by this Website (indicated in the relevant sections) may involve a transfer of Data outside the European Union, in particular to the United States. Users have the right to obtain information regarding the legal basis of Data transfers and the security measures adopted, by contacting the Data Controller.

Retention period

Data is processed and stored for as long as required by the purpose it has been collected for:

  • Data collected for purposes related to the performance of a contract (e.g. a booking) shall be retained until such contract has been fully performed, and for the period required by applicable accounting/tax obligations;
  • Data collected for the purposes of the Data Controller’s legitimate interests shall be retained until such interests are fulfilled.

When processing is based on the User’s consent, the Data Controller may retain Personal Data for longer until such consent is withdrawn.

Purposes of processing

User Data is collected to allow the Data Controller to provide its Service, as well as for the following purposes: responding to information and booking requests, interaction with social networks and external platforms, and displaying content from external servers.

Detailed information on the processing of Personal Data

Contacting the User and handling bookings

Contact and booking form (this Website)

By filling in the contact or booking-request form with their own Data (name, email, desired check-in/check-out dates), the User consents to its use to reply to requests for information or availability.

Personal Data collected: first name, last name, email address, requested stay dates.

Interaction with social networks and external platforms

This type of service allows interaction with social networks directly from the pages of this Website. Interactions and information acquired by this Website are always subject to the User’s privacy settings for each social network.

Facebook Page widget (Meta Platforms, Inc.)

The Facebook Page widget, embedded on the Social page of this Website, is a social-network interaction service provided by Meta Platforms, Inc.

Personal Data collected: Cookies and Usage Data.

Place of processing: USA – Meta Privacy Policy.

Instagram feed (Meta Platforms, Inc.)

The Instagram feed, displayed on the Social page of this Website, shows public content from the Data Controller’s Instagram profile through a third-party plugin. Images may be loaded directly from Meta’s servers, which involves sending the User’s IP address to Meta Platforms, Inc.

Personal Data collected: Usage Data.

Place of processing: USA – Meta Privacy Policy.

Displaying content hosted on external servers

This type of service allows fonts or scripts hosted on external servers to be displayed directly from the pages of this Website. Even without any direct action by the User, this involves the transmission of Usage Data (e.g. IP address) to the service provider.

Google Fonts (Google LLC)

Google Fonts is a typeface visualisation service provided by Google LLC that allows this Website to incorporate content of this kind on its pages.

Personal Data collected: Usage Data.

Place of processing: USA – Google Privacy Policy.

Flatpickr (jsDelivr CDN)

The calendar used in the booking form (to select check-in/check-out dates) is based on the open-source Flatpickr library, loaded via the jsDelivr content delivery network (CDN). Loading these files involves sending the User’s IP address to the CDN operator, without installing any profiling cookies.

Personal Data collected: Usage Data.

Place of processing: as per the jsDelivr Privacy Policy.

The rights of Users

Users may exercise certain rights regarding their Data processed by the Data Controller. In particular, Users have the right to do the following:

  • Withdraw their consent at any time.
  • Object to processing of their Data when processing is carried out on a legal basis other than consent.
  • Access their Data and receive a copy of the Data being processed.
  • Verify and request rectification.
  • Restrict the processing of their Data under certain circumstances.
  • Have their Personal Data deleted or otherwise removed.
  • Receive their Data and have it transferred to another controller (data portability).
  • Lodge a complaint with their competent data protection authority (in Italy, the Garante per la Protezione dei Dati Personali) or take legal action.

How to exercise these rights

Any requests to exercise User rights can be directed to the Data Controller through the contact details provided in this document. These requests are free of charge and will be answered by the Data Controller as soon as possible, and always within one month.

Additional information about Data collection and processing

Legal action

The User’s Personal Data may be used by the Data Controller in legal proceedings, or in the preparatory stages thereof, for defence against abuse in the use of this Website by the User.

System logs and maintenance

For operation and maintenance purposes, this Website and any third-party services used may collect system logs, i.e. files that record interactions and may also contain Personal Data, such as the User’s IP address.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be requested from the Data Controller at any time using the contact details provided.

Changes to this privacy policy

The Data Controller reserves the right to make changes to this privacy policy at any time by giving notice to Users on this page. Please check this page regularly, referring to the date of the last modification indicated below.

Last update: 15 July 2026.