This policy explains how we process the personal data of people who visit the Borgo Magliano Garden Resort website and contact us through it, under Regulation (EU) 2016/679 (GDPR).
1. Controller and joint controller
The data controller is Futura Holding srl, Viale Enrico Mattei 7, 61032 Pesaro (PU), Italy, email: marketing@essencehotels.it.
VEGA HOSPITALITY SRL – P.IVA 02781390410, operates the property and is joint controller for booking and stay data. The essence of the arrangement between the joint controllers is available on request at marketing@essencehotels.it.
2. What data we process
- Browsing data: IP address, date and time, requested page, browser. Full technical logs are kept for no more than 72 hours for security and operation; after that only aggregated statistics by country remain, with no cookies and no identification of the visitor.
- Booking and quote requests: name, contact details, dates, number of guests and any other information you enter in the SimpleBooking booking engine or in the website forms. Payments are handled by the booking engine provider: the website does not receive card data.
- Messages: what you write in contact forms, to the Essy virtual assistant or on WhatsApp.
- Newsletter: email, language, date and proof of consent (double opt-in).
- Cookies and similar tools: see the cookie policy.
3. Purposes and legal bases
- Answering requests and managing bookings and stays: pre-contractual measures and performance of the contract (Art. 6(1)(b) GDPR).
- Complying with legal obligations, such as tax and guest registration duties: legal obligation (Art. 6(1)(c)).
- Website security, abuse prevention and cookie-free aggregated statistics: legitimate interest (Art. 6(1)(f)).
- Newsletter and promotional messages: consent (Art. 6(1)(a)), which you can withdraw at any time via the link in every email.
- Statistics and marketing cookies: only with your consent, managed from “Cookie preferences”.
4. Who receives the data
Data are processed by authorised staff of the controller and joint controller and by providers acting as processors: website hosting (servers in the European Union), SimpleBooking (booking engine), Mailchimp by Intuit Inc. (newsletter and contact management), Meta Platforms (WhatsApp, only if you choose to message us) and, only with your consent, Google and Meta for statistics and advertising. We do not sell personal data.
5. Transfers outside the European Union
Some providers (for example Mailchimp, Google, Meta) may process data in the United States. Transfers are based on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.
6. How long we keep data
- Requests without a booking: up to 24 months.
- Bookings and tax records: for the period required by law (usually 10 years).
- Newsletter: until consent is withdrawn.
- Full technical logs: no more than 72 hours.
7. Your rights
You can request access to your data, rectification, erasure, restriction, portability, and object to processing based on legitimate interest by writing to marketing@essencehotels.it. You can withdraw any consent at any time, without affecting processing already carried out. You have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of your country of residence.
8. Other information
Providing the data requested in the forms is necessary to answer or to book; without it we cannot follow up on your request. No data protection officer (DPO) has been appointed. We do not make decisions based solely on automated processing. This policy may be updated: the date at the top shows the latest version.