← Back to home

Privacy Policy

Last updated: 17/06/2026

This Privacy Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 ("Italian Privacy Code"), in compliance with the guidelines issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali).

It describes how personal data of users browsing villairenelanghe.com (the "Site") are processed. The Site is an informational website dedicated to the short-term rental of Villa Irene Langhe, located in Monforte d'Alba (CN), Italy.

1. Data Controller

The Data Controller is:
Luca Massaro
Viale Matteotti 13, 10048 Vinovo (TO), Italy
Italian Tax Code: MSSLCU74T11L219C
Email: lucamassaro@icloud.com
For any request regarding the processing of personal data or the exercise of GDPR rights, users may contact the Controller directly using the details above.

2. Categories of data processed

The Site is informational and does not provide registration, user accounts or online purchases. The personal data processed are exclusively those voluntarily provided by the user through the available contact channels:
  • email;
  • telephone;
  • WhatsApp.
Data typically processed include: first and last name, email address, telephone number, requested stay dates, number of guests, and any further information the user freely chooses to share.
The Site does not use any traffic analytics or session replay tool. Only strictly necessary technical cookies are used; pursuant to the Italian Garante's decision of 10 June 2021, these do not require prior consent.

3. Purposes and legal basis of processing

Personal data provided via the contact channels are processed solely for the following purposes:
  • responding to information requests;
  • handling booking and availability requests;
  • communicating with the user in relation to the requested stay.
The legal basis is the performance of pre-contractual measures taken at the data subject's request pursuant to Article 6(1)(b) GDPR. Providing the data is optional, but refusal makes it impossible to fulfil the request.

4. Methods of processing

Data are processed using electronic and paper-based means, with technical and organisational measures adequate to ensure security, integrity and confidentiality, in accordance with Article 32 GDPR. No automated decision-making or profiling is performed.

5. Data retention

Personal data collected via contact channels are retained for 24 months from the last communication with the user, unless longer retention is required by law (e.g. tax and accounting obligations). After this period, data are deleted or anonymised.

6. Recipients and third-party services

Personal data are not disclosed publicly nor sold to third parties for commercial purposes. They may be shared with parties providing services to the Controller, duly appointed as Data Processors under Article 28 GDPR. In particular:
  • Netlify, Inc. (USA) — provider of the hosting and CDN infrastructure on which the Site is hosted, appointed as Data Processor under Article 28 GDPR.
The Site uses or enables interaction with the following third-party services, which may collect browsing data and install their own cookies when the user interacts with them:
  • WhatsApp (Meta Platforms Ireland Ltd.) — messaging;
  • Google Maps (Google Ireland Ltd.) — map display;
  • YouTube (Google Ireland Ltd.) — embedded videos;
  • Instagram (Meta Platforms Ireland Ltd.) — embedded content or profile links;
  • Facebook (Meta Platforms Ireland Ltd.) — embedded content or page links.
These providers act as independent data controllers for the data collected through their own technologies. Users are invited to consult their respective privacy policies.

7. Transfers of data outside the European Union

Some of the services listed above are provided by US-based groups (Meta, Google, Netlify, Inc.) and may involve the transfer of personal data outside the European Economic Area, in particular to the United States.
Such transfers take place on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission pursuant to Article 46(2)(c) GDPR and/or, where applicable, the EU-US Data Privacy Framework (the actual mechanism applicable to each provider is to be verified case by case), ensuring a level of data protection adequate to that required by the GDPR.

8. Rights of the data subject

Pursuant to Articles 15 to 22 GDPR, the data subject has the right to:
  • access their personal data (Art. 15);
  • rectification of inaccurate or incomplete data (Art. 16);
  • erasure ("right to be forgotten", Art. 17);
  • restriction of processing (Art. 18);
  • data portability (Art. 20);
  • object to processing (Art. 21);
  • not be subject to automated decision-making, including profiling (Art. 22).
Rights can be exercised at any time by writing to: lucamassaro@icloud.com. A response will be provided within one month of receipt of the request, except for extensions allowed by the GDPR.

9. Right to lodge a complaint

If the data subject believes that the processing of their personal data infringes the GDPR, they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, Italy — www.garanteprivacy.it — or to seek judicial remedy.

10. Addition of further tools in the future

At present the Site does not use any statistical analysis tool (e.g. Google Analytics), session replay tool or marketing tool (e.g. advertising pixels, retargeting). Should such tools be introduced in the future, they will be activated only upon the user's free, specific, informed and unambiguous consent, collected through a cookie banner compliant with the Italian Garante's guidelines, and this Privacy Policy will be promptly updated.

11. Changes to this Privacy Policy

The Controller reserves the right to modify this Privacy Policy at any time, providing notice through publication of the updated version on the Site. Users are invited to review this page regularly.