This privacy policy describes how the website www.lafelicina.com manages the personal data of users who consult it and use its services. The information is provided in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR).
The web infrastructure acquires, independently or through external providers, specific categories of personal data, including: first name, last name, email address, phone number, navigation metrics, and tracking identifiers. The user may voluntarily provide such data (e.g., by filling out forms), or they may be automatically generated by network communication protocols during navigation.
Providing data for contractual purposes (e.g., bookings) is a mandatory requirement; failure to provide it will result in the inability to deliver the service. The Controller assumes no responsibility for third-party data published or shared by the user on the site without prior authorization.
The Controller applies strict technical and organizational measures to mitigate the risks of unauthorized access, disclosure, alteration, or destruction of data. Processing is carried out using IT systems, with logic strictly related to the stated purposes. Where necessary, access is granted to authorized internal personnel or external entities formally appointed as Data Processors.
Data processing is based on one of the following legal conditions:
Primary databases reside at the Controller's operating facilities. Some data flows may be routed to servers located outside the European Economic Area (EEA). In such scenarios, the transfer is safeguarded by the adoption of Standard Contractual Clauses (SCCs) or adequacy decisions issued by the European Commission (e.g., Data Privacy Framework).
Records are maintained in the database for the time strictly necessary to fulfill the original purpose. Data linked to commercial transactions are retained in compliance with tax law obligations. Once the legal basis expires or upon a legitimate request, the data will be deleted or irreversibly anonymized.
The infrastructure uses third-party services to ensure operational continuity. The data flow mapping is as follows:
Internal communication forms: Entering data into contact forms authorizes the system to use these details exclusively to process the user's request (quotes, information). Processed data: personal details and contact info.
Booking system: Accommodation data acquisition occurs via applications residing on the local server. Monetary transactions are delegated to external encrypted gateways. The Controller does not process or store credit card numbers.
Google Analytics 4 (Google Ireland Limited): Traffic measurement system with native server-side IP anonymization protocol. Analytical data is used for technical site optimization. Processing location: EU/USA - Privacy Policy.
These services make direct API calls to the provider's servers to render visual elements, resulting in the transmission of the client's IP address.
Individuals to whom the personal data refer hold the rights set out in Articles 15-22 of the GDPR, including:
Technical requests to exercise these rights must be forwarded to the Controller's email address and will be processed within the statutory timeframe (maximum 30 days).
The server infrastructure generates log files (access log and error log) necessary to maintain IT security (e.g., DDoS attack mitigation) and diagnostics. These files record the IP address, timestamp, and user agent, constituting processing based on legitimate interest.
Logs and navigation data may be produced as digital evidence upon explicit request by Judicial Authorities to determine liability in the event of cybercrimes committed against the site.
The current protocols of this site do not decode "Do Not Track" HTTP headers sent by browsers. To control tracking, refer to the cookie preference management panel.
The Controller reserves the right to apply patches and updates to this document to reflect changes in software architecture or legislation. Users are required to monitor the "Last updated" timestamp at the bottom.
Legal Basis: This document is drafted in strict compliance with Articles 13 and 14 of the European Regulation 2016/679 (GDPR).
Last updated: March 21, 2026
