Privacy notice

This notice is given under Articles 13 and 14 of Regulation (EU) 2016/679. It describes what this website collects, why, for how long it is kept, and what you can require us to do about it. It is written to be read rather than to be survived.

Who is responsible

The controller is Tuscany Like – Events & PR, Via Pietro Cuppari 68, 56124 Pisa, PI, VAT 02286590506. Enquiries about this notice, and any request under the rights set out below, go to stay@villacevoli.com.

This site presents Villa Cevoli. The same controller runs the sites for the other houses in the collection, and an enquiry sent from any of them reaches the same people and is handled the same way.

The houses themselves belong to their owners, not to us: we manage them and let them on their behalf. For everything described on this page — this website, your enquiry, the quotation we send you — the controller is the company named above, and the owner sees nothing. That changes only if you book, and it is set out under “who else sees your data” below.

What we collect, and when

Only what you type into the enquiry form, and a small amount of context sent with it. There is no account to create, nothing to log in to, and no profile built about you.

• Your name and email address. Required — without them we cannot reply.
• Your telephone number and country, if you give them. Both optional.
• The dates you are asking about, how many adults and children, and the occasion.
• Anything you write in the message, including any dietary, mobility or access needs you choose to tell us.
• Whether you are bringing a dog, and which optional rooms or extras you ticked.
• The quotation calculated for those dates, so that what you were shown is what we can honour.
• How you arrived: the page you landed on, the site that referred you, any campaign parameters in the link, and which language of the site you were reading.

Your IP address is used for a few seconds to limit how often the form can be submitted from one place, and is held only in the server’s memory for that window. It is not written to our records. If the anti-spam challenge is switched on, your IP address is also sent to Cloudflare for that check and to no one else.

Why, and on what legal basis

• To answer your enquiry and prepare a quotation — Article 6(1)(b), steps taken at your request before a contract. Refusing this data means we cannot reply.
• To keep a record of enquiries that become bookings, and the invoices that follow — Article 6(1)(c), our obligations under Italian tax and accounting law.
• To stop the form being used for spam — Article 6(1)(f), our legitimate interest in a working contact channel.
• To know which pages and which language actually bring enquiries — Article 6(1)(f), our legitimate interest in running the site sensibly. You may object to this on its own, and we will delete that part of the record and keep the rest.

Cookies, analytics and tracking

There are none. This site sets no cookies of any kind, stores nothing in your browser, runs no analytics, loads no fonts, maps, videos or scripts from anyone else, and has no advertising or social pixels. That is why you were not asked to accept anything when you arrived: there was nothing to accept.

If that ever changes, this page changes first and you will be asked properly before any non-essential cookie is set.

Who else sees your data

A short list, and each of them only to the extent they must:

• The company that hosts the site and its database, acting on our instructions under a written agreement.
• The provider that carries the email through which we reply to you.
• Cloudflare, for the anti-spam check described above, if it is switched on.
• Our accountant, where a booking has generated an invoice.
• The owner of the house, but only once you have booked it. An enquiry that does not become a booking is never passed on.

That last one is worth a sentence of its own. The houses belong to their owners and we manage them; when you book, the owner needs what any host needs — who is arriving, when, and how many. From that point they decide for themselves what to do with it and answer for it themselves. Italian law also obliges whoever hosts you to report the identity documents of every guest to the Questura within twenty-four hours of arrival; that is done at check-in, it is not optional for either of us, and it is the one piece of your data neither we nor the owner may decline to hand over.

The cooks, drivers, guides, florists and planners we can introduce you to are not included. Nothing goes to them unless you ask for an introduction, and when you do, we pass only what that person needs. From that moment they decide for themselves what to do with it and answer for it themselves — they are their own controller, not our processor. This is the same line described under what we can arrange: we introduce, they contract with you.

Nothing is sold, rented, or shared for anyone else’s marketing. Not ever, and not in exchange for anything.

Where your data is

On servers within the European Economic Area. If the anti-spam check is in use, Cloudflare processes your IP address under the European Commission’s standard contractual clauses.

How long we keep it

• Enquiries that do not become a booking: 24 months from your last contact with us, then deleted. Long enough to recognise you if you write again about the same summer; not long enough to be a filing cabinet of strangers.
• Bookings, and the invoices that follow them: 10 years, which is the period Italian law requires us to be able to produce them for.
• Messages the spam filter caught: 90 days, so that a real enquiry wrongly caught can be recovered.

Deletion is carried out on a schedule, not when somebody remembers.

What you can require of us

Under Articles 15 to 22 you may ask for a copy of what we hold, have it corrected, have it deleted, have its use restricted, receive it in a portable form, or object to any processing we base on legitimate interest. Write to stay@villacevoli.com and we will answer within one month. There is no charge, and we will not ask you why.

If you think we have handled your data badly, you may complain to the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma — garanteprivacy.it — or to the authority in the country where you live. You do not have to raise it with us first, though we would rather you did.

Guest reviews

The reviews shown on this site were written by guests on the public listing where they stayed, and are reproduced with the first name and the place the writer gave there, exactly as written and never edited. If you wrote one and would rather it did not appear here, write to us and it comes down the same day.

Children

This site is not addressed to children and we ask for nothing from them. Where an enquiry mentions children in the party, that is a number in a booking, not a record about a child.

Changes

If this notice changes materially, the date below changes with it and the previous version is kept so you can see what moved.