Privacy policy
Draft for review — not yet ready for publication
Last updated: [publication date]
At Ecolodge Selvitelle, we respect your privacy. This policy explains how we handle personal data when you visit our website, contact us, make a booking or stay with us.
1. Who is responsible for your personal data?
The person responsible for the processing described in this policy—the data controller—is:
Linda Gudrun Daube
Operating as Ecolodge Selvitelle
Contrada Selvitelle 6
84053 Cicerale (SA), Italy
Email: info@ecolodgeselvitelle.com
Telephone: +39 346 21 28 788
You can use these contact details for questions about this policy or to exercise your data protection rights.
2. What personal data do we process?
The information we process depends on how you interact with us.
Enquiries and correspondence
When you contact us, we process your name, contact details and the information you include in your message.
We use this information to answer your questions and handle your request. Where your enquiry concerns a possible booking, processing is necessary to take steps at your request before entering into a contract. For other correspondence, we rely on our legitimate interest in responding to people who contact us.
Bookings and stays
When you make a booking, we process the information needed to arrange and provide your stay. This may include:
- your name and contact details;
- arrival and departure dates;
- the accommodation selected and number of guests;
- booking preferences and requests;
- correspondence relating to your reservation;
- payment status and relevant transaction references.
We process this information to enter into and perform our accommodation contract with you.
Legal and administrative obligations
We process the guest identification, stay and administrative information required under applicable Italian law. This may include information needed for public security registration, applicable tourism reporting, taxation and accounting.
The legal basis is compliance with our legal obligations. Where information is legally required, we may be unable to provide accommodation without it.
We do not retain copies of identity documents merely because we are required to register guests. Any copy temporarily obtained for the required registration process must be deleted or destroyed once that purpose has been fulfilled, unless a separate legal requirement applies.
Payments
We process payment amounts, payment status, transaction references and information needed to handle refunds or payment enquiries.
The legal bases are performance of our contract and compliance with applicable accounting and tax obligations.
Website operation and security
Our website and hosting services may process technical information such as IP addresses, browser details, requested pages, timestamps and error information.
We use this information to operate, maintain and protect the website. We rely on our legitimate interest in providing a reliable and secure service. Separate rules apply to storing information on, or accessing information from, your device, as explained in section 5.
3. How do we receive your information?
We receive personal data directly from you when you contact us, book directly or provide information for your stay.
We also receive booking information through Airbnb and Natuurhuisje when you reserve through those platforms. Depending on the booking, this may include your name, contact or platform messaging details, stay dates, number of guests and relevant requests.
We use the information received from these platforms to manage your reservation, communicate with you and provide your stay.
4. Bookings, payments and service providers
Direct bookings
We use VikBooking to manage direct bookings. Our website also uses VikChannelManager for booking-channel functionality.
The presence of these software tools does not mean that every supplier receives all booking data. Any access or data exchange depends on the services and connections actually used.
Payments through Stripe
Our website has a VikStripe integration through which payments may be processed by Stripe.
When you use a Stripe payment method, Stripe processes the payment information required to provide and secure that service. Further information is available in the Stripe Privacy Policy.
[Before publication: confirm the active payment methods and precisely which payment information Selvitelle receives or can access.]
Hosting and email
We use STRATO for website hosting and email services. Personal data contained in website requests, hosted website data and email correspondence may therefore be processed through STRATO’s services.
External booking platforms
Airbnb and Natuurhuisje process personal data for their own platform services under their respective privacy policies. Selvitelle is responsible for its own use of the booking information it receives.
We may also disclose relevant information to professional advisers, accounting service providers and authorised technical service providers where necessary for their work, or to public authorities where required by law.
Where a provider processes personal data on our behalf, the relationship must be governed by appropriate data processing terms. Providers acting as independent controllers are responsible for their own processing.
[Before publication: verify the relevant contracting entities, provider roles and any additional providers that have access to guest or website data.]
5. Cookies, tracking and browser storage
Our website uses cookies and similar technologies for functions such as language selection and maintaining a booking session.
The website also has VikBooking statistics tracking enabled. This can use a persistent identifier to associate visits, referral information and booking-related activity. The identifier may be generated using session information, an IP address and browser information.
[Implementation note—resolve and remove before publication: the technical review on 3 November 2026 found that VikBooking’s statistical tracking could start before the visitor accepted the existing Plaza banner. This policy does not authorise that tracking or replace any consent required by law. The published wording must match the consent mechanism actually implemented.]
The website currently loads fonts from Google Fonts, which causes your browser to connect to Google and disclose technical connection information, including your IP address.
Details of the cookies and storage technologies used, their purposes and their expiry periods will be provided in our [Cookie Policy—insert working link].
[Before publication: add an accessible cookie preferences function if optional tracking is retained. Describe consent and withdrawal only once those functions work.]
6. Newsletters and cameras
We do not currently operate an email newsletter. If we introduce one, we will provide information about the service and its use of personal data before collecting subscriptions.
There is no CCTV or other camera surveillance at Selvitelle.
7. International transfers
Some service providers may process personal data outside the European Economic Area.
Where such transfers take place, an appropriate legal transfer mechanism must apply. Depending on the recipient and destination, this may be an applicable adequacy decision or other safeguards, such as the European Commission’s Standard Contractual Clauses.
[Before publication: verify the actual processing locations and transfer arrangements for the relevant STRATO, Stripe, Airbnb, Natuurhuisje and other service entities. Specify applicable safeguards and how individuals can obtain further information or a copy.]
8. How long do we keep personal data?
We retain personal data only for as long as necessary for the purpose for which it was collected, taking account of legal obligations and any need to establish, exercise or defend legal claims.
Our retention schedule will distinguish between:
| Type of information | Retention period |
|---|---|
| Enquiries that do not lead to a booking | [Confirm period after the enquiry is closed] |
| Booking records and guest correspondence | [Confirm period and starting point] |
| Invoices and accounting records | [Confirm applicable statutory period] |
| Statutory guest registration information and submission receipts | [Confirm applicable requirements for each record type] |
| Website security and technical logs | [Confirm STRATO and website settings] |
| Statistical tracking records | [Confirm server retention and deletion settings] |
| Backups | [Confirm backup cycle and expiry] |
Temporary copies of identity documents used for statutory registration are deleted or destroyed once that purpose has been completed, unless a separate legal requirement applies.
A cookie’s expiry date does not necessarily determine how long associated information remains in server records or backups.
[Complete this schedule and confirm the corresponding deletion practices before publication.]
9. How do we protect personal data?
We use appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and disclosure.
Access should be limited to people and service providers who need the information to perform their responsibilities. The measures used must reflect the nature of the data and the risks involved.
10. Your rights
Depending on the circumstances and applicable legal conditions, you have the right to:
- request access to your personal data;
- have inaccurate or incomplete information corrected;
- request deletion of your data;
- request restriction of processing;
- receive certain data in a portable format;
- object to processing based on legitimate interests.
Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
To make a request, email info@ecolodgeselvitelle.com. We normally respond within one month. Where legally permitted, this period may be extended for complex or multiple requests; we will explain any extension within the initial month.
We may request proportionate additional information where necessary to verify your identity. Some information may need to be retained to comply with legal obligations or handle legal claims.
You may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the competent supervisory authority in the country of your habitual residence, place of work or the alleged infringement.
11. Information you choose to provide
Please avoid sending sensitive information or copies of identity documents through ordinary contact forms or email unless we have explained why the information is needed and how to provide it appropriately.
If a particular requirement may affect your stay, contact us first so that we can discuss what information is necessary.
12. Changes to this policy
We may update this policy when our services, processing activities or legal obligations change. The current version will be available on our website, with its last updated date shown above.