Information provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree 196/2003 (“Privacy Code”) as amended by Legislative Decree 101/2018, and the Italian Data Protection Authority’s Guidelines on cookies and other tracking tools of 10 June 2021.
Last updated: 12 November 2026
1. Data controller
Immobiliare Turistcasa di Stefania Boido
Via Roma, 2 – 04027 Ponza (LT), Italy
VAT no. IT01533470595
Phone: +39 0771 809886
Email: turistcasa@turistcasa.it
If you have any questions about this policy or your data, please write to the email address above.
2. What data we process and why
2.1 Browsing the website
When you visit the website, the server automatically records some technical data: IP address, date and time of the request, page requested, response code, referring site, browser type and operating system.
- Purpose: running the website, keeping it secure, detecting and blocking abuse and cyber attacks.
- Legal basis: the controller’s legitimate interest in the security and proper functioning of the website (Art. 6(1)(f) GDPR).
- Retention: server logs are kept for a maximum of 30 days, unless they are needed to investigate offences at the request of the authorities.
To protect the website from unauthorised access and automated spam, the IP address is also used in encrypted (hashed) form to limit repeated attempts: this data is deleted automatically after 15 minutes (restricted login area) or 60 minutes (contact form).
The website does not use analytics or profiling tools and does not track visitors’ behaviour.
2.2 Information requests (contact form, email, phone)
If you contact us through the form on the Contacts page, by email or by phone, we process the data you provide: first and last name, email address, phone number (optional), dates of stay and number of guests (optional), the text of your message and the language of the website you used.
- Purpose: answering your request and providing the information or quotes you asked for.
- Legal basis: taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
- Provision of data: fields marked as required are necessary for us to reply; without them we cannot handle your request. The other fields are optional.
- Retention: the copy of the request stored on the website is deleted automatically 12 months after it is received. Email correspondence is kept for as long as needed to handle the request; if it leads to a contract (for example a booking), the necessary data is kept for the duration of the relationship and for the following 10 years required by Italian civil and tax law (Art. 2220 of the Civil Code).
Data sent through the contact form is not used for newsletters, promotions or other marketing communications.
2.3 Map on the Contacts page (OpenStreetMap)
The Contacts page shows a map provided by the OpenStreetMap Foundation (United Kingdom). To display it, your browser connects to OpenStreetMap’s servers, which receive your IP address and the technical data of the request. The map does not set any cookies.
- Purpose: showing you where we are.
- Legal basis: the controller’s legitimate interest in clearly presenting its location (Art. 6(1)(f) GDPR).
- Transfer: the United Kingdom is covered by an adequacy decision of the European Commission (Art. 45 GDPR), renewed on 19 December 2025 and valid until 27 December 2031.
OpenStreetMap Foundation privacy policy: osmfoundation.org/wiki/Privacy_Policy.
2.4 Bookings and links to other websites
The website contains simple links to other websites: the booking platform booking.ponzaviaggi.it, excursion booking services (for example FareHarbor), ferry companies and our Facebook and Instagram pages. No data is sent to these websites until you click a link: the website does not use “Like” buttons, social plugins or embedded third-party content. Any data you enter on other websites is processed according to their own privacy policies.
3. Recipients of the data
Data is processed by the controller and authorised staff. It may also be processed, exclusively on our behalf and under a contract pursuant to Art. 28 GDPR, by the providers of our website hosting, email and technical support services. Data may be disclosed to the competent authorities where required by law.
Data is never published or sold to third parties.
4. Transfers of data outside the European Union
Data is processed within the European Union. The only exception is the map described in section 2.3 (United Kingdom, a country covered by an adequacy decision).
5. Cookies
Cookies are small text files that a website stores in your browser. This website uses only technical cookies that are necessary for it to work: it does not use profiling, analytics or third-party cookies. For this reason, as provided by the Italian Data Protection Authority’s Guidelines of 10 June 2021, no consent is required and the website does not show a cookie banner.
| Cookie | Purpose | Duration |
|---|---|---|
| pll_language | Remembers the website language you chose. | 12 months |
| wordpress_test_cookie, wordpress_logged_in_*, wordpress_sec_* | Only for administrators who log in to the restricted area: they verify the login and keep the session. | Until the browser is closed or up to 14 days |
You can delete or block cookies at any time in your browser settings; the website will keep working but may not remember the language you chose.
6. Automated decision-making
We do not take decisions based solely on automated processing, including profiling (Art. 22 GDPR).
7. Your rights
At any time you can ask the controller for:
- access to your data and a copy of it (Art. 15 GDPR);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure of your data (Art. 17);
- restriction of processing (Art. 18);
- portability of the data you provided to us (Art. 20);
- to object to processing based on legitimate interest (Art. 21).
To exercise your rights, write to turistcasa@turistcasa.it. We will reply within one month of your request.
If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.
8. Security
We take appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), regular software updates, a restricted login area protected against repeated attempts, and retention of data only for as long as necessary.
9. Changes to this policy
This policy may be updated, for example if the website or the law changes. The date of the last update is shown at the top of the page.