Privacy & data protection
Privacy Policy
Last updated 15 September 2026
This notice explains how CASAL DEI FICHI S.R.L., trading as Casal dei Fichi, processes personal data when you use Casal dei Fichi, contact us, request or make a booking, or complete the guest check-in information required for a stay.
1. Personal data we process
Website use and security
When you visit the website, our hosting infrastructure and technical services may process ordinary connection and log information such as IP address, date and time, requested page, browser/device information, referring page, security events and error information. We use this to deliver and secure the website, diagnose faults and prevent abuse.
Contact enquiries
If you contact us through the website or by email, we process the information you provide, such as your name, email address and message, so that we can answer your enquiry and take any requested pre-contractual steps.
Direct booking requests
For a direct booking request, we process the stay dates, apartment, number of guests, quoted/booking price information, your name and email address, and any optional phone number or notes you choose to provide. No payment card details are collected on the website booking form.
Guest check-in and statutory accommodation records
For guests who stay with us, we process the identification details required for accommodation, public-security and tourism/statistical reporting. Depending on the guest and reporting requirement, this can include name, sex, date and place/country of birth, nationality, city/country of residence, document type and number, and the country/city that issued the identity document.
Bookings originating from third-party platforms
If your stay originates from an online travel platform such as Booking.com or Airbnb, we may receive booking identifiers, stay dates, guest/party information and contact information made available to us through that platform or its calendar/booking feeds.
Cookie and preference information
We store your cookie/privacy choice and may use strictly necessary cookies or browser storage for security, sessions and website functionality. Optional external services are disabled by default and are only enabled for the specific service(s) you choose. See our Cookie Policy.
2. Why we process data and our legal bases
| Purpose | Legal basis under GDPR |
|---|---|
| Answering enquiries and taking steps requested before a booking | Article 6(1)(b) — steps at your request before entering into a contract; where appropriate, Article 6(1)(f) — our legitimate interest in handling correspondence. |
| Managing reservations and providing your stay | Article 6(1)(b) — performance of the accommodation contract. |
| Guest identification, Alloggiati Web/public-security reporting, regional tourism/statistical obligations, invoicing/accounting and other mandatory records | Article 6(1)(c) — compliance with legal obligations. |
| Website security, fraud/abuse prevention, troubleshooting and defence of legal claims | Article 6(1)(f) — our legitimate interests in operating and protecting the website and business, subject to your rights. |
| Optional external website services (Google Translate, Google-hosted fonts and live Google review information) | Article 6(1)(a) — consent. Each optional service is off by default and can be enabled or withdrawn separately through “Cookie settings”. |
We do not currently use the website to build advertising profiles, and we do not currently run Google Analytics or Meta Pixel on the site. If that changes, this notice and the consent mechanism must be updated before those technologies are enabled.
3. Who may receive the data
Personal data is made available only where necessary and proportionate to:
- authorised Casal dei Fichi staff and service providers supporting hosting, email, IT, maintenance, booking/accounting administration and professional advice, where applicable;
- competent public authorities where required by law, including the public-security reporting system (Alloggiati Web / Polizia di Stato) and the competent regional tourism/statistical reporting systems (including ROSS1000 for Marche, where applicable);
- accounting, tax, legal or other professional advisers where necessary;
- the relevant online travel platform where a booking originated there and data exchange is necessary to administer that booking.
The website also uses technical content-delivery and map/weather services. Depending on the page you use, technical data such as your IP address may be sent to providers used to deliver Bootstrap/Leaflet resources, map tiles or weather information (for example jsDelivr, unpkg, Esri/CARTO/OpenStreetMap-related infrastructure and Open-Meteo). Optional Google services are blocked until you expressly enable the relevant service in the privacy choices panel.
4. International data transfers
Some technology providers may process data from locations outside the European Economic Area. Where GDPR transfer rules apply, we expect the relevant provider/controller relationship to rely on an applicable adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses. You can contact us if you need more information about a transfer relevant to your data.
5. How long we keep data
We keep personal data only for as long as necessary for the purpose for which it was collected and for any applicable statutory, accounting, tax, public-security, tourism/statistical or legal-claims period. In practice:
- enquiry information is retained while the enquiry is active and afterwards only for a proportionate follow-up/claims period;
- reservation, accounting and tax records are retained for the periods required by Italian law and any period needed to establish, exercise or defend legal claims;
- guest-identification fields are retained according to the applicable accommodation/public-security/statistical obligations and our documented retention criteria, and should not be kept longer merely because they are convenient;
- we do not use the online check-in form to retain image copies of identity documents;
- security/server logs are retained for the period set by the hosting/security configuration and then deleted or rotated unless an incident requires longer retention.
Where a document copy is exceptionally collected outside this online form solely to transcribe the data required for Alloggiati Web, it must not be retained after that purpose has ended and the applicable receipt/confirmation has been obtained.
6. Cookies and optional services
Strictly necessary storage may be used without consent where it is required to provide a service requested by you or protect the site. Optional external services remain off by default and are enabled only for the service(s) you choose to allow. Your choice can be changed at any time using . For details, see the Cookie Policy.
7. Your GDPR rights
Subject to the conditions in the GDPR, you may have the right to request access to your personal data, correction of inaccurate data, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time without affecting processing that was lawful before withdrawal.
To exercise a right, contact privacy@casaldeifichi.it. We may need to verify your identity before acting on a request.
You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali.
8. Data required to provide the stay
Some information is required to enter into or perform a booking and some guest-identification information is required by law. If required information is not provided, we may be unable to complete the booking, check-in or mandatory reporting. Optional form fields are marked or treated as optional.
9. Security
We use proportionate technical and organisational measures intended to protect personal data against accidental or unlawful loss, alteration, disclosure or access. No internet or storage system can be guaranteed to be completely secure.
10. Changes to this notice
We update this notice when our website, processing activities or legal obligations materially change. The date shown at the top of this page is the date of the current version.
