This privacy policy describes how the personal data of visitors to the masseriafrancescani.com website and users of its services is processed, in accordance with Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003.

Data Controller

Masseria Solicara XIV secolo s.r.l.
Via Vittorio Emanuele II 55, 73100 Lecce (LE)
VAT No. 02378250753
Email: info@masseriafrancescani.com

Processed Data, Purposes, and Legal Bases

Browsing Data

The systems that power the website record, as is the case with any website, certain technical data related to requests: IP address, date and time, requested page, browser, and operating system. This data is used to ensure the website’s functionality and security and to detect misuse (legitimate interest, Art. 6.1.f of the GDPR) and is retained for a limited period, unless necessary to investigate criminal offenses.

Contact Requests

  • Data: First name, last name, email address, phone number, and the content of messages sent via contact forms, email, or phone.
  • Purpose: To respond to requests and provide the requested information.
  • Legal basis: Implementation of precontractual measures requested by the data subject (Art. 6.1.b of the GDPR) and legitimate interest in responding (Art. 6.1.f).
  • Retention: For as long as necessary to process the request and, in any case, no longer than 24 months, unless a contractual relationship is established.

Reservations

  • Data: Personal and contact information, dates of stay or service, special requests; for stays, the identification information required by law.
  • Purpose: Management of reservations and requested services; mandatory reports to law enforcement authorities.
  • Legal basis: Performance of the contract (Art. 6.1.b of the GDPR) and compliance with legal obligations (Art. 6.1.c, including Art. 109 of the TULPS).
  • Retention: For the duration of the relationship and for the periods required by law (up to 10 years for tax-related records).

Table Reservations, Events, and Services

  • Information: Name, contact information, date, number of people, and special requests.
  • Purpose: To manage reservations and related communications.
  • Legal basis: Performance of precontractual measures and the contract requested by the data subject (Art. 6.1.b of the GDPR).
  • Retention: Up to 12 months after the reserved date, subject to legal requirements.

Cookies and Third-Party Services

The website uses necessary technical cookies and, only with the visitor's consent, any other tools described in the Cookie Policy, which lists the individual services and their providers.

Nature of the Contribution

Providing the information requested in the forms is necessary to obtain what you have requested; optional fields are marked as such. Declining non-essential cookies does not prevent you from using the site.

Recipients of the data

The data is processed by authorized personnel of the data controller and by service providers acting as data processors (Art. 28 of the GDPR), including:

  • MMultimedia s.a.s. – website development and technical management
  • OVHcloud (OVH SAS, France) – servers hosting the website, located in the European Union
  • Krossbooking – Online Booking Engine
  • Meta Platforms Ireland Ltd. (WhatsApp Business) – messages with guests, only if the user initiates the conversation
  • the third-party service providers listed in the Cookie Policy, only if the visitor has accepted them.

Data may also be disclosed to the authorities when required by law. It is neither disclosed nor sold.

Transfers Outside the European Union

The website is hosted on servers located in the European Union. Some third-party services may transfer data to the United States or other countries; in such cases, the transfer is based on an adequacy decision by the European Commission (such as the EU-U.S. Data Privacy Framework for participating providers) or on standard contractual clauses.

Rights of the Data Subject

At any time, you may request from the data controller access to your data, rectification, erasure, restriction of processing, data portability, and object to processing based on legitimate interests (Articles 15–22 of the GDPR). You may withdraw your consent at any time, without this affecting the lawfulness of the processing carried out prior to such withdrawal. To exercise your rights, please contact the data controller using the contact information provided above.

If you believe that the processing violates the law, you may file a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Changes

This privacy policy may be updated. The current version is always posted on this page along with the date of the last update.

Last updated: October 17, 2026