Privacy and cookies
Updated on 2 November 2026
Who handles your data
Eleonora Odorizzi, the individual managing Villa Ines, Sunny Place and Palazzo del Barone di Rallo, is the controller for enquiries received through this website. Address: Viale G. Prati 10, Riva del Garda (TN), Italy. For privacy enquiries and rights requests: villa.ines.riva@gmail.com. For availability and stays: villa.ines.riva@gmail.com.
Data and purposes
We use your name, contact details, preferred property, dates, guest numbers and any information you choose to provide to answer enquiries, prepare offers and, if you proceed, manage your booking. The legal basis is taking steps at your request before a contract and performing that contract (GDPR Article 6(1)(b)). Legal obligations, where applicable, rely on Article 6(1)(c). There are no newsletters, profiling or automated decisions. Please do not enter identity documents or health information in the form.
How the form works
The form prepares a message on your device. Open it in WhatsApp or your email application, review it and send it there. This website does not automatically send enquiries or save form entries in its own database. Opening WhatsApp passes the prepared text to that service. The controller receives your enquiry when you send it. Email drafts include a blind copy to eleonora@italianstories.it, another address of the same controller. Providing details is voluntary, but without necessary information we may be unable to answer or arrange your stay. An enquiry does not confirm a booking. The availability calendar receives only blocked date ranges from the server, without prices, guest names or booking details. The server reads Airbnb and caches the anonymous projection for five minutes; visitors never receive the private iCal link. Selected dates stay on your device until you open the form or WhatsApp.
Browsing, hosting and other services
Delivering and protecting the site involves technical data such as IP addresses, page requests, timestamps, browser information and logs. The purpose is service delivery and security, based on legitimate interests (GDPR Article 6(1)(f)). Hosting uses OpenAI Sites and its infrastructure, including Cloudflare. Communications use Gmail and, if you choose, WhatsApp. Data may be accessed by the controller and service providers as necessary, according to their roles and terms, and disclosed to authorities when legally required. It is not made public.
Links and international transfers
Instagram, Google Maps, Airbnb and tourism websites are ordinary links: no social feeds, interactive maps or review widgets are embedded. Following a link opens an external service with its own privacy notice. Hosting and communication providers may process data outside the European Economic Area; their agreements and linked notices describe applicable terms and safeguards. The OpenAI Sites data processing addendum applies to hosted data where relevant. You may contact the controller for information about safeguards relevant to your data.
Retention
Enquiries that do not become bookings are kept as long as needed to handle the request and follow-up questions, then deleted when no longer necessary. Booking documents are kept for managing the stay and the periods required by laws applicable to each document. Relevant data may be retained to establish, exercise or defend legal claims. Infrastructure technical data follows providers’ service and security retention arrangements; the form does not copy it into a website guest database.
Cookies and similar technologies
The site code does not set advertising cookies, profiling tools, Google Analytics or Meta Pixel, and does not use localStorage to save form entries. A check of the public domain on 2 November 2026 detected __cf_bm, a Cloudflare technical cookie protecting against automated traffic. It expires after 30 minutes of continuous inactivity. A consent banner is not requested for this technical function. You can manage cookies through your browser; blocking technical cookies may affect security checks. Linked external services manage their own cookies under their notices. This notice will be updated if site functions change.
Your rights
Where applicable under the GDPR, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Contact villa.ines.riva@gmail.com. You can also complain to the Italian Garante per la protezione dei dati personali or another competent supervisory authority. Withdrawing any consent does not affect prior lawful processing; stay enquiries are not based on marketing consent.