Privacy policy
Last updated: 08/10/2026
Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), this notice explains how we process the personal data of people who visit https://tuscanhideaway.com and of people who write to us through the contact form.
Data controller
The data controller is Matilde Angelotti, Strada comunale del Quintilio 67/bis, 55033 Castiglione di Garfagnana (LU), Italy. For any question about your data, write to [email protected].
What data we process and why
Contact form requests. Name and surname, email, arrival and departure dates, number of guests and any message you choose to write. We use them to answer your request and tell you about availability and the terms of your stay. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
Browsing data. Your IP address, date and time of access, pages visited and browser type are recorded in the technical logs of the server that hosts the site. They keep the site running and protect it from abuse. Legal basis: legitimate interest in the security of the site (Art. 6(1)(f) GDPR).
Spam protection. The contact form uses Cloudflare Turnstile, a service of Cloudflare, Inc. that checks some technical data about your browser and device (such as your IP address and browser features) to tell people apart from automated programs. It is not used for advertising or profiling. Legal basis: legitimate interest in protecting the site and our mailbox from spam and abuse (Art. 6(1)(f) GDPR). More in the Cloudflare privacy policy and the Turnstile privacy notice.
Map. The Google Maps map only loads if you choose to see it. Google Ireland Ltd then receives your IP address and may set cookies. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from the cookie preferences. See the Google privacy policy.
Do you have to give us your data?
No. Without your name, email and dates of stay, however, we cannot answer your request.
How we process data and who receives it
We process data electronically, with appropriate measures to protect it. We do not sell or publish it and we make no automated decisions based on it. Only the providers of the services we use may receive it:
- the site's hosting provider, which keeps the technical logs;
- Google, which provides the mailbox (Gmail) where we receive requests;
- Cloudflare, for the spam protection of the form.
Each of these providers acts, for its own part, as a data processor or as an independent controller. If you book through Airbnb, your booking data is also processed by Airbnb under its own privacy policy.
Transfers outside the European Union
Google and Cloudflare may process some data in the United States. Transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, which both companies have joined, or otherwise on the standard contractual clauses approved by the Commission.
How long we keep data
- Form requests: as long as needed to handle the request, and no longer than 24 months after the last contact. If the request turns into a stay, we keep the data required by law (for example for tax purposes) for the period the law sets.
- Server technical logs: for the period set by the hosting provider for security reasons.
- Cookie choices: 6 months.
Your rights
At any time you can ask to access, correct or delete your data, restrict its processing, receive it in a portable format, or object to processing based on legitimate interest (Articles 15-22 GDPR). You can also withdraw any consent you gave, without affecting processing carried out before. To do so, write to [email protected].
If you believe the processing breaks the GDPR, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.
Cookies
For the cookies used on the site and how to manage consent, see the cookie policy.
Changes to this notice
We may update this notice. The date of the last change is shown at the top.