Who handles your data
The data controller is Dario Sanchez, operator of Stay Val di Sole, an apartment in Malè, Trentino, with national identification code (CIN) IT022110C2ISQ2ZLK6.
For privacy enquiries: stayvaldisole@proton.me. Telephone: +39 329 439 1766.
This notice covers the website and contact initiated through it. Any processing obligations relating to a confirmed stay will be explained in the information relevant to that accommodation arrangement.
Stay enquiries and contact
You can select arrival, departure and the number of guests and optionally add a name and message. These fields are processed in your browser; the website does not send them to its own enquiry database.
If you choose “Continue on WhatsApp”, the prepared text is included in the link and transmitted to WhatsApp when you open it. You can review it before sending it to the host. The Airbnb link communicates your selected dates and number of guests to that platform.
When you contact us by email, WhatsApp or Airbnb, we process the contact details, message and stay information you choose to share so that we can respond and handle your enquiry. The legal basis is taking pre-contractual steps at your request, Article 6(1)(b) GDPR. For other general questions, it is our legitimate interest in responding to correspondence, Article 6(1)(f).
Contacting us is optional. Without contact details and the necessary information, we may be unable to respond or provide an offer. The name and message fields remain optional. Identity documents and health information are not needed for a simple enquiry. The website does not process payments or automatically confirm bookings.
Calendar, map and media
Availability calendar
The server consults the property’s Airbnb calendar and returns only unavailable date ranges and update information to your browser. The public calendar does not expose guests’ names, contact details or booking details. Viewing it does not send your contact details to Airbnb. It is an information service based on the legitimate interest described above.
Map of Malè
When your browser loads the embedded map, it connects to OpenStreetMap Foundation, which receives your IP address and technical connection data. We display the map to show the property’s location, based on our legitimate interest in providing useful directions. See the provider’s OpenStreetMap privacy policy.
Photographs, video and fonts
These are served by the website’s hosting infrastructure. The winter video loads when you open its panel, without an embedded player from an external video platform.
Providers and international transfers
Data is handled by the controller and, for their respective functions, the service providers we use:
- Netlify, Inc. (United States): hosting, content delivery, calendar functions and statistics. For data processed on our behalf it acts as a processor under its Data Processing Agreement.
- Proton AG (Switzerland): the email service receiving correspondence sent to stayvaldisole@proton.me. Proton privacy policy.
- OpenStreetMap Foundation (United Kingdom): the embedded map. OpenStreetMap privacy policy.
- WhatsApp and Airbnb: services you choose to open to contact us or view the listing. They also act as independent controllers for processing on their platforms: WhatsApp privacy policy and Airbnb privacy policy.
Using these services involves processing outside the European Economic Area. For covered transfers, Netlify’s DPA provides for the EU–US Data Privacy Framework and, where that does not apply, the European Commission’s standard contractual clauses. Safeguards and provider locations are described in the linked documents; you may ask the controller for further details or a copy.
Transfers to providers in Switzerland and the United Kingdom rely on the relevant European Commission adequacy decisions. Any onward transfers by external services are described in their respective privacy notices.
Further disclosure to authorised parties or authorities takes place only where necessary for technical support, legal obligations or the protection of legal rights. Enquiry data is not published or sold.
How long data is kept
- Enquiries and correspondence: for the time needed to respond and complete any exchanges about the proposed stay. The period depends on closure of the enquiry, any resulting contractual relationship and a documented need to protect legal rights. Once these purposes are fulfilled, data is erased or anonymised; any further retention is limited to legal obligations or disputes.
- Technical data: according to the rotation and retention periods of Netlify’s infrastructure, determined by service delivery, troubleshooting and security needs. Data needed to investigate an incident may be retained for that investigation. The Web Analytics dashboard displays statistics for the last 30 days; this window does not represent the retention period of every technical log held by the provider.
- Language preference: until overwritten or until the website’s local browser storage is cleared.
- Published reviews: for as long as the excerpt remains relevant and up to date for presenting the property, subject to the author’s rights.
- Holiday saved at your request: in the browser for 30 days after the latest update; the save updates while the feature is enabled. You can remove it with “Delete saved holiday”, “Start again” or by clearing the website’s data; expired saves are removed when the site next reads them. Private house instructions remain only in page memory for up to 15 minutes or until access is closed or expires sooner.
Services you use directly, including WhatsApp and Airbnb, also apply the retention terms in their own notices to data they process independently.
Guest reviews
The website reproduces short excerpts from reviews published on the Airbnb listing, together with the displayed name and the month and year of the review, including translations. The source is the public listing linked from the reviews section.
The purpose is to inform visitors about guests’ experiences; the legal basis is our legitimate interest in presenting the property through relevant testimonials while limiting the data displayed, Article 6(1)(f) GDPR. If you wrote a review, you can contact us to exercise your rights, report inaccuracies or request removal of the excerpt from this website.
Your rights
Where applicable and subject to the conditions in Articles 15–22 GDPR, you may request access, rectification, erasure, restriction of processing and data portability.
You may object to processing based on legitimate interests on grounds relating to your particular situation. The controller will assess your request under Article 21 GDPR.
Write to stayvaldisole@proton.me. Requests are normally answered within one month; any extension permitted by law will be explained and communicated to you. A proportionate check of your identity may be necessary.
You may lodge a complaint with the Italian Garante per la protezione dei dati personali or the competent supervisory authority, particularly where you habitually reside, work or where the alleged infringement occurred. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
Updates to this notice
This page is updated when the website’s services or processing practices change. The date at the top identifies the version of the notice.
Legal reference: Regulation (EU) 2016/679.
AI holiday assistant
The chat is optional. When you send a message, its text and the previous conversation messages are sent through Netlify to OpenAI to generate holiday suggestions. The purpose is to answer your planning request; the legal basis is taking pre-contractual steps at your request (Article 6(1)(b) GDPR).
By default, the conversation is held in page memory and is cleared by reloading the page or choosing “Start again”. If you enable “Save holiday”, the site stores the last 12 messages and the planning data described under “Cookies and browser storage” only in the browser you are using, for 30 days after the latest update. Resuming also uses a signed token valid for no more than 30 days and containing selections and preferences; the token is not a booking confirmation and contains no private house instructions. The saved quote is indicative: prices, availability, weather and opening times must be checked again when you resume your holiday. The site does not create a remote chat archive. OpenAI API content is not used for model training by default; abuse-monitoring logs may be retained for up to 30 days, subject to provider exceptions or legal obligations. Netlify technical logs follow its service terms. Do not enter documents, health information or other sensitive data.
OpenAI provides the processing service: see the API data controls and DPA, including international transfer safeguards. Replies are automatically generated, may contain errors and do not constitute bookings or decisions with legal effects. The plan passes to WhatsApp only when you choose that link; you can review it before sending.
The public house guide is served directly by the website without requiring an AI model. A guest code entered in the private panel is sent to Netlify to verify its validity. The code, access token and private instructions are not sent to OpenAI or included in chat messages or the saved holiday. Private instructions and their token stay in page memory for the authorised session, for up to 15 minutes and never beyond the invitation’s validity; they are removed when you close the panel or chat, start again or the session expires.
Private host access
The administration panel uses Netlify Identity to authenticate the authorised host account, with technical session cookies and the information necessary for access. Pricing is stored in Netlify Blobs and contains no guest data. Website visitors do not need this access.