Privacy Policy

The data controller is B&B Le Orme, Via Villa Canale 28, 38060 Canale di Tenno (TN), Italy — CIN IT022191C1MEOLAKDF. Contact: email info@le-orme.it.

Data protection contact: the Controller. The appointment of a Data Protection Officer under Article 37 GDPR is not mandatory — the activity involves neither systematic large-scale monitoring nor large-scale processing of special categories of data — and remains subject to periodic review. To exercise your rights, or for any question about the processing, it is enough to write to info@le-orme.it.

For guests’ data the controller is B&B Le Orme: the property determines the purposes and the means — reporting guests to the public security authority, statistical returns, tourist tax, management of the stay.

The booking form published in the «Book your stay» section is provided by GuesTrace, which acts as a data processor (Article 28 GDPR): it processes the data solely on behalf of the property and under its instructions, on the basis of a processing agreement referred to in §7.

The distinction is not a formality: it determines who to address. Anyone wishing to exercise a right over their data writes to the property, not to the provider of the form.

a) Data entered in the booking form

• full name, email address, telephone number;
• dates of the stay, room chosen, number of guests and ages of children;
• any notes and requests, for example parking.

Where the enquiry covers more than one person, the details provided about the other guests (name, age) come from whoever books, who is required to inform them of this page: this is the case covered by Article 14 GDPR.

b) Data collected on arrival

On arrival every guest is identified: this is a legal obligation on the property (Article 109 of the Italian Consolidated Public Security Act, TULPS). Personal details and the particulars of a valid identity document are recorded, to the extent required by law.

c) Technical data from the website

IP address, connection data and logs recorded by the systems hosting the site, processed for security and fault diagnosis.

d) Data the site does NOT collect

The site uses no profiling cookies and no third-party advertising trackers (§10); it collects no special categories of data; it runs no newsletter and does not profile visitors for commercial purposes.

Data is processed in order to:

• respond to booking enquiries and to questions received by email or WhatsApp;
• manage the stay: confirmation, deposit, arrival, stay and departure;
• meet the obligations that apply to accommodation providers: reporting guests to the public security authority, tourism statistics, collection and payment of the tourist tax;
• meet the accounting and administrative obligations required by law;
• keep the site secure and prevent abuse.

Data is not used for marketing purposes, nor passed to third parties for that purpose.

• Performance of a contract and pre-contractual measures (Art. 6.1.b) — for the booking enquiry, the reply and the management of the stay;
• Legal obligation (Art. 6.1.c) — for reporting guests to the public security authority, statistical returns, the tourist tax and accounting obligations;
• Legitimate interest (Art. 6.1.f) — for the security of the site and the prevention of abuse. This processing yields to the data subject’s objection (Art. 21), which can be exercised by writing to info@le-orme.it.

Consent is not required in order to book or to stay: none of the purposes set out above rests on it.

To send a booking enquiry, name, email address, telephone number, dates and number of guests are required: without them the enquiry cannot be handled. Notes and additional requests are optional.

On arrival, presenting a valid identity document is not optional: it is a legal obligation (Article 109 TULPS), and without it accommodation cannot be provided.

Data may be processed, for the purposes set out above, by parties acting as data processors under Article 28 GDPR, on the basis of specific agreements. The recipients are listed below, with what they do and which data they see.

• GuesTrace — booking form and enquiry management. Sees the data entered in the form and the data of the stay;
• Cloudflare — hosting and delivery of the website, plus anonymous, aggregated visit statistics. Sees data in transit, the IP address and request logs;
• Google — the typefaces (Google Fonts) and the map in the «Getting here» section (Google Maps). Sees the IP address of whoever loads the page;
• WhatsApp (Meta) — only if you choose to write on that channel: the conversation then passes through Meta’s systems, under its own privacy policy.

Public authorities are also recipients, by legal obligation: the State Police through the «Alloggiati Web» portal for guest reporting (Article 109 TULPS), the bodies responsible for tourism statistics, and the Municipality of Tenno for the tourist tax.

These transmissions are not disclosures to third parties: they are obligations the property fulfils as controller. Data is never disseminated, sold or communicated to third parties for marketing purposes.

Booking data resides in the systems of the GuesTrace management system, on servers located in the European Union.

Some providers — in particular hosting and content delivery services and the Google and Meta components referred to in §7 — may involve a transfer of data to third countries, including the United States. Such transfers take place with appropriate safeguards under Articles 44 et seq. GDPR, in particular the Standard Contractual Clauses adopted by the European Commission and, where applicable, participation in the EU-U.S. Data Privacy Framework.

• Enquiries that do not become a stay: kept for as long as is useful to handle them and deleted once the period set in the management system has elapsed. Anyone who merely asked for a quote does not stay on file for ever;
• Data of the stay: for its whole duration and thereafter for 10 years, the period required by accounting and administrative obligations;
• Data reported to the public security authority: its retention by the authority is governed by law and does not depend on the property;
• Technical logs of the site: kept for a limited period, proportionate to the purposes of security and diagnosis.

Once these periods have elapsed the data is deleted.

The site sets no cookies of its own, and visit statistics are collected anonymously and in aggregate form, without cookies and without identifying the visitor. No profiling cookies and no third-party advertising trackers are used.

This is why the site shows no banner: consent is not due under Article 122 of Legislative Decree 196/2003 where there is nothing that requires it, and showing a banner when it is not needed teaches people to click without reading.

Two third-party components referred to in §7 are the exception: the Google Fonts typefaces, loaded from Google’s servers, and the Google Maps map in the «Getting here» section, which may set its own cookies once you interact with it. If you prefer to avoid this, you can simply not use the map and refer to the address given on the page.

The property cannot accommodate children under the age of 6. For the younger guests it can welcome, the booking form asks for their age: it is needed to calculate the tourist tax correctly, since the tax provides exemptions by age band, and to check that this rule is met.

Children are never asked to provide data themselves: it is provided by a parent or guardian, when booking and on arrival. Children’s data is processed, like adults’ data, solely to meet legal obligations and to manage the stay.

No decision based solely on automated processing is taken that produces legal effects or similarly significantly affects the data subject within the meaning of Article 22 GDPR, and no profiling is carried out.

The availability check and the price calculation performed by the form are a computation on parameters set by the property, not an assessment of the person; and the enquiry sent through the form is approved by a person before it becomes a confirmed booking.

You may exercise at any time the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21).

Requests should be sent to info@le-orme.it and receive a reply within 30 days, extendable by two months in the cases provided for by Article 12.3 GDPR, with reasons given.

Erasure cannot cover data the law requires to be kept — in particular data reported to the public security authority and data subject to accounting obligations — for as long as that obligation lasts.

The site is served exclusively over a secure channel (HTTPS). Booking data resides in the management system, access to which is restricted to the property’s managers and protected by personal credentials.

In the event of a personal data breach posing a risk to the rights and freedoms of data subjects, the Controller notifies the Italian Data Protection Authority within the time limits of Article 33 GDPR and, where required, informs the data subjects.

Anyone who considers that the processing of their data infringes the Regulation has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it), without prejudice to any other administrative or judicial remedy.

This notice may be updated: the version in force and its date are always shown at the top of the page.

To exercise your rights or for any question about the processing: info@le-orme.it.