Privacy notice

1. Controllers and contact details

Casa Mariuccia brings together accommodation managed by two separate controllers: Abramo Spizzi is the data controller for accommodation at Sporting Mirasole 15; Paola Spizzi is the data controller for accommodation at Sporting Mirasole 19, both in Noverasco di Opera (MI), Italy. For privacy requests, email info@casamariuccia.it or call +39 329 058 0016. Your booking confirmation identifies the accommodation and therefore the relevant controller.

2. Data, purposes and legal bases

• Browsing and security: technical data, IP address and logs needed to deliver and protect the website; legal basis: legitimate interests in security and correct operation.
• Quote and booking: contact details, dates, party size, accommodation and selected services; legal basis: pre-contractual steps and performance of the contract.
• Payment: amounts, outcome and technical identifiers. Full card details are collected directly by Stripe; legal basis: performance of the contract and accounting obligations.
• Pre-check-in and legal duties: identity data, current residence and document data required for reporting to the Italian Police and statistical reporting to the Lombardy Region; legal basis: legal obligation. In-person identification remains required.
• Stay communications: operational email, access and support; legal basis: performance of the contract.
• Google Ads measurement: advertising identifiers and verified paid bookings, only after consent; legal basis: consent, which can be withdrawn at any time through “Privacy settings”. We do not enable personalised advertising.

3. Required and optional data

Fields marked as required are needed to conclude and manage the booking or comply with the law. Without them, the relevant operation cannot be completed. Advertising-measurement consent is optional: refusal does not prevent browsing or booking.

4. Recipients and services

Where necessary, data may be processed by providers supporting hosting and the database (Railway), payments (Stripe), transactional email (Resend), electronic access where configured (Nuki), and advertising measurement after consent (Google Ads). Data may also be disclosed to the Italian Police, the Lombardy Region and other authorities when required by law. We do not sell personal data.

Some providers may process data outside the European Economic Area. Where this happens, transfers rely on safeguards provided by the GDPR, such as adequacy decisions or standard contractual clauses adopted by the provider.

5. Retention

Data is kept according to these criteria: booking, payment and accounting data for statutory periods and the defence of legal claims; data reported to authorities for the period required by applicable law; logs and technical tokens for the time needed for security, support and operation of the stay. The Google Ads choice expires after 180 days unless withdrawn sooner. The detailed operational deletion schedule is still being formalised; you may ask the privacy contact which period applies to your booking.

6. Cookies and Google Ads

Before a choice, consent signals are denied and the Google Ads tag is not loaded. Booking, payment, cancellation and check-in codes are excluded from the data sent to the tag. Site fonts are served locally, without requests to external font providers.

7. Your rights

You may request access, rectification, erasure, restriction, portability and objection where applicable, and withdraw consent without affecting earlier processing. Email info@casamariuccia.it. You may also lodge a complaint with the Italian Data Protection Authority or your local supervisory authority.