Privacy notice

1. Controllers and contact details

Casa Mariuccia brings together accommodation managed by two separate controllers: Abramo Spizzi is the data controller for accommodation at Sporting Mirasole 15; Paola Spizzi is the data controller for accommodation at Sporting Mirasole 19, both in Noverasco di Opera (MI), Italy. For privacy requests, email info@casamariuccia.it or call +39 329 058 0016. Your booking confirmation identifies the accommodation and therefore the relevant controller.

2. Data, purposes and legal bases

• Browsing and security: technical data, IP address and logs needed to deliver and protect the website; legal basis: legitimate interests in security and correct operation.
• Quote and booking: contact details, dates, party size, accommodation and selected services; legal basis: pre-contractual steps and performance of the contract.
• Quote displayed on the website: when you press “Show quote”, we record your declared email and phone number, accommodation, dates, party size, services, calculated price and time. We separately record whether the browser displays the price and whether a linked request or booking follows. The purpose is to manage the quote you requested; legal basis: pre-contractual steps. Calculating a quote does not reserve accommodation, initiate payments or send automatic messages. Contact details are not verified, and a display event does not prove that you read the quote.
• Personalised offers for the stay you searched for: only if you select the separate optional checkbox may the accommodation manager use your email and phone number to propose an offer relating to your choices, including if you do not proceed to booking. Legal basis: separate consent, recorded with the notice version and date. You may withdraw it on the quote page while it remains open or by emailing info@casamariuccia.it. Refusing or withdrawing consent does not prevent viewing a quote or booking.
• Payment: amounts, outcome and technical identifiers. Full card details are collected directly by Stripe; legal basis: performance of the contract and accounting obligations.
• Pre-check-in and legal duties: identity data, current residence and document data required for reporting to the Italian Police and statistical reporting to the Lombardy Region; legal basis: legal obligation. In-person identification remains required.
• Stay communications: operational email, access and support; legal basis: performance of the contract.
• Google Ads measurement: advertising identifiers, contact button clicks and verified paid bookings, only after consent; legal basis: consent, which can be withdrawn at any time through “Privacy settings”. We do not enable personalised advertising.
• Quote simulation statistics: after consent, we measure accommodation and date selection, prices actually viewed, subsequent changes, form starts, submitted requests and contact clicks. We use a random session identifier, accommodation, number of nights, amount and source category. We do not record names, contacts, exact stay dates or reasons for travel. Legal basis: optional consent, withdrawable through “Privacy settings”.

3. Required and optional data

The “Show quote” form requires an email and phone number before displaying your personalised quote. Other required fields are needed to conclude and manage the booking or comply with the law. Without them, the relevant operation cannot be completed. Consent to personalised offers is separate and optional: entering contact details does not authorise commercial offers. Statistics and advertising-measurement consent are also optional and separate; refusing them does not prevent browsing, viewing a quote or booking.

4. Recipients and services

Where necessary, data may be processed by providers supporting hosting and the database (Railway), payments (Stripe), transactional email (Resend), electronic access where configured (Nuki), and advertising measurement after consent (Google Ads). Data may also be disclosed to the Italian Police, the Lombardy Region and other authorities when required by law. We do not sell personal data.

Some providers may process data outside the European Economic Area. Where this happens, transfers rely on safeguards provided by the GDPR, such as adequacy decisions or standard contractual clauses adopted by the provider.

5. Retention

Contact details collected through “Show quote”, related searches, prices and personalised-offer preferences are kept for 30 days from the first registration, then automatically deleted. New simulations for the same contact do not extend this period. Actual requests and bookings that may be created retain their own data for the periods applicable to their management. You can request earlier erasure of website contacts or withdraw consent by emailing the privacy contact.

Data is kept according to these criteria: booking, payment and accounting data for statutory periods and the defence of legal claims; data reported to authorities for the period required by applicable law; logs and technical tokens for the time needed for security, support and operation of the stay. The Google Ads choice expires after 180 days unless withdrawn sooner. The detailed operational deletion schedule is still being formalised; you may ask the privacy contact which period applies to your booking.

6. Cookies and Google Ads

Simulation events are retained for 90 days and automatically deleted periodically. The browser session code is renewed after 30 minutes without measured activity; only its hash is stored on the server. Withdrawal stops collection and removes the session code and source category from the browser. Earlier actions are not reconstructed or replayed.

Before a choice, consent signals are denied and the Google Ads tag is not loaded. Booking, payment, cancellation and check-in codes are excluded from the data sent to the tag. Site fonts are served locally, without requests to external font providers.

For the phone and WhatsApp buttons at the top of the accommodation near IEO page, we measure the click, not the conversation content or call outcome. This event does not include names, phone numbers, stay dates or message text. You can use these contacts even if you decline measurement; clicks made before consent are not recorded afterwards.

Simulation statistics remain on our backend hosted on Railway and are not sent to Google Ads. The Statistics section displays aggregate reports only; its codes are not linked to contacts or bookings. The separate administrative “Website contacts” section displays information explicitly provided for a quote: it does not link it to earlier statistics and does not send contact details, dates or quote contents to advertising services. We do not record screens, typed text or conversations. A lack of further steps does not prove why a visitor stopped. A local technical preference lets the manager exclude their own tests from statistics until removed.

7. Your rights

You may request access, rectification, erasure, restriction, portability and objection where applicable, and withdraw consent without affecting earlier processing. Email info@casamariuccia.it. You may also lodge a complaint with the Italian Data Protection Authority or your local supervisory authority.