Privacy notice
1. Data controller
Villagemma S.r.l.s., Corso Beato Simeone, 67, 84048 Castellabate (SA), Italy. VAT no. and tax code: 06401850653.
Privacy contact: villagemmaguest@gmail.com · PEC: villagemmasrls@pec.it.
This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003 as amended).
2. What data we process
- Browsing data: IP address, browser type, pages requested, date and time. These are logged technically by the provider hosting and delivering the website, for security and operation. Visit statistics are aggregated, collected without cookies and without identifying visitors.
- Enquiries: name, contact details, approximate dates and the content of your message sent by email, phone or WhatsApp. The website contact form prepares the message in your WhatsApp or email app and you send it yourself: the website neither receives nor stores it.
- Your stay: personal and ID document details of all guests, required by Italian law for reporting to the Public Security Authority; statistical data on arrivals and nights; data needed for the municipal tourist tax (number of guests, age, nights).
- Bookings: they are made on Airbnb or Booking.com, which process booking and payment data as independent controllers, with their own privacy notices. We receive from the platform the data needed for your stay.
- Video surveillance: images recorded by cameras installed only in the outdoor areas of the property (see section 9).
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering enquiries and quotes | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) | 24 months from the last contact, unless you book |
| Managing the booking, the stay and guest support | Performance of a contract (Art. 6(1)(b)) | For the duration of the relationship; then as required for accounting records |
| Reporting guests’ identities to the police via the Alloggiati Web portal | Legal obligation (Art. 6(1)(c); Art. 109 TULPS, Royal Decree 773/1931; Ministry of the Interior Decree of 7 January 2013) | Data are sent within the legal deadlines; transmission receipts are kept for 5 years |
| Statistical reporting (ISTAT, via the Campania regional portal) | Legal obligation (Art. 6(1)(c)) | Data reported in aggregate form |
| Collecting and paying the tourist tax | Legal obligation and municipal regulation (Art. 6(1)(c)) | For the periods set by the municipal regulation and tax law |
| Tax and accounting obligations | Legal obligation (Art. 6(1)(c)) | 10 years (Art. 2220 Italian Civil Code) |
| Website security and abuse prevention | Legitimate interest (Art. 6(1)(f)) | For the technical period set by the service provider |
| Safety of people and property in outdoor areas (video surveillance) | Legitimate interest (Art. 6(1)(f)) | Normally no longer than 72 hours, unless specific needs or authority requests |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) | For as long as needed |
We do not send newsletters or marketing messages. Should we do so in future, it will only be with your explicit consent (Art. 6(1)(a)), which you can withdraw at any time.
4. Whether providing data is required
For enquiries, providing data is optional, but without contact details we cannot reply. For bookings and legal obligations it is necessary: without a valid ID document you cannot stay at the property.
5. Who we share data with
Data are processed by the controller and by authorised, instructed people. They may be shared with:
- providers processing data on our behalf, appointed as processors (Art. 28 GDPR): Netsons s.r.l. (website hosting); our tax adviser or accountant;
- public authorities, where required by law: the police (Alloggiati Web), ISTAT and the Campania Region (statistics), the Municipality of Castellabate (tourist tax), tax authorities;
- independent controllers, when you choose to use them: Airbnb and Booking.com (if you book via a platform), WhatsApp / Meta (if you message us on WhatsApp), Google (if you open the map).
Data are not published or sold to third parties.
6. Transfers outside the European Union
Some services (for example booking platforms or messaging services) may process data in the United States. Such transfers rely on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (10 July 2023) for certified providers, or on the Commission’s standard contractual clauses.
7. Your rights
You may at any time request access to your data, rectification, erasure, restriction, portability, and object to processing based on legitimate interest (Arts. 15–22 GDPR). Where you gave consent, you may withdraw it without affecting earlier processing.
To exercise your rights, write to villagemmaguest@gmail.com. We reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
Data reported to the police and other authorities under legal obligations cannot be erased on request before the legal periods expire.
8. Minors
Bookings must be made by adults. Data of minors staying at the property are provided by those with parental responsibility and processed only for legal obligations and the stay.
9. Video surveillance in outdoor areas
The outdoor areas of the property are monitored for the safety of guests and property. Cameras do not film the inside of the accommodation. A notice sign is placed before the monitored areas. Images are accessible only to the controller or authorised people, are deleted automatically within the periods in section 3, and may be handed to judicial or police authorities on request.
10. Automated decisions and updates
We do not carry out profiling or decisions based solely on automated processing.
This notice may be updated; the current version is always on this page. Last updated: 28 September 2026.