Privacynotice.
What we collect when you visit this website, write to us or stay at the house, why we need it, and the rights you have over it. Last updated on 4 November 2026.
The short version: we collect only what we need to answer you and look after your stay, we keep it no longer than the law or the job requires, we never sell it, and this website uses no tracking or advertising cookies.
Who we are
The data controller is Villa Velatura, Strada della Velatura, 53026 Pienza (SI), Italy. For anything about your personal data, write to hello@velatura.it or to the postal address above.
This notice is given under Articles 13 and 14 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended).
What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Enquiries: your name, email, dates, number of guests, occasion and message | To answer you, check availability and prepare an offer | Steps taken at your request before a contract (Art. 6(1)(b) GDPR) |
| Bookings: the lead guest’s contact and billing details, the names of the guests, payments | To manage your booking and your stay, and to keep our accounts | Contract (Art. 6(1)(b)); legal obligations on tax and accounting (Art. 6(1)(c)) |
| Dietary needs and allergies you tell us about | So Graziella can cook safely for you | Your explicit consent (Art. 9(2)(a)), which you can withdraw at any time |
| Requests for extras: drivers, guides, classes, treatments | To book them with the people who provide them | Contract (Art. 6(1)(b)) |
| Correspondence after your stay | To deal with questions, complaints or anything left behind | Our legitimate interest in looking after our guests (Art. 6(1)(f)) |
You do not have to give us any of this, but without your contact details we cannot answer you, and without the booking details we cannot host you.
Guest registration
Italian law (Article 109 of the Consolidated Law on Public Security) requires everyone who hosts guests to send the details of each guest’s identity document to the State Police within 24 hours of arrival, through the Alloggiati Web service. We do this on the day you arrive. We look at the documents, send the details the law asks for and keep no copies.
We also record the number of guests and nights for the tourist tax of the Comune di Pienza and for the tourism statistics the Region of Tuscany collects. These are legal obligations (Art. 6(1)(c) GDPR).
Letters from the valley
If you subscribe on the website or tick the box in an enquiry form, we use your email address to send our newsletter, four times a year. The legal basis is your consent (Art. 6(1)(a) GDPR). Every letter has an unsubscribe link, or you can simply reply and ask, and we delete your address from the list straight away.
This website
When you visit, our hosting provider records technical logs (IP address, browser, the page requested and the time) to keep the site running and secure. This is our legitimate interest (Art. 6(1)(f) GDPR), and the logs are deleted after 30 days.
We use no analytics, no advertising and no social media trackers. The typefaces are loaded from Google Fonts and, on the homepage, a 3D graphics library from the jsDelivr network; your browser sends them your IP address to fetch those files, and they set no cookies. Google LLC is certified under the EU–US Data Privacy Framework. See the cookie notice for the one small note your browser keeps.
Messages sent through the forms travel encrypted to our server and arrive in Chiara’s inbox; they are not stored on the website.
How long we keep it
- Enquiries that do not lead to a booking: 24 months after our last message, so we can recognise you if you write again.
- Booking and billing records: ten years, as Italian law requires for accounting documents (Article 2220 of the Civil Code).
- Dietary needs and allergies: until the end of your stay.
- Newsletter address: until you unsubscribe.
- Website logs: 30 days.
Your rights
You can ask us at any time to see the data we hold about you, to correct it, to delete it, to restrict how we use it or to send it to you in a portable format, and you can object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it whenever you like, without affecting what we did before.
Write to hello@velatura.it. We answer within one month. If you think we have not handled your data properly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority in the EU country where you live.
Changes to this notice
If we change the way we use personal data, we will update this page and the date at the top. If the change matters to a booking you have already made, we will tell you by email.