Notice on the Processing of Personal Data Collected via this Website
Last revised: 14 August 2026
1. Introduction and regulatory references
This notice describes the processing of personal data collected via this website, including data obtained through cookies, tracking technologies and – where applicable – contact forms and any other features that may be active on the site.
This notice is intended for anyone who accesses or uses this website, and explains how users’ personal data is collected, used and protected, as well as the rights granted by law.
These provisions do not apply to other websites, pages or online services accessible via external links that may appear on this site; for these, please refer to the relevant privacy notices.
This notice is provided in accordance with the main national and international regulations on the protection of personal data, including:
- Regulation (EU) 2016/679 (GDPR) and Directive 2002/58/EC, known as the ePrivacy Directive
- Other regulations that may apply.
2. Who manages your data and how can you contact us?
Your personal data is processed by:
Hotel Villa dei Bosconi
Via F. Ferrucci, 51 - 50014 Fiesole (Florence)
villadeibosconi@fiesolehotels.com
VAT number: 02298400488
For any information regarding the processing of personal data or to exercise the rights granted by law, data subjects may contact the Data Controller.
3. On what legal bases do we process your data?
The processing of personal data collected via this website (including data collected through cookies, similar technologies, contact forms and any other features that may be active on the website) is based on one or more of the following legal grounds:
- Performance of pre-contractual or contractual measures: where processing is necessary to respond to user requests, provide the requested services and, where the website so provides, manage orders, accounts or contractual relationships.
- Compliance with legal obligations: where processing is necessary to comply with tax, accounting, administrative or security obligations, or with requests from the authorities.
The Data Controller may also process the necessary data on the basis of its own legitimate interest, in order to safeguard the security of the website, prevent misuse and fraud, and protect its rights in legal proceedings. The user may, in any event, object to the processing in accordance with the applicable legislation, in the cases provided for in Article 21 of the GDPR.
Failure to give consent, or the withdrawal of consent, may restrict access to certain features or services on the website.
The website does not require you to actively provide personal data: technical browsing data is collected automatically and is necessary to enable the website to function and be used; without this data being transmitted automatically, it is not technically possible to establish a connection or provide the requested functionality.
4. What data do we collect when you visit the site?
Whilst browsing this site, the following data may be collected, including by means of cookies and similar technologies such as pixel tags, web beacons, local storage and equivalent technologies, namely:
-
Navigation and technical data: information such as IP addresses, device identifiers, data relating to the operating system and browser, requested URLs, connection times, technical logs, technical preferences, and usage data collected via cookies and tracking technologies (pixel tags, web beacons, local storage and equivalent tools).
5. How do we process your data, how do we protect it and how long do we keep it?
The personal data collected via this website is processed primarily by electronic and digital means in accordance with the principles of lawfulness, fairness, data minimisation, integrity and confidentiality.
Data is retained in accordance with the following timeframes:
- Cookie preferences and consents: retained for 180 days, as set out in the Cookie Policy on this site.
- Navigation and technical data: retained for the time strictly necessary for security purposes and, as a rule, for no longer than 12 months, after which it is deleted or anonymised, except where longer periods are required by legal obligations or by the need to establish, exercise or defend a right in legal proceedings.
- Data relating to any contractual relationships entered into with the Data Controller: Where such data exists, it is retained for the duration of the relationship and, thereafter, for the period required by the applicable legal obligations (for example, in relation to accounting and tax matters).
- Data entered via forms or specific requests: retained for as long as is necessary to respond to the request and to fulfil the related purpose, and thereafter for any period required by legal obligations.
6. Who can access your data?
The following may access the personal data collected via this website, within the limits of their respective responsibilities and purposes:
- Authorised internal staff designated by the Data Controller, who has been duly briefed on privacy and security matters;
- Suppliers and third parties appointed as data processors (for example: technical service providers and IT services, website maintenance, email providers, consultants, where applicable);
- Third parties that provide services integrated into the website (e.g. fonts, maps, image display), which may process technical data as independent data controllers in accordance with their own privacy notices (in which case, please also refer to the individual privacy notices of such third parties);
- Competent public authorities and supervisory bodies, within the limits laid down by law or in order to comply with requests from the judicial authorities;
The updated list of external recipients can be provided on request by writing to the Data Controller using the contact details provided.
7. Where can your data be transferred?
Personal data collected via this website is, as a general rule, processed in the country where the Data Controller is established and by the service providers it uses. Where data is transferred or made accessible outside the relevant territory in accordance with the applicable legislation, the transfer takes place by means of one of the mechanisms permitted by that legislation, including adequacy decisions, appropriate or suitable safeguards and, where applicable, derogations or other conditions provided for by the applicable legislation. For data transfers subject to the GDPR, the relevant territory is the European Union / European Economic Area and, in particular, the EU-US Data Privacy Framework – which is limited to certified organisations – and the Standard Contractual Clauses adopted by the European Commission apply. Information on the applicable mechanism and, where provided for, a copy of the relevant safeguards – with any confidential parts redacted – may be requested using the Data Controller’s contact details.
Countries to which data may be transferred: Israel, the United States.
8. What are your rights regarding the data collected?
Under the applicable legislation, the user has the right to:
- To obtain confirmation as to whether or not personal data relating to them is being processed and, if so, to obtain access to that data and the related information (right of access).
- Request the rectification, updating or erasure of data that is inaccurate or no longer necessary (right to rectification and erasure).
- Request the restriction of processing or object, on grounds relating to your particular situation, to processing based on the Data Controller’s legitimate interest, subject to the conditions set out in Article 21 of the GDPR.
- To receive, in the cases and under the conditions provided for by the applicable legislation, the personal data relating to you in the format required by that legislation, and to have that data transmitted to another controller or service provider; for the EU/EEA and the UK, this right applies to the data you have provided; the format must be structured, commonly used and machine-readable, and direct transmission must be carried out where technically feasible (right to data portability).
- You may withdraw any consent given at any time, without this affecting the lawfulness of any processing carried out on the basis of that consent prior to the withdrawal (for example, for the sending of marketing communications or newsletters, where applicable).
- Withdraw your consent to the use of non-essential cookies and to the processing of data collected via tracking tools.
- Report any irregularities or abuses to the competent supervisory authorities.
To exercise these rights, simply send a request to the Data Controller’s contact details. The Data Controller will respond without undue delay and within the time limits laid down by the applicable legislation. For requests subject to the GDPR or the UK GDPR, a response is provided within the standard period of one month, calculated in accordance with the applicable legislation; that period may be extended by a further two months, taking into account the complexity and number of requests, and the data subject is informed of the extension and the reasons for it within the standard period.
9. How is data relating to minors processed?
The protection of minors is a fundamental priority.
This site is not intended for minors and does not intentionally collect their data via its forms. Where, in the context of a request or enquiry, the user provides personal data relating to third parties – including any minors – they must ensure that they are authorised to do so; such data will be processed within the limits and for the purposes of the request, in accordance with the applicable legislation. For requests regarding rectification, restriction or erasure, please contact the Data Controller using the contact details provided.
10. How can you report incidents or make complaints to the authorities?
If you believe that the processing of your personal data via this website does not comply with the relevant legislation, you may lodge a complaint free of charge, in accordance with Article 77 of the GDPR, with the competent authorities listed below, in accordance with the relevant legislation:
11. How do we inform you of changes to this notice?
This notice is subject to periodic review to reflect changes in regulations or modifications to the services offered via the website. Any significant changes will be communicated via this page.
Last revised: 14 August 2026
