Last updated: 08.09.26
 

This Privacy Policy describes how the personal data of users visiting casacorliano.com, the website dedicated to Casa Corliano, an accommodation and olive oil producer located in Calenzano, Tuscany, is processed.

This notice is provided pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and the applicable Italian legislation concerning the protection of personal data.
 

1. Data Controller

The Data Controller is:

Corliano Società Semplice Agricola 
Address: Via delle Romagne 10, 50041 Calenzano (FI), Italy
Tax code or VAT number: 07402480487
Email: ciao@casacoriano.com
Certified email address (PEC): corliano@cia.legalmail.it

For any request concerning the protection of personal data, users may contact the Data Controller at the email address indicated above.
 

2. Personal Data Processed

The following categories of personal data may be processed through the website.

Browsing Data

The IT systems and procedures used to operate the website automatically collect certain technical data, including:

• IP address;

• device type, browser and operating system;

• date and time of the visit;

• pages visited;

• referring page address;

• technical information necessary for the security and proper operation of the website.

This data is normally processed in aggregate form, unless it is necessary to use it for security purposes, the prevention of misuse or the establishment of liability.

Data Provided Voluntarily

When users contact Casa Corliano by email, telephone, WhatsApp or through any forms available on the website, the following data may be collected:

• first and last name;

• email address;

• telephone number;

• requested stay dates;

• number and composition of guests;

• message content;

• any additional information voluntarily provided.

Users are advised not to include sensitive data or unnecessary information in their messages.

Booking and Stay Data

If the website allows direct booking requests, the following data may also be processed where necessary to:

• manage the request and the stay;

• comply with administrative, tax and accounting obligations;

• submit legally required information to the competent authorities;

• manage payments, cancellations, assistance and disputes.

Identification document data is processed only when required by law and using appropriate security measures.

​

3. Purposes and Legal Bases of Processing

Personal data is processed for the following purposes:

• to ensure the operation, security and maintenance of the website, based on the Data Controller’s legitimate interest;

• to respond to requests for information, availability or quotations, in order to take pre-contractual steps requested by the user;

• to manage bookings, payments and stays, for the performance of a contract;

• to comply with legal, administrative, tax and public-security obligations;

• to establish, exercise or defend legal claims, based on the Data Controller’s legitimate interest;

• to send promotional communications or newsletters, only when the user has provided specific consent.

Any consent provided may be withdrawn at any time, without affecting the lawfulness of the processing carried out before its withdrawal.
 

4. Nature of Data Provision

Providing data marked as mandatory is necessary in order to respond to the user’s requests or manage a booking.

Failure to provide such data may make it impossible to provide the requested information or services.

Providing data for promotional purposes is optional and does not affect the user’s ability to request information or book a stay.
 

5. Processing Methods and Security

Personal data is processed using electronic and, where necessary, paper-based tools. Appropriate technical and organisational measures are adopted to protect it against unauthorised access, loss, destruction, unlawful disclosure or alteration.

Processing is carried out by the Data Controller and by any authorised collaborators, within the limits of their respective duties.
 

6. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected and, in particular:

• general enquiries and availability requests: for up to 12 months after the end of the communication;

• booking, contractual and accounting data: for the period required by law, generally 10 years;

• data required for public-security obligations: for the periods established by applicable law;

• data used for promotional communications: until consent is withdrawn or for a maximum of [24 MONTHS];

• technical logs and security data: normally for no longer than [30 DAYS], unless they are required to investigate misuse or unlawful activity.

Data may be retained for longer where necessary to manage disputes or protect the Data Controller’s legal rights.
 

7. Recipients of Personal Data

Personal data may be disclosed, where necessary, to:

• hosting, maintenance and technical-support providers;

• email, messaging and enquiry-management service providers;

• tax, accounting or legal advisers;

• payment service providers;

• booking platforms;

• public authorities and other parties to whom disclosure is required by law.

Providers processing personal data on behalf of the Data Controller are appointed as data processors pursuant to Article 28 GDPR, where required.

Personal data is neither sold nor publicly disclosed.
 

8. Bookings Through Airbnb

The website may contain links to Casa Corliano’s listing on Airbnb.

When users select a link to Airbnb, they are redirected to an external website. Airbnb processes personal data collected through its platform as an independent Data Controller and in accordance with its own Privacy Policy.

Casa Corliano does not control the cookies, tracking technologies or processing methods used by Airbnb on its website.

Users are advised to read Airbnb’s Privacy Policy before using the platform or making a booking.
 

9. External Services and Embedded Content

The website may use services provided by third parties, including maps, videos, fonts, anti-spam tools, booking systems and links to social media platforms.

When such content is loaded, the relevant providers may receive users’ technical data, including their IP address, and may use cookies or other tracking technologies.

Services that are not strictly necessary are activated only after the user has provided consent, where required by law.

​

10. Cookies and Tracking Technologies

The website uses technical cookies that are necessary for its proper operation.

Any analytics cookies that cannot be treated as technical cookies, advertising cookies or other non-essential tracking technologies are installed only after the user has provided consent.

Users may accept, reject or customise their choices through the cookie banner. They may change or withdraw their consent at any time through the “Manage cookie preferences” link available on the website.

For detailed information about the cookies used, their purposes, providers and retention periods, users may consult the website’s Cookie Policy.
 

11. Transfers Outside the European Economic Area

Some technology providers may process personal data in countries outside the European Economic Area.

In such cases, the transfer is carried out in compliance with Articles 44 and following of the GDPR, on the basis of a European Commission adequacy decision, Standard Contractual Clauses or another safeguard recognised under applicable law.

Further information may be requested from the Data Controller.
 

12. Data Subject Rights

Users may exercise the rights provided for under Articles 15–22 of the GDPR at any time and, in particular, request:

• confirmation as to whether their personal data is being processed and access to that data;

• correction of inaccurate personal data;

• deletion of personal data, where legally permitted;

• restriction of processing;

• data portability, where applicable;

• objection to processing based on legitimate interest;

• withdrawal of consent;

• not to be subject to decisions based solely on automated processing, in the circumstances provided for by law.

Requests may be sent to [PRIVACY EMAIL ADDRESS].

The Data Controller will respond within the time limits established by law, normally within one month of receiving the request.
 

13. Complaint to the Supervisory Authority

If users believe that their personal data is being processed in breach of applicable law, they may lodge a complaint with:

Italian Data Protection Authority – Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Rome, Italy
Website: https://www.garanteprivacy.it

Users also retain the right to seek a judicial remedy before the competent courts.
 

14. Changes to This Privacy Policy

The Data Controller may periodically update this Privacy Policy to reflect changes in legislation, technology or the services offered through the website.

The updated version will be published on this page together with the date of the latest revision.