Last updated: 28 September 2026
This Privacy Policy explains how the personal data of users visiting www.pennella.it are processed in accordance with Regulation (EU) 2016/679 (“GDPR”) and the applicable Italian data protection legislation.
1. Data Controller
The Data Controller is:
Soc. Agr. La Bandita e Lunadoro
Podere Lunadoro 134
53026 Pienza (SI), Italy
VAT number: 00893880526
Email: in**@******la.it
Telephone: +39 333 2055743
For any request concerning the processing of personal data or the exercise of data protection rights, users may contact the Data Controller at in**@******la.it.
2. Categories of personal data
The following categories of personal data may be processed through the website:
- identification data, such as first name and surname;
- contact details, such as email address and telephone number;
- information concerning the requested stay, including dates, number of guests and message content;
- booking and payment information when the external booking system is used;
- technical and browsing data, such as anonymised IP address, device, browser, pages visited, traffic source and website usage data;
- any additional information voluntarily provided by the user.
Users are requested not to include special categories of personal data, such as health information, in the contact form unless strictly necessary.
3. Browsing and security data
During their normal operation, the IT systems used to run the website collect certain technical data whose transmission is implicit in the use of Internet protocols.
These data may include IP addresses, the date and time of a request, the page visited, device, browser, operating system and information concerning technical errors.
The data are processed to:
- ensure the correct operation of the website;
- maintain system security;
- prevent misuse, unauthorised access and fraudulent activity;
- obtain technical and statistical information about the website’s operation.
The legal basis is the Controller’s legitimate interest in ensuring the security and correct operation of the website under Article 6(1)(f) GDPR.
4. Information and availability requests
When users submit the contact form, the following data may be collected:
- first name and surname;
- email address;
- telephone number;
- requested dates;
- number of guests;
- message content.
The data are used solely to respond to the request, check the property’s availability, provide a quotation and supply information needed to organise the stay.
The legal basis is taking steps at the user’s request prior to entering into a contract under Article 6(1)(b) GDPR.
Fields marked as mandatory are necessary to receive a response. Without these data, it may not be possible to handle the request properly.
Requests that do not result in a booking are retained for no longer than 12 months, unless a longer period is necessary to establish, exercise or defend legal claims.
5. Bookings and payments through Xenion
The website contains links to the external Xenion booking system. When users select these links, they are redirected to an external platform governed by its own terms and privacy information.
The booking platform may collect identification and contact details, information concerning the stay, billing details and payment information.
Data made available to Pennella are processed to:
- manage the booking;
- provide the requested accommodation and services;
- communicate with the guest;
- manage payments, cancellations and refunds;
- comply with administrative, accounting, tax and public-security obligations;
- protect the Controller’s rights in the event of a dispute.
The legal bases are the performance of a contract or pre-contractual steps under Article 6(1)(b) GDPR and compliance with legal obligations under Article 6(1)(c) GDPR.
Payment data are handled through the platform and the relevant payment service providers. Pennella does not directly collect or store complete payment-card details, except where otherwise stated within the external platform.
Booking records are retained for the time needed to provide the stay and subsequently for the period required by administrative, tax and accounting legislation, generally 10 years, without prejudice to longer periods required in connection with disputes or legal proceedings.
Before completing a booking, users should read the privacy notice available on the Xenion platform and that of the relevant payment service provider.
6. WhatsApp contact
The website may contain a link allowing users to contact Pennella through WhatsApp.
Using WhatsApp is voluntary. If users choose this service, their telephone number, profile name, message content and any attachments are processed to answer the request and manage the stay or booking.
The legal basis is taking steps at the user’s request prior to entering into a contract or performing a contract under Article 6(1)(b) GDPR.
WhatsApp is provided by a third party and processes data in accordance with its own privacy policy. Users are advised not to send unnecessary documents or information through WhatsApp and to read the service’s privacy policy before using it.
7. Legal obligations concerning guests
When a booking is made, guests’ personal data may be processed to comply with the legal obligations applicable to accommodation providers.
Data required by law may be disclosed to:
- the Italian public-security authorities through the Alloggiati Web portal;
- the competent regional authorities and bodies responsible for tourism statistics;
- tax, administrative or judicial authorities where required by law.
The legal basis is compliance with a legal obligation to which the Controller is subject under Article 6(1)(c) GDPR.
Identity documents required for guest registration are not collected through this website.
8. Matomo Analytics
The website uses Matomo Analytics for WordPress to obtain aggregated statistics concerning website usage.
Matomo is configured to operate without tracking cookies and with IP-address anonymisation. Statistical data are managed within the website’s infrastructure and are not used to profile users, identify them directly or combine them with information from other sources.
The following information may be collected:
- pages visited;
- visit duration and navigation path;
- traffic source;
- device, browser and operating system;
- approximate geographical area;
- links selected;
- anonymised IP address.
The data are processed to understand how the website is used and improve its content, performance and usability.
The legal basis is the Controller’s legitimate interest in obtaining aggregated statistics and improving the website under Article 6(1)(f) GDPR.
Non-aggregated analytics data are retained for no longer than 13 months. Aggregated reports that do not identify users may be retained for a longer period.
9. Google Maps
The website may use Google Maps to display the property’s location and help users organise their journey.
The service is provided by Google. When the map is activated, Google may receive technical data, including the user’s IP address and information about the device and page visited, and may use cookies or similar technologies.
Where required, Google Maps is loaded only after the user has provided consent. The legal basis is therefore consent under Article 6(1)(a) GDPR.
Consent can be withdrawn at any time through the website’s cookie settings, without affecting the lawfulness of processing carried out before its withdrawal.
Google may process data outside the European Economic Area using the safeguards required under applicable law. Further information is available in Google’s Privacy Policy.
10. Google Fonts
The website uses Google Fonts typefaces.
When font files are hosted locally on the website’s server, no data are transmitted to Google in order to display them.
If any fonts are loaded directly from Google’s servers, the user’s browser may transmit technical information to Google, including the IP address. In this case, the service is managed in accordance with the preferences expressed through the website’s consent system.
11. Cookies and consent management
The website uses Complianz to collect and store users’ preferences concerning cookies and external services.
Information concerning cookie categories, purposes, duration and the services using them is provided in the separate Cookie Policy, available through the relevant link on the website.
Users may change or withdraw their choices at any time by selecting the “Manage consent” or “Cookie settings” link.
12. Hosting and technical management
The website is hosted by Aruba S.p.A., which may process technical and browsing data required to provide hosting, security, backup and infrastructure-maintenance services.
The website is built using WordPress and Elementor. These tools are used for the website’s technical and visual management and do not necessarily involve data disclosure to third parties unless external services or integrations are enabled.
The Controller may engage technical service providers for maintenance and support. These providers process data solely on the Controller’s instructions and, where necessary, are appointed as processors under Article 28 GDPR.
13. Data recipients
Personal data may be disclosed, where strictly necessary, to:
- hosting and IT service providers;
- booking-system and payment service providers;
- administrative, tax and legal advisers;
- website maintenance and technical-support providers;
- public-security authorities;
- regional administrations and other public bodies;
- judicial or administrative authorities where required by law.
Personal data are not sold or publicly disclosed.
14. Transfers outside the European Economic Area
Some external services, such as Google or WhatsApp, may involve the processing of data in countries outside the European Economic Area.
In these cases, transfers are based on a European Commission adequacy decision or other safeguards provided under Articles 44 et seq. GDPR, including standard contractual clauses where applicable.
15. Processing methods and security
Data are processed using electronic and, where necessary, paper-based tools. Appropriate technical and organisational measures are adopted to protect personal data against unauthorised access, loss, disclosure, alteration or destruction.
Access is limited to persons who need the data to perform the relevant activities.
16. Data-subject rights
Where provided by the GDPR, users may request:
- access to their personal data;
- correction of inaccurate data;
- deletion of their data;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interests;
- withdrawal of consent at any time;
- information concerning the recipients to whom their data have been disclosed.
Requests may be sent to in**@******la.it.
Users also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali, following the procedure available at www.garanteprivacy.it.
17. Requirement to provide data
Providing data through the contact form is voluntary, although fields marked as mandatory are needed to answer the request.
Providing the information required for booking and guest registration is necessary to enter into and perform the contract and comply with legal obligations. Failure to provide these data may make it impossible to complete the booking or provide the accommodation.
18. Children
The website and booking services are not intended to collect personal data directly from children. Any information concerning children that is required to manage a stay must be provided exclusively by a person holding parental responsibility or by an authorised adult.
19. Changes to this Privacy Policy
The Controller may update this Privacy Policy to reflect legal, technical or service-related changes.
The updated version will be published on this page together with the date of the latest revision.