In accordance with Article 13 of EU Regulation 2016/679 (hereinafter "GDPR"), Charme in Spello provides the following information regarding the processing of personal data of users who visit the website and use the services offered.
1. Data Controller
The data controller is:
- Alessandra Calzolari
- Via Porta Prato 6, 06038 Spello (PG)
- Phone:
- PEC: alessandra.calzolari@postecert.it
- CIN: IT054050C245036513
2. Processing Purposes
Personal data provided by users is processed for the following purposes:
- Reservation Management: to process and confirm vacation home booking requests;
- Communications: to respond to information requests and provide assistance;
- Contractual Performance: for the execution of the holiday rental contract;
- Legal Obligations: to comply with obligations provided by tax, accounting, and public security regulations;
- Marketing (with consent): to send promotional communications relating to the services offered, only with prior explicit consent.
3. Legal Basis for Processing
Personal data processing is based on:
- Contract Performance (art. 6, para. 1, lit. b GDPR) for reservation management;
- Legal Obligation (art. 6, para. 1, lit. c GDPR) for tax and public security compliance;
- Data Subject Consent (art. 6, para. 1, lit. a GDPR) for the sending of promotional communications;
- Legitimate Interest (art. 6, para. 1, lit. f GDPR) for the protection of rights in legal proceedings.
4. Data Collected
Personal data collected includes:
- Identification Data: name, surname, email address, phone number;
- Booking Data: check-in and check-out dates, number of guests;
- Navigation Data: IP address, browser type, operating system (collected automatically);
- Contact Data: message sent via the contact form.
5. Processing Methods
Personal data is processed with computer and telematic tools, with methods strictly correlated to the purposes indicated and with the adoption of security measures suitable to guarantee data protection.
6. Data Communication and Disclosure
Personal data may be communicated to:
- Public Authorities: for legal compliance (e.g., Police for public security obligations, Tax Agency);
- Service Providers: web hosting, email management, payment platforms, only as Data Processors;
- Consultants: professionals and companies providing assistance in legal, tax, and accounting matters.
Data will not be disclosed or transferred to third parties for commercial purposes.
7. Data Transfer Abroad
Personal data is stored on servers located in the European Union. Any transfers to third countries will only occur in the presence of adequate guarantees provided by the GDPR.
8. Data Retention Period
Personal data will be retained for the time necessary to:
- Fulfill the purposes for which they were collected;
- Comply with legal obligations (e.g., retention of tax documents for 10 years);
- Manage any disputes (statute of limitations for rights).
After such period, data will be deleted or anonymized in an irreversible manner.
9. Data Subject Rights
As a data subject, you have the right to:
- Access (art. 15 GDPR): obtain confirmation of the existence of personal data concerning you and request a copy;
- Rectification (art. 16 GDPR): obtain the correction of inaccurate data or the completion of incomplete data;
- Erasure (art. 17 GDPR): obtain the deletion of data in certain circumstances;
- Restriction (art. 18 GDPR): obtain the restriction of processing;
- Data Portability (art. 20 GDPR): receive data in structured format and transmit them to another controller;
- Objection (art. 21 GDPR): object to data processing for legitimate reasons;
- Withdrawal of Consent: withdraw consent at any time, without prejudicing the lawfulness of processing based on consent given before the withdrawal.
10. How to Exercise Your Rights
To exercise the rights listed above, you can contact the data controller:
- Email: via the contact form on the website
- Phone:
- PEC: alessandra.calzolari@postecert.it
- Ordinary Mail: Via Porta Prato 6, 06038 Spello (PG)
11. Right to Lodge a Complaint
You have the right to lodge a complaint with the Guarantor Authority for the Protection of Personal Data if you believe that the processing of your personal data violates the GDPR.
12. Cookies
The website uses technical cookies strictly necessary for the operation of the site. Profiling cookies or third-party cookies for marketing purposes are not used without your explicit consent.
13. Changes to Privacy Policy
This Privacy Policy may be modified over time. Any modifications will be published on this page with the indication of the date of last update.
Last updated: January 3, 2026
