This Privacy Policy explains how personal data relating to visitors of www.molinodellabefa.it and users of services connected with Molino della Befa are processed, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable Italian data protection legislation.
1. Data Controller
The Data Controller is:
CAMPINUOVI Società Semplice Società Agricola
Podere Campinuovi – Cinigiano (Grosseto), Italy
VAT No. 01658590532
Molino della Befa
Podere Molino – Località La Befa
Strada Maremmana, 1
Murlo (Siena), Italy
Privacy enquiries: info@molinodellabefa.it
2. Categories of personal data processed
When visiting the website or using its related services, the following categories of personal data may be processed:
Browsing and technical data
The computer systems and software used to operate the website may automatically collect certain technical information, such as IP address, browser and device type, operating system, date and time of access, pages visited and other information necessary for the operation and security of the website.
Reservation data
When making a reservation, information such as name, email address, telephone number, date and time of the reservation, number of guests, messages or requests and other information required to manage the booking may be collected.
Allergies, intolerances and dietary requirements
Where a guest provides information concerning allergies, intolerances or other health-related matters, this information may constitute special-category personal data under Article 9 GDPR.
Providing this information is voluntary, but it may be necessary in order for us to assess and accommodate particular dietary requirements. Such information is used exclusively to organise the service and protect the guest’s safety and is processed on the basis of the guest’s explicit consent where required by applicable law.
Guests are requested to provide only information that is strictly necessary.
3. Purposes and legal bases
Personal data may be processed for the following purposes:
Website operation and security
To display the website correctly, ensure its technical operation, prevent misuse and protect its security.
Legal basis: the Controller’s legitimate interest in maintaining secure and properly functioning systems under Article 6(1)(f) GDPR.
Reservation and restaurant service management
To receive, confirm, modify or cancel reservations, communicate with guests and organise the requested service.
Legal basis: performance of a contract or steps taken at the guest’s request prior to entering into a contract under Article 6(1)(b) GDPR.
Management of allergies, intolerances and dietary requirements
To prepare, where reasonably possible, a service compatible with the requirements communicated by the guest.
Legal basis: the data subject’s explicit consent under Article 9(2)(a) GDPR, where applicable.
Legal, administrative and tax obligations
To comply with applicable legislation and to manage potential disputes or requests from public authorities.
Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR.
Information collected for reservations is not used by Molino della Befa for promotional communications unless the guest has given separate and specific consent.
4. Reservations through Superb
Online reservations linked from this website are managed through the external Superb platform, provided by Superb ApS, based in Denmark.
When users select the booking button, they are redirected to an environment operated by Superb. Superb may collect and process information necessary to manage the reservation, including identification and contact details, booking information, guest messages and any information provided concerning allergies or dietary requirements.
Superb may process certain information on behalf of Molino della Befa and, for certain purposes of its own, as an independent data controller. Such processing is also governed by Superb’s own Privacy Policy, which users are encouraged to review before using the service.
Depending on the configuration of the booking service, Superb may also manage reservation confirmations and reminders by email or SMS and other features connected with the booking process.
5. Recipients of personal data
Personal data may be processed by authorised staff and collaborators of the Controller and, where necessary, disclosed to parties providing services required for the operation of the business, including:
- hosting and IT service providers;
- reservation and guest-management providers;
- accounting, tax and legal advisers;
- communications service providers;
- public authorities or other parties where disclosure is required by law.
Where appropriate, providers processing personal data on behalf of the Controller are appointed as data processors pursuant to Article 28 GDPR.
Personal data are not sold to third parties.
6. International data transfers
Some technology providers used by the website or its connected services may process personal data outside the European Economic Area.
Where such transfers take place under the responsibility of the Controller, they are carried out in accordance with Chapter V GDPR, using adequacy decisions, Standard Contractual Clauses or other safeguards provided for by applicable legislation where necessary.
For processing carried out independently by external platforms, users should refer to the relevant provider’s privacy policy.
7. Data retention
Personal data are retained only for as long as necessary for the purposes for which they were collected.
In particular:
- reservation information is retained for as long as necessary to manage the service and any subsequent requests or disputes;
- information required for administrative, accounting or tax purposes is retained for the periods required by law;
- information concerning allergies, intolerances or health-related dietary requirements is retained only for as long as necessary to manage the relevant reservation and service, unless the guest has expressly authorised longer retention;
- technical and security data are retained for as long as necessary to ensure the security, integrity and proper functioning of the systems, in accordance with the technical policies of the relevant providers.
At the end of the applicable retention periods, personal data are erased or anonymised unless further retention is required by law or necessary for the establishment, exercise or defence of legal claims.
8. Cookies and tracking technologies
The website may use technical cookies or similar technologies that are strictly necessary for its operation and for providing services specifically requested by the user.
Technical cookies do not require the user’s consent, although their use is disclosed in this Privacy Policy.
If analytics cookies that cannot be treated as technical cookies, profiling cookies or other tracking technologies requiring consent are introduced in the future, they will only be activated following a positive choice by the user through an appropriate consent-management system.
Users will be able to change their choices at any time through the tools made available on the website, where applicable.
9. Links to third-party websites and services
The website contains links to services operated by third parties, including the Superb reservation platform and Google Maps.
A link to an external website does not necessarily involve the disclosure of personal data to that third party before the user selects the link. Once an external service is accessed, any processing carried out by its provider is governed by that provider’s own privacy policy.
Molino della Befa does not control the privacy practices of external websites.
10. Processing methods and security
Personal data are processed using electronic systems and, where necessary, paper-based records, with appropriate technical and organisational measures designed to protect them against unauthorised access, loss, destruction, alteration or improper disclosure.
Access to personal data is restricted to those who need it for the performance of their duties.
11. Provision of personal data
Providing the information necessary to make a reservation is required in order for us to manage the booking. Failure to provide such information may make it impossible to complete the reservation or provide the requested service.
Providing information regarding allergies, intolerances and dietary requirements is voluntary. However, where this information is necessary for the guest’s safety or to determine whether a particular requirement can be accommodated, failure to provide it may prevent us from managing the request appropriately.
12. Automated decision-making
Molino della Befa does not carry out automated decision-making, including profiling, that produces legal effects concerning users or similarly significantly affects them.
Any independent processing carried out by third-party services is governed by the relevant provider’s privacy policy.
13. Data subject rights
Where provided for by the GDPR, data subjects may exercise their rights, including the right to:
- obtain access to their personal data;
- have inaccurate data corrected or incomplete data completed;
- request erasure of their personal data;
- request restriction of processing;
- receive their data in a portable format, where applicable;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before consent was withdrawn.
Requests may be sent to:
info@molinodellabefa.it
or by post to:
CAMPINUOVI Società Semplice Società Agricola
Podere Campinuovi – Cinigiano (Grosseto), Italy
Data subjects also have the right to lodge a complaint with the Italian Garante per la Protezione dei Dati Personali (Italian Data Protection Authority) in accordance with the procedures indicated on the Authority’s official website.
14. Changes to this Privacy Policy
This Privacy Policy may be updated from time to time, including as a result of changes in legislation or the introduction of new services and technologies.
The most recent version will always be published on this page together with the date on which it was last updated.