This is a translation provided for convenience. In case of discrepancies, the Italian version prevails.

Information provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) to users of the website www.villacesarea.com.

1. Data controller

SUNTOUR S.r.l. – Via Roma 14, 73020 Santa Cesarea Terme (LE), Italy – VAT no. 05319360755 – email: info@villacesarea.com.

2. Data processed

  • Browsing data: IP address, browser type, pages visited and other technical data collected automatically by the website systems.
  • Data provided voluntarily: name, email, phone number and the content of messages sent by email, phone or contact forms.
  • Booking data: personal, contact and stay details entered in the booking form.
  • Cookies and tracking tools: see the Cookie Policy.

3. Purposes and legal bases

  • to answer requests for information and quotes (pre-contractual measures, Art. 6(1)(b) GDPR);
  • to manage bookings and stays (performance of a contract, Art. 6(1)(b));
  • to comply with legal obligations, such as reporting guests to the Public Security Authority, tax obligations and the tourist tax (legal obligation, Art. 6(1)(c));
  • to ensure the security and operation of the website (legitimate interest, Art. 6(1)(f));
  • to send newsletters and promotional communications, measure visits and show personalised advertising (consent, Art. 6(1)(a)), which can be withdrawn at any time.

4. Methods and retention

Data is processed using electronic and manual tools, with appropriate security measures to prevent loss, unlawful use and unauthorised access. It is kept for as long as necessary for the purposes indicated: information requests for up to 12 months; booking and tax data for the periods required by law (normally 10 years); data processed on the basis of consent until consent is withdrawn.

5. Recipients

Data may be disclosed to parties providing services to the Controller, appointed as data processors where necessary: the hosting provider (Aruba S.p.A.), the booking platform (CiaoBooking), email marketing and analytics services (Mailchimp, Google), Meta Platforms (Facebook/Instagram), tax and legal advisers. It may also be disclosed to the competent authorities where required by law. Data is not disseminated.

6. Transfers outside the EU

Some providers, such as Google and Meta, may process data in the United States. In these cases transfers are based on the EU-US Data Privacy Framework or on the Standard Contractual Clauses approved by the European Commission.

7. Provision of data

Providing the data needed to answer requests and manage bookings is mandatory: without it the service cannot be provided. Consent to newsletters, analytics and marketing is optional.

8. Your rights

You may exercise the rights provided for by Articles 15-22 GDPR at any time (access, rectification, erasure, restriction, portability, objection and withdrawal of consent) by writing to info@villacesarea.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

9. Updates

This policy may be updated. Last update: October 2026.

Write a review