Privacy Policy

This Privacy Policy explains what information is collected when you visit villarosa.com (the "Site"), how it is used, and your rights under the General Data Protection Regulation (GDPR).

This Site is operated on behalf of Villa Rosa as a direct booking website. We are committed to handling your personal data with transparency and care.

1. Data Controller

The data controller for this website is:

If you have any questions about how your personal data is processed, you may contact us at the address above.

2. What Data We Collect and Why

2.1 Booking Information (via Smoobu)

This Site uses an embedded booking widget provided by Smoobu GmbH. When you make a reservation through this widget, Smoobu collects and processes:

• Your name, email address, and phone number
• Payment information (processed securely by Smoobu and its payment partners)
• Booking details: check-in and check-out dates, number of guests
• Any messages you send through the booking system

This data is collected and stored by Smoobu, not by Villa Rosa directly. Smoobu acts as a data processor on our behalf under Article 28 GDPR. Villa Rosa has entered into a Data Processing Agreement with Smoobu.

Smoobu's privacy policy is available at smoobu.com/en/privacy-policy.

The legal basis for this processing is the performance of a contract (Article 6(1)(b) GDPR) — specifically, to process your booking request.

2.2 Maps (via Google Maps)

This Site embeds a map from Google Maps to display the property location. When you view the map, Google may collect your IP address and certain browser information.

Google acts as an independent data controller for the data collected through the Maps embed. Google's privacy policy is available at policies.google.com/privacy.

The legal basis for this processing is your consent (Article 6(1)(a) GDPR), obtained through the cookie consent banner before the map is loaded.

2.3 Fonts (via Google Fonts)

This Site loads fonts from Google Fonts. When the page loads, your browser makes a request to Google's servers, which may log your IP address. Google Fonts do not set cookies and do not track users across websites. More information is available at developers.google.com/fonts/faq/privacy.

2.4 Contact via WhatsApp or Phone

If you contact us directly via WhatsApp, phone, or email, the information you provide (your name, contact details, and the content of your message) will be used solely to respond to your enquiry and arrange your booking. This data is not stored in any database — it exists only in our messaging and email accounts.

The legal basis is legitimate interest (Article 6(1)(f) GDPR) — responding to an enquiry you have initiated.

3. Cookies

Cookies are small text files stored in your browser. This Site uses cookies in the following ways:

• Consent preference cookie — we store your cookie consent choice in your browser's localStorage under the key bnb_consent_v1. This is a functional record with no expiry; it is not transmitted to any server.
• Smoobu widget cookies — set only after you give consent, to enable the booking calendar and session management. See Smoobu's cookie policy for details.
• Google Maps cookies — set only after you give consent, when the map is loaded. These cookies may be used by Google to identify your browser for security and analytics purposes.

We do not use advertising cookies, social media trackers, or analytics tools such as Google Analytics.

4. How Long We Keep Your Data

Villa Rosa does not store guest booking data in its own systems. All booking records are retained by Smoobu in accordance with their data retention policy and applicable legal obligations (including Italian tax and accounting law, which may require retention of booking records for up to 10 years).

Contact messages sent via WhatsApp or email are retained only as long as necessary to manage the booking or respond to an enquiry, and are deleted when no longer needed.

5. Data Transfers Outside the EU

Smoobu and Google may transfer data to countries outside the European Economic Area (EEA). Both companies rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal basis for such transfers. For details, see their respective privacy policies.

6. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can request that we delete your personal data, subject to our legal obligations.
• Right to restriction of processing — you can ask us to limit how we use your data in certain circumstances.
• Right to data portability — you can request your data in a structured, commonly used, machine-readable format.
• Right to object — you can object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time by clearing your browser's localStorage or by contacting us.

To exercise any of these rights, please contact us:

We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.

7. Third-Party Links

This Site may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal data.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, the "Last updated" date below will be revised. We encourage you to review this page periodically. Material changes will be communicated by updating the date and, where appropriate, by a notice on the Site.