Privacy policy

This is a courtesy translation: the Italian version prevails.

This policy explains how we process the personal data of visitors to torredifyos.it and of people who contact us through the website, under Articles 13 and 14 of Regulation (EU) 2016/679 («GDPR») and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 («Italian Privacy Code»).

1. Data controller

Torre Di Fyos S.r.l.
Registered office: Corso Novara 36, 80143 Napoli (NA), Italy
Property: Via Noce snc, 84060 Perdifumo (SA), Italy
VAT no. 10160071212
Email: info@torredifyos.it, certified email (PEC): agricolatorredifyossrl@legalmail.it, phone +39 0974 184 8118

You can use these contacts for any question about your data and to exercise your rights.

2. What data we process

• Data you send with the form (Contact and Book pages): name, email, phone (optional), topic, text of your message, the page you write from and the date it was sent.
• Data you give us directly if you email, message us on WhatsApp or call us from the links on the site: your contact details and what you write or tell us.
• Browsing data: the servers hosting the site automatically record IP address, date and time, page requested and browser type, needed to run and secure the site. For the form's sending limit, the IP address is stored only in an encrypted, non-reversible form, for one hour.
• Cookies and similar tools: described in the cookie policy.

Please do not include unnecessary data in your message. If you choose to tell us about health matters (for example food allergies or intolerances, mobility needs) we use them only to answer your request and organise your stay, based on the consent you give by sending them (Art. 9.2.a GDPR). If you write on behalf of other people (family members, friends travelling with you), make sure they agree.

3. Why we process it and on what legal basis

Purpose	Legal basis	Providing data
a) Answering requests for information, checking availability and offering you a stay	Pre-contractual steps at your request (Art. 6.1.b GDPR)	Needed to get an answer
b) Protecting the site and forms from spam, abuse and cyber attacks, also with Cloudflare Turnstile	Legitimate interest in security (Art. 6.1.f GDPR)	Needed to use the site
c) Complying with legal obligations and requests from authorities	Legal obligation (Art. 6.1.c GDPR)	Mandatory
d) Defending our rights in case of disputes	Legitimate interest (Art. 6.1.f GDPR)	Needed
e) Aggregate visit statistics with Google Analytics	Consent given in the cookie banner (Art. 6.1.a GDPR and Art. 122 Italian Privacy Code)	Optional, can be withdrawn

We do not use form data for newsletters, advertising or profiling, we do not pass it to third parties for their own purposes, and we make no decisions based solely on automated processing.

4. How we process it

Data is processed electronically and, to a limited extent, on paper, only for the purposes above and with appropriate technical and organisational measures (Art. 32 GDPR): encrypted connection (HTTPS), access limited to authorised staff, no copy of messages stored on the website (the form forwards them to our mailbox).

5. How long we keep it

• Information requests and correspondence: 24 months from the last contact, unless they lead to a stay (then the legal retention periods apply, for example 10 years for accounting records, Art. 2220 of the Italian Civil Code).
• Server logs: up to 51 days (21 on the server, then in the backups), unless requested by the authorities.
• Data used for the form's sending limit: one hour.
• Cookies: as stated in the cookie policy.

After that, data is deleted or anonymised, unless it is needed to defend a legal claim.

6. Who we share it with

• The controller's staff authorised to process it (Art. 29 GDPR).
• Providers that help us run the website and email, appointed as processors (Art. 28 GDPR): hosting and email service providers, whoever maintains the website, Cloudflare, Inc. (anti-spam check on the forms), Google Ireland Ltd (statistics, only with your consent).
• Advisers (accountant, lawyer) and public authorities, when required by law or to defend our rights.

Data is never made public. The up-to-date list of processors is available on request at info@torredifyos.it.

7. Transfers outside the European Union

The website and email are hosted on servers in Italy (Turin), with encrypted backups in Germany. The hosting provider is based in the Republic of San Marino, which has no adequacy decision from the European Commission: access by its technicians is governed by the standard contractual clauses approved by the Commission (Art. 46.2.c GDPR). Some providers (Cloudflare, Google) may also process data in the United States: transfers rely on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or, failing that, on the standard contractual clauses approved by the Commission (Art. 46.2.c GDPR).

8. Your rights

Under Articles 15-22 GDPR you have the right to:

• know whether we process your data and get a copy (access, Art. 15);
• have it corrected or completed (rectification, Art. 16);
• have it erased, where applicable (Art. 17);
• ask us to restrict processing (Art. 18);
• receive it in a commonly used format and transmit it to another controller (portability, Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw your consent at any time, without affecting processing carried out before (Art. 7.3).

9. How to exercise them

Write to info@torredifyos.it or to the certified email agricolatorredifyossrl@legalmail.it, or by registered letter to Torre Di Fyos S.r.l., Corso Novara 36, 80143 Napoli (NA), Italy. It is free of charge. We reply within one month of your request, extendable by two months for particularly complex requests (Art. 12 GDPR); if so, we will let you know.

10. Complaints to the supervisory authority

If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome (garanteprivacy.it), Art. 77 GDPR, or with the supervisory authority of the EU country where you live or work, or go to court.

11. What happens if you do not provide data

Name, email and message are needed to answer you: without them we cannot handle your request. Phone is optional. You can always contact us by phone or in person as well.

12. Children

The form is not intended for children under 14: requests for them should be sent by a parent or guardian (Art. 2-quinquies Italian Privacy Code).

13. Links to external sites and services

The site links to third-party services (WhatsApp, social networks, Google Maps). When you open them, the data you give those services is processed by their operators under their own privacy policies.

14. Updates

We may update this policy, for example if we add new services to the site. The date of the last update is shown at the top of the page; significant changes are announced on the site.