Privacy & Cookie Policy

Information provided under Article 13 of EU Regulation 2016/679 (GDPR) to users browsing the events website of Villa Santa Barbara and sending us a request.

1. Data controller

Villa Santa Barbara — Via Federico Giunchi, 06036 San Luca, Montefalco (PG), Italy — VAT 03781260546 — CIN IT054030A101009840.
Email: info@villasantabarbaraevents.it · Phone: +39 0742 399402 · +39 393 140 0445.

2. What data we collect

Browsing data. The IT systems managing this website acquire some data whose transmission is implicit in the use of internet protocols: IP address, time of the request, requested page and outcome, information about the browser and the device. This data is used to ensure the correct functioning and security of the website.

Data you provide voluntarily. The contact form prepares a draft in your email application with your name, email address, phone number and the event details you choose to enter (date or period, guest count, event type and message). Completing the form and clicking “Send request” do not send these fields to the website server: we receive the data only when you actually send the email from your email application. We also receive information you choose to provide by email or telephone. Name and email are required by the form so that we can reply; the other fields are optional. Without contact details we cannot reply. Please do not send sensitive data that is unnecessary for your enquiry.

Restricted area. The management panel processes authorised users’ access data and records administration actions and security events. This information is used to manage access, protect the website and support maintenance.

3. Purposes and legal basis

• Replying to your enquiries and quote requests: performance of a contract or pre-contractual measures (Art. 6.1.b GDPR).
• Complying with legal, accounting and tax obligations (Art. 6.1.c GDPR).
• Ensuring website operation and security, managing panel access and preventing misuse: the controller’s legitimate interest in protecting systems and data (Art. 6.1.f GDPR).

4. Cookies and similar technologies

The public pages of this website do not use profiling cookies, advertising cookies or third-party cookies, and does not include visitor tracking or analytics tools.

To remember that you closed the notice, we use browser localStorage: the key vsb-cookie-notice is set to 1. This technical preference only prevents the notice from appearing again, contains no identifying data and is not transmitted to the server by the website code. No expiry is set: it remains until you clear the website data in your browser. The “Got it” button closes the notice and does not collect consent to profiling.

Both /preview/admin/ and /admin/ access the same restricted area, which uses a technical PHP session cookie for authentication, request protection and service messages. It contains a session identifier and lasts for the session, according to browser settings. The code configures it as HttpOnly, SameSite=Lax and Secure on HTTPS connections. It is not used for visitor profiling. The local preference and session cookie support their respective technical functions and do not require the consent needed for non-essential tracking.

Links to Google Maps and social networks open external services; they are not maps or content embedded in this page. After you open them, the external service’s processing is governed by its own privacy notice. If non-essential tracking tools are introduced, this notice will be updated and consent will be requested before they are activated.

How to manage cookies. From your browser menu (Chrome, Safari, Firefox, Edge) you can block or delete cookies and locally stored data. Disabling technical cookies may affect some website features.

5. Disclosure of data and recipients

Data may be processed, on behalf of the controller, by technical service providers (website hosting, IT maintenance, email service), appointed as data processors under Art. 28 GDPR. Data is not disseminated, sold or shared with third parties for marketing purposes.

6. Data transfers

Processing takes place within the European Union. Should the use of a service involve a transfer to third countries, it will be based on appropriate safeguards under the GDPR (adequacy decisions or standard contractual clauses of the European Commission).

7. How long we keep data

• Personal data provided in connection with information requests and quotations is retained for as long as necessary to handle the request and any ensuing negotiations, taking into account the nature of the event, organisational timelines and any need to protect the Controller’s rights. If a contract is concluded, the data will be retained for the duration of the contractual relationship and for any additional periods required by applicable law.
• Browsing data and technical logs: for the period needed for website security, normally no longer than 12 months.
• Accounting and tax records: for the periods required by law (10 years).

8. Your rights

You may exercise the rights of access, rectification, erasure, restriction, objection and portability in the cases and under the conditions set out in Articles 15–22 GDPR. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing. The website does not carry out decisions based solely on automated processing or profiling. To exercise them, write to info@villasantabarbaraevents.it: we will reply without undue delay and normally within one month. Where permitted by Article 12 GDPR, this period may be extended by a further two months; we will inform you of the extension and its reasons within the first month.

9. Complaint to the supervisory authority

If you believe that the processing of your data infringes the law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or bring the matter before the courts.

10. Changes to this policy

This policy may be updated over time, also in relation to the evolution of the website and the services used. We invite you to review it periodically.

Last updated: 11 October 2026. This policy may be updated: the version published on this page is the one in force.

Back to the website