Privacy Policy

Personal data processing notice pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR)

1. Data Controller

The Data Controller for the personal data collected through the website www.malgavalcigolera.it:

Malga Valcigolera
Loc. Valcigolera – 38054 Primiero San Martino di Castrozza
info@malgavalcigolera.it
Partita IVA: 02251880221

2. Types of data collected

In the course of normal browsing of the website and use of its services, the Controller may collect the following categories of data:

Browsing data: IP addresses, browser types, operating system and other parameters relating to the device used, automatically collected by the website’s IT systems during their normal operation;
Data voluntarily provided by the user: identification and contact data (e.g. name, surname, email address, phone number) provided spontaneously by writing to the email address or phone number shown on the site to request information or make a booking;
Stay-related data: should a booking be finalized, the guests’ personal and identity document data required for legal obligations relating to public security (e.g. reporting to the Police via the “Alloggiati Web” portal) and tourist tax;
Cookies and similar technologies: for details, please refer to the

3. Purposes of processing and legal basis

Personal data is processed for the following purposes:

to respond to information requests and manage contact with users, on the basis of pre-contractual measures taken at the request of the data subject (Art. 6.1.b GDPR);
to manage the booking and performance of the tourist rental agreement, on the basis of the performance of a contract to which the data subject is party (Art. 6.1.b GDPR);
to comply with legal obligations relating to public security, tax matters and tourist tax (e.g. communications to the Police, the Municipality and the Revenue Agency), on the basis of compliance with a legal obligation (Art. 6.1.c GDPR);
to carry out aggregated statistical analysis of website usage through Google Analytics, on the basis of the user’s consent (Art. 6.1.a GDPR), collected via the dedicated cookie banner;
to protect the Controller’s rights in legal proceedings, on the basis of the Controller’s legitimate interest (Art. 6.1.f GDPR).

Providing data is optional for information requests, but failure to provide it may make it impossible to respond to the request. To conclude and perform the tourist rental agreement and for the related legal obligations, providing the data is instead necessary.

4. Processing methods

Processing is carried out using IT and/or paper-based tools, with logic strictly related to the purposes indicated and, in any case, in a way that guarantees the security, integrity and confidentiality of the data, in compliance with the organizational, physical and logical measures required by current legislation.

5. Disclosure and transfer of data

Personal data may be disclosed, for the purposes indicated above, to the following parties:

technical and IT service providers (e.g. website hosting and management services);
consultants and professionals (e.g. accountant) for tax and administrative obligations;
competent public authorities (e.g. Police, Municipality, Revenue Agency) for compliance with legal obligations;
Google Ireland Limited / Google LLC, as provider of the Google Analytics and Google Maps services.

Some of these parties, in particular Google LLC, are based in the United States; any transfer of data to countries outside the EEA takes place on the basis of adequate safeguards provided for by the GDPR, such as the Standard Contractual Clauses adopted by the European Commission, as indicated in the respective providers’ privacy notices.

Data is in no way disseminated.

6. Data retention period

Data is retained for the time strictly necessary to achieve the purposes for which it was collected, in compliance with legal deadlines. Specifically: data relating to simple information requests is retained for the time necessary to handle the request; data relating to the contract and tax obligations is retained for the periods set out by civil and tax legislation (generally 10 years); data relating to public security obligations is retained for the periods set out by the relevant legislation.

7. Data subject rights

As a data subject, you have the right to obtain from the Controller at any time, within the limits and conditions set out in Articles 15-22 of the GDPR:

confirmation of the existence of processing and access to your personal data (right of access);
rectification of inaccurate data or completion of incomplete data;
erasure of data, in the cases provided for by law (right to be forgotten);
restriction of processing;
data portability, where technically possible;
objection to processing, in whole or in part;
withdrawal of consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal.

To exercise these rights, you can write to info@malgavalcigolera.it.

You also retain the right to lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), if you believe that the processing of your data breaches applicable law.

8. Minors

The website is not intended for individuals under 16 years of age, and the Controller does not knowingly collect data relating to minors without the consent of those exercising parental responsibility.

9. Cookies

For detailed information on the cookies and tracking technologies used by the website, please refer to the Cookie Policy.

10. Changes to this notice

The Controller reserves the right to make changes to this notice at any time, giving notice to users on this page. Please check this page frequently, referring to the last update date shown at the bottom.

Last updated: August 18, 2026