S'arruga 'e is Portalis Holiday Home
Privacy Policy
under Articles 13 and 14 of Regulation (EU) 2016/679 · Last updated: 7 October 2026
This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 ("Privacy Code") to visitors of www.casavacanzesarrugaeisportalis.com, to anyone who contacts us and to guests of the holiday home. The Italian version is the reference text.
1. Data controller
Giorgio Lai
Via Sardegna 31 – 09019 Teulada (SU) – Italy
Email: giorgio.lai@outlook.com
Phone: +39 348 527 7113
The Controller runs the S'arruga 'e is Portalis Holiday Home, Via Cavour 33 – 09019 Teulada (SU), apartments "Mirto" and "Maestrale" – CIN (national identification code) IT111089C2000U3697 – property email sarrugaeisportalis@outlook.com.
No Data Protection Officer (DPO) has been appointed, as one is not required for this activity.
2. Data we process
- Contact data: first name, surname, email address, phone number, when you write to us by email, WhatsApp or phone.
- Stay request data: arrival and departure dates, number of guests, preferred apartment (Mirto or Maestrale), message text.
- Guest data (only if you stay with us): personal and ID document details of each guest, required by Italian law for reporting to the police (Questura); data needed for payments, receipts and tax obligations.
- Data from booking platforms: if you book through Booking.com, Airbnb or other portals, we receive from them the data needed to manage the booking.
- Browsing data: IP address, browser and device type, pages requested, date and time, automatically logged by the servers hosting the site for technical and security reasons; and, only with your consent, statistics collected by Google Analytics.
How the contact form works: the site's forms do not send data to our server. Pressing "Send request" opens your own email program with the message pre-filled: we only receive the data if you choose to send the email. The "Check availability" form takes you to Booking.com with the dates you selected.
We do not ask for or process special categories of data (Art. 9 GDPR, e.g. health data). Please do not include them in your messages.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering requests for information, availability and quotes (email, WhatsApp, phone) | Pre-contractual steps at your request – Art. 6(1)(b) GDPR |
| Managing your booking and stay: confirmation, check-in, assistance, useful information | Performance of the contract – Art. 6(1)(b) GDPR |
| Reporting guests' identity to the police through the Alloggiati Web portal (Art. 109 of the Italian Public Security Act) | Legal obligation – Art. 6(1)(c) GDPR |
| Tourism statistics reporting to the competent authorities (Sardinia Region/ISTAT) and, where applied by the municipality, tourist tax | Legal obligation – Art. 6(1)(c) GDPR |
| Tax and accounting obligations | Legal obligation – Art. 6(1)(c) GDPR |
| Website security and abuse prevention (server logs) | Legitimate interest – Art. 6(1)(f) GDPR |
| Anonymous website statistics with Google Analytics | Consent – Art. 6(1)(a) GDPR (can be withdrawn at any time) |
| Displaying external content (Google Maps, Tripadvisor widget) | Consent – Art. 6(1)(a) GDPR (can be withdrawn at any time) |
| Defending the Controller's rights in case of disputes | Legitimate interest – Art. 6(1)(f) GDPR |
Providing data to answer your request and manage your stay is necessary: without it we cannot reply or conclude the rental. Guest data required by law is mandatory. Consent to statistics and external content is optional, and refusing it does not limit your use of the site.
We do not carry out profiling or decisions based solely on automated processing (Art. 22 GDPR). We do not send newsletters or promotional messages.
4. Processing and security
Data is processed electronically and, where necessary, on paper, with appropriate technical and organisational measures against unauthorised access, loss or destruction (Art. 32 GDPR). Only the Controller and, where necessary, persons authorised and instructed by him have access.
5. Recipients
- Technical service providers acting as processors (Art. 28 GDPR) or independent controllers: Netlify, Inc. (website hosting), Microsoft (Outlook email), Google (Google Analytics and Google Maps, only with your consent).
- Booking platforms (Booking.com, Airbnb and similar), for bookings made through them, as independent controllers under their own policies.
- Messaging services (WhatsApp, Meta), if you choose to contact us that way.
- Public authorities: police (Alloggiati Web), tourism statistics bodies, the municipality, tax authorities and others where required by law.
- Professionals (accountant, legal advisers), bound by confidentiality.
Data is never sold or shared with third parties for marketing purposes, and is not published.
6. Transfers outside the European Economic Area
Some providers (Netlify, Google, Microsoft, Meta) are based in, or use servers in, the United States. Transfers rely on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (10 July 2023) for certified providers and/or on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR).
7. Retention
| Data | Period |
|---|---|
| Enquiries not followed by a booking | 12 months from the last contact |
| Booking data, receipts and accounting records | 10 years (Italian Civil Code Art. 2220 and tax law) |
| Alloggiati Web submission receipts | 5 years, as required by public security rules; we do not keep copies of ID documents beyond what is needed for the submission |
| Server logs | For the period set by the hosting provider for security purposes, normally no longer than a few months |
| Google Analytics cookies (if you consent) | Up to 13 months; statistics kept in Google Analytics for 14 months |
| Your cookie choice | 6 months, then we ask again |
8. Your rights
At any time you can ask the Controller (Arts. 15–22 GDPR) for access to your data, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting prior processing (for cookies: "Cookie preferences" link at the bottom of every page).
To exercise your rights write to giorgio.lai@outlook.com. We will reply without undue delay and at the latest within one month.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.
9. Cookies and tracking tools
The site uses only necessary technical tools and, with your consent, Google Analytics and external content (Google Maps, Tripadvisor). Fonts are hosted on our own site, with no connection to Google Fonts. Full details are in the Cookie Policy.
10. Children
The site is not aimed at children under 14 (Art. 2-quinquies of the Italian Privacy Code) and we do not knowingly collect their data through it. Bookings must be made by an adult. Data of minors staying with their family is processed only for legal obligations (police reporting).
11. Changes to this notice
We may update this notice, for example following changes in the law or in the services used by the site. The current version is always published on this page with its last-updated date.