Notice
Privacy and cookies
Notice under Article 13 of Regulation (EU) 2016/679.
Data controller
Andrea Maria Gradante, manager of La Bandita Cottage. Contact: info@labanditacottage.it and +39 347 574 7767. CIN IT055030C101032675.
Data and purposes
Information voluntarily sent by WhatsApp, phone or email is used to answer inquiries, prepare quotes, administer bookings and comply with legal requirements. The infrastructure may also temporarily process IP address, request date and time, and technical device information in logs needed to deliver and protect the website.
How the form works
To check availability, the form sends only the arrival and departure dates to this website. The server compares them with availability calendars; it does not disclose the calendar contents to visitors. Other fields are processed in your browser to prepare a message. If you choose to open WhatsApp, the text is transferred to that external service; you must send it in WhatsApp for Andrea to receive it. This website does not save those fields in an inquiry database.
Providing information is optional, but dates are needed for the availability check and contact details are needed to answer an inquiry. You can also contact us by phone or email. Do not enter identity documents, health information or other sensitive details in the form.
Legal basis
Inquiries and bookings are processed for requested pre-contractual steps and performance of the contract (Article 6(1)(b) GDPR); statutory duties are based on legal obligations (Article 6(1)(c)). Technical processing for security and abuse prevention is based on the legitimate interest in protecting the website (Article 6(1)(f)). No marketing is sent without specific consent. Automatic quotes are indicative: bookings require the host’s personal confirmation and are not decided automatically by the website.
Retention
Unconverted inquiries are retained for up to 12 months, unless needed for legal protection. Booking, payment and tax records are retained for the legally required period.
Recipients and providers
Where necessary to provide the services, data may be processed by: OpenAI, which publishes the website through Sites; Cloudflare, for delivery, security and technical logs; Aruba S.p.A., for the domain and email service; Microsoft, when the mailbox is accessed through Outlook; and Meta, only if the user opens WhatsApp and sends the message. Airbnb and Booking.com provide the availability calendars to the server: the website extracts occupied dates only and does not disclose calendar contents to visitors. Providers act as processors or independent controllers depending on the service and their respective terms. Data may also be disclosed to competent authorities where required by law.
Links to Google Maps, Waze, Instagram, Airbnb and Booking.com open external services governed by their respective privacy notices; none is embedded in the page or activated before a click.
Transfers outside the EEA
Some international providers may process data outside the European Economic Area. Where applicable, transfers rely on a European Commission adequacy decision, the EU-US Data Privacy Framework for participating recipients, or the European Commission’s Standard Contractual Clauses together with any further safeguards required by law. You may request information or a copy of the applicable safeguards by contacting the Data Controller.
Your rights
You may request access, rectification, erasure, restriction, objection or portability where applicable under Articles 15–22 GDPR by writing to info@labanditacottage.it, and lodge a complaint with the Italian Data Protection Authority.
Anonymous statistics, cookies and tracking
The website collects essential aggregate statistics about pages viewed, time, country, language, any referring website and selected actions used to assess the inquiry journey: the availability-check outcome and opening the WhatsApp link. Selected dates, message text and other form fields are not stored in these statistics. The website uses no analytics cookies, does not store IP addresses and creates no advertising or behavioural profiles. To distinguish approximate visits during the same day, the IP address and browser type are immediately transformed into an anonymous code that changes daily; the original data is not retained in the analytics database. Processing is based on the Data Controller’s legitimate interest in evaluating and improving the website (Article 6(1)(f) GDPR). Statistics are accessible only to the Data Controller and retained for no longer than 13 months.
The website uses no advertising cookies or profiling systems. External services are activated only when the user selects the relevant link. If non-essential services are added in future, they will remain disabled until consent is obtained.
Technical security cookie
The Cloudflare infrastructure uses the __cf_bm cookie to protect against harmful automated traffic. It expires after 30 minutes of continuous inactivity and is not used for advertising. Consent is not requested for this strictly necessary function. You can block cookies in your browser settings, but this may affect security functions.
Cloudflare states that cookie data may also be processed in the United States. Its information about processing and transfers is available in the Cloudflare privacy policy; the cookie’s purpose and duration are described in its cookie documentation.
Last updated: 15 September 2026.