Privacy Policy

Last updated: 09/10/2026

Data Controller

Associazione La Grancia APS
Via La Grancia, Fraz. Serre, 53040 Serre di Rapolano (SI)
Controller contact email: info@livingrancia.it

Types of Data collected

Among the personal data processed by this website, either directly or through third parties, are: data entered in the contact form: first name, last name, email, phone, reason for the request, message and, for stay requests, chosen suite, arrival and departure dates, number of guests and rooms, presence of children and of people with mobility difficulties; data entered in the Serre in Posa participation form: first name, last name, date and municipality of birth, tax code, email, phone, municipality, province, postcode and address of residence, story and availability for the photo shoots; for minors also the minor's name, date of birth and tax code and the relationship with the person filling in the form; data of members registered in the reserved area: first name, last name, email, phone, date and place of birth, tax code, address, membership fees paid and notices read; IP address, usage data; IP address, usage data, data entered in forms; the data contained in the messages received from the forms; usage data, online identifiers. Complete details on each type of data are provided in the sections dedicated to the individual services. Data may be provided voluntarily by the user (for example by filling in a contact form) or collected automatically while browsing (for example usage data and technical identifiers).

Users who choose not to provide certain data may be unable to use the corresponding services (for example, a contact request cannot be answered without contact details).

Purposes and legal bases of processing

Data are processed for the following purposes:

Website operation and security: legal basis is the legitimate interest of the Controller (art. 6.1.f GDPR);
Statistics: legal basis is consent (art. 6.1.a GDPR);
Display of external content and marketing: legal basis is consent (art. 6.1.a GDPR);
Responding to user requests (contact forms, email): legal basis is the performance of pre-contractual measures requested by the data subject (art. 6.1.b GDPR);
Compliance with legal obligations: legal basis is art. 6.1.c GDPR.

For processing based on consent (art. 6.1.a GDPR), such as non-technical cookies, consent may be withdrawn at any time without affecting the lawfulness of processing carried out beforehand.

Methods and place of processing

Processing is carried out using IT and telematic tools, with security measures adequate to prevent unauthorised access, disclosure, modification or destruction of the data. In addition to the Controller, the data may be accessed by authorised internal parties and by external providers appointed, where necessary, as data processors (art. 28 GDPR), such as hosting and technical service providers. The data are processed at the Controller's operating offices and at the data centres of the providers listed in this policy.

Where a service involves the transfer of data outside the EU (in particular to the United States), the transfer takes place on the basis of adequacy decisions of the European Commission or standard contractual clauses (arts. 45 and 46 GDPR).

Retention period

Data are kept for the time necessary for the purposes for which they were collected: data provided to answer a request are kept for the time needed to handle it and for any legal obligations; data collected on the basis of consent are kept until consent is withdrawn, unless further retention obligations apply.

Third-party services used by this website

Vercel (hosting)

Provider: Vercel Inc. (USA). Purpose: website hosting, content delivery network and technical infrastructure (technical logs and cookieless analytics). Data processed: IP address, usage data. Transfer to Vercel Inc. (USA): the provider states in its privacy notice that it is certified under the EU-US Data Privacy Framework. Provider's privacy notice: https://vercel.com/legal/privacy-notice.

Supabase (database and backend)

Provider: Supabase, Inc. (USA). Purpose: website database, content storage and authentication of the reserved area. Data processed: IP address, usage data, data entered in forms. Transfers outside the EU are governed by standard contractual clauses (EU Decision 2021/914) incorporated in the provider's DPA (supabase.com/legal/dpa). Provider's privacy notice: https://supabase.com/privacy.

SiteGround (posta elettronica)

Provider: SiteGround Spain S.L.. Purpose: mailbox that receives and stores messages sent through the website forms. Data processed: the data contained in the messages received from the forms. Provider's privacy notice: https://it.siteground.com/privacy.htm.

Google Analytics 4

Provider: Google Ireland Limited. Purpose: aggregate statistics on website usage. Data processed: usage data, online identifiers. Transfers to Google LLC (USA) are covered by the EU-US Data Privacy Framework. Provider's privacy notice: https://policies.google.com/privacy.

YouTube (embedded videos, privacy-enhanced mode)

Provider: Google Ireland Limited. Purpose: display of videos embedded from the youtube-nocookie.com domain: according to google, in this mode views are not used to personalize browsing or ads. once a video is played, the provider's privacy notice applies. Data processed: IP address, usage data. Possible transfer to Google LLC (USA) covered by the EU-US Data Privacy Framework. Provider's privacy notice: https://policies.google.com/privacy.

Google Maps

Provider: Google Ireland Limited. Purpose: display of interactive maps. Data processed: usage data, online identifiers. Transfer to Google LLC (USA) covered by the EU-US Data Privacy Framework. Provider's privacy notice: https://policies.google.com/privacy.

Record of consents

When the user gives consent through the website forms (for example by subscribing to the newsletter or sending a contact request), the Controller keeps evidence of the consent (date, form filled in and content transmitted) in order to demonstrate that it was given, pursuant to art. 7 GDPR. These records are kept for as long as the consent remains active and for the applicable limitation periods.

Rights of the user

Under articles 15-22 GDPR, users have the right to obtain from the Controller access to their data, rectification, erasure, restriction of processing and portability, as well as the right to object to processing and to withdraw any consent given. Requests should be addressed to info@livingrancia.it.

Users also have the right to lodge a complaint with the competent supervisory authority: for Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Cookies

This website uses cookies and similar tools. The full notice is available in the Cookie Policy.

Definitions and legal references

Personal Data (or Data): any information relating to an identified or identifiable natural person, directly or indirectly, including by reference to an identifier such as a name, an identification number, location data or an online identifier (art. 4(1) GDPR).

Usage Data: information collected automatically through this website (including from third-party applications integrated into it), such as: IP addresses or domain names of the devices used, URI addresses, time of the request, method used to submit the request to the server, size of the file received in response, numerical code indicating the status of the server's response, country of origin, browser and operating system characteristics, duration of the visit and the path followed within the website.

User / Data Subject: the natural person using this website, to whom the Personal Data refers.

Data Controller: the natural or legal person that determines the purposes and means of the processing of Personal Data (art. 4(7) GDPR); it is identified at the top of this policy.

Data Processor: the natural or legal person that processes Personal Data on behalf of the Controller (art. 4(8) GDPR), such as the technical service providers listed in this policy.

Cookies and similar tools: small pieces of data stored on the user's device, or other tools (such as pixels, local storage, fingerprinting) that allow information to be stored on or accessed from the device.

Legal references: this policy is drawn up in accordance with Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code) as amended by Legislative Decree 101/2018, also taking into account the Italian Data Protection Authority's Guidelines on cookies and other tracking tools of 10 June 2021. It applies solely to this website.

Changes to this policy

The Controller may amend this policy at any time by publishing the updated version on this page. The date of the last update is shown at the top.