This notice describes how personal data of visitors and customers of hospitality.sacrobosco.eu is processed, pursuant to Regulation (EU) 2016/679 ("GDPR").
Data controller
Bosco Sacro di Bomarzo srl
Località Giardino snc — 01020 Bomarzo (VT), Italy
VAT no. / Tax code: 01579690569
Email: hospitality.sacrobosco@gmail.com
What data we process, why, and on what basis
1. Browsing data
The systems that run this website collect, in the course of their normal operation, certain technical data (IP address, time of the request, pages visited, browser used). This data is used solely to ensure the operation and security of the site (legal basis: legitimate interest) and is kept for the time technically necessary.
2. Booking and contact requests
When you fill in the request form on the accommodation pages, we process the data you provide — first name, last name, email, phone number, dates of stay, number and type of guests and any special needs — for the sole purpose of handling your booking request and getting back to you (legal basis: pre-contractual measures taken at your request). The same applies to enquiries you send us directly by email. The form is protected by Google reCAPTCHA for anti-spam and security purposes (legitimate interest); the service is provided by Google Ireland Ltd.
3. Bookings and purchases
To manage bookings and stays we process the data required for the contract: personal and contact details, booking details (dates, guests, property), and any customer account (legal basis: performance of the contract). Tax-related data connected to payments is processed to comply with legal obligations (legal basis: legal obligation).
4. Payments
Online payments are handled by PayPal: payment details (card, account) are sent directly to the provider and neither pass through nor are stored on our systems. PayPal acts as an independent data controller; please refer to its privacy notice.
5. Public security obligations
As an accommodation provider we are required to report our guests' details to the Alloggiati Web portal of the Italian State Police (art. 109 TULPS — legal basis: legal obligation). For this purpose, an identity document is required for each guest at check-in.
Recipients of the data
Data may be processed on behalf of the Controller, within the limits of their respective roles, by: technical service providers (website hosting and maintenance), administrative and tax advisors, and payment institutions (PayPal). Data is never disclosed or sold to third parties for commercial purposes.
Transfers outside the EU
Some providers (Google, PayPal) may process data in countries outside the EU; in such cases the transfer takes place on the basis of adequacy decisions or the standard contractual clauses approved by the European Commission.
Retention periods
- Contact requests: up to 24 months from the last interaction.
- Booking data and tax documents: 10 years, as required by law.
- Customer account: until you request its deletion.
Your rights
You may exercise at any time the rights provided for by articles 15–22 GDPR: access, rectification, erasure, restriction, portability, objection. Just write to hospitality.sacrobosco@gmail.com. If you believe a processing operation violates the law, you may lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
Cookies
For the use of cookies and similar technologies, please see the Cookie policy.
Last updated: July 2026.