Last updated: 22/10/2026
This Privacy Policy explains how Residence Carracci processes the personal data of users who visit this website and use its contact and quotation request services.
This notice is prepared in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and applicable Italian data protection legislation.
1. Data Controller
The data controller is:
Fabio Meliconi – owner of Sucre S.r.l., the company operating Residence Carracci.
- Registered office: Via dell’Osservanza 28, Bologna, Italy
- Property address: Via de’ Carracci 33, Bologna, Italy
- Privacy contact email: residenzacarracci@gmail.com
- Telephone: +39 051 361 280
2. Categories of Personal Data Processed
Depending on how users interact with the website, the following categories of personal data may be processed.
Data voluntarily provided by users
When users contact the property or submit a form, the following information may be collected:
- first and last name;
- email address;
- telephone number, if provided;
- intended check-in and check-out dates;
- number of guests;
- requested accommodation type;
- expected length of stay;
- message content and other information voluntarily provided.
Users are asked not to include unnecessary personal information in free-text fields, particularly special categories of personal data as defined in Article 9 GDPR.
Technical browsing data
When users browse the website, the IT systems and software procedures required for its operation may collect technical data, including IP addresses, browser and device information, request dates and times, and technical logs.
Such data are processed only to the extent necessary for website operation, security and maintenance, in accordance with the actual configuration of the infrastructure used.
Cookies and similar technologies
The website may use cookies and other storage or tracking technologies. The relevant categories, purposes, retention periods and third parties will be described in the separate Cookie Policy, based on the tools actually installed.
Non-essential tracking technologies requiring consent will not be activated before valid consent has been obtained.
3. Purposes and Legal Bases for Processing
Personal data are processed for the following purposes.
A. Responding to information and quotation requests
Data submitted through forms or communicated by email or telephone are used to handle requests, provide information about accommodation and prepare quotations.
The legal basis is the performance of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR.
B. Managing bookings and contractual relationships
If a user proceeds with a booking or enters into a contract with the property, the necessary data may be processed to manage the relationship, fulfil contractual obligations and provide the requested services.
The legal basis is the performance of a contract or pre-contractual measures, together with compliance with applicable legal obligations.
Submitting a request through the website does not, in itself, constitute a confirmed booking.
C. Compliance with legal obligations
Data may be processed to comply with applicable administrative, accounting, tax, accommodation-related and other legal obligations.
The legal basis is compliance with a legal obligation under Article 6(1)(c) GDPR.
D. Website security and abuse prevention
Technical data and logs may be used, where necessary, to maintain website security, prevent unauthorised access and address technical failures or cybersecurity incidents.
The legal basis may be the controller’s legitimate interest in securing its systems, subject to an appropriate balancing assessment of the interests and fundamental rights of data subjects, pursuant to Article 6(1)(f) GDPR.
E. Statistical analysis and marketing
If analytics tools that are not exempt from consent, advertising technologies or profiling tools are activated, the relevant processing will be carried out in accordance with applicable law and, where required, only after the user has given consent.
The purposes, providers, data involved and methods for withdrawing consent will be described in the Cookie Policy and the consent management interface.
Any promotional emails will be sent only on an appropriate legal basis and, where required, with the user’s specific consent.
4. Whether Providing Data Is Mandatory
Providing the information necessary to respond to an information or quotation request is required for the request to be handled. Failure to provide essential information may prevent the property from responding adequately.
Providing optional information, such as a telephone number where it is not essential, is voluntary.
Consent to non-essential cookies and to promotional activities requiring consent is optional and may be withdrawn as described in the relevant information notice.
5. Processing Methods and Security Measures
Personal data are processed using electronic systems and, where necessary, manual procedures. Appropriate technical and organisational measures are adopted to protect data against unauthorised access, loss, disclosure, alteration or destruction.
Access to personal data is limited to authorised individuals and service providers who need the data to perform relevant activities.
6. Website Forms and Communications
The website uses or intends to use the SureForms plugin to manage contact and quotation request forms.
Depending on the website configuration, submitted data may be transmitted to the controller, stored within the WordPress system, sent to configured email addresses or processed by technical service providers necessary for the service to operate.
Before publication, the actual operation of the forms, data storage arrangements, recipients and retention periods must be verified.
7. Recipients of Personal Data
Personal data may be disclosed, to the extent necessary, to:
- authorised staff and collaborators of the controller;
- website hosting, maintenance and technical support providers;
- email and form-management service providers;
- analytics, advertising or consent-management providers, if actually activated;
- professional advisers and service providers assisting with administrative, accounting or legal obligations;
- public authorities and other entities where disclosure is required by law.
Service providers processing personal data on behalf of the controller will be identified and, where required, appointed as data processors pursuant to Article 28 GDPR.
An updated list of relevant providers may be requested from the controller using the contact details provided in this Privacy Policy.
8. Data Retention Periods
Personal data are retained for as long as necessary to fulfil the purposes for which they were collected and in accordance with applicable legal obligations.
In particular:
- Information and quotation requests: for the period necessary to handle the request and any subsequent communications, according to a retention period defined and documented by the controller.
- Contractual, administrative and tax records: for the periods required by applicable law and for the management of potential disputes.
- Technical and security logs: for the period strictly necessary for security and technical management, to be defined according to the service configuration.
- Cookies and tracking technologies: for the periods specified in the Cookie Policy and in the settings of the relevant tools.
Actual retention periods must be defined and verified before publication. Data will not be retained indiscriminately or for longer than necessary.
9. Data Subject Rights
Subject to the conditions and limitations set out in the GDPR, data subjects may exercise the following rights:
- obtain confirmation as to whether their personal data are being processed and access those data;
- request the rectification of inaccurate data or completion of incomplete data;
- request erasure of data where the legal conditions are met;
- request restriction of processing;
- object to processing based on legitimate interests on grounds relating to their particular situation;
- receive their data in a structured format and, where applicable, request data portability;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
- lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
Requests may be sent to residenzacarracci@gmail.com.
10. Cookies and Tracking Preferences
For information about cookies and other tracking technologies used on the website, including their purposes, retention periods and third parties, please refer to the separate Cookie Policy.
Where required by law, users will be able to give, refuse or withdraw consent through a preference-management interface accessible from the website.
The actual arrangements will be specified after the cookies and tracking technologies installed on the website have been reviewed.
11. Changes to This Privacy Policy
This Privacy Policy may be updated to reflect changes in legislation, organisational arrangements or technical systems, as well as the introduction of new website services or tools.
The updated version will be published on this page together with its revision date.