Privacy Policy

Last update: 07/07/2026

This Privacy Notice explains how Magia dell’Aspromonte (hereinafter “we”, “us”, “Data Controller”) collects, uses, processes and discloses personal data in connection with the booking system and related website. At Magia dell'Aspromonte, we are committed to protecting and respecting your privacy. By accessing the platform or providing information, you agree to our privacy practices as set out in this privacy statement.

Data Controller

Magia dell’Aspromonte
GALLUZZO GROUP S.R.L. – SOCIETÀ AGRICOLA
LOCALITÀ ACQUAFREDDA, SNC – CIMINÀ
P.IVA: 03125210801
Email privacy: info@magiadellaspromonte.com 

Data Protection Officer (DPO)

Magia dell’Aspromonte
GALLUZZO GROUP S.R.L. – SOCIETÀ AGRICOLA
LOCALITÀ ACQUAFREDDA, SNC – CIMINÀ
P.IVA: 03125210801
Email privacy: info@magiadellaspromonte.com

Data Processor

The booking system is operated on behalf of the Data Controller by ErmesHotels, acting as Data Processor. A contractual framework governs the relationship between Controller and Processor to ensure protection of personal data.
ErmesHotels contact details: ErmesHotels S.r.l. — DPO email: dpo@ermeshotels.com 

Scope

This Notice applies to personal data collected via the website, booking engine and related contact channels (forms, email, phone, social) for bookings, information requests, newsletter subscriptions and ancillary services.

Personal data we collect

We may collect and process:

• • Identification and contact data: name, address, email, phone;
• • ID document data: where required by law;
• • Payment data: for processing payments and invoicing;
• • Booking and stay data: dates, preferences, dietary/allergy notes if provided;
• • Technical and navigation data: IP address, cookies and usage data (see Cookie Policy);
• • Third‑party data: if you provide data of others, you confirm you have their consent.
  
  

Purposes and legal bases

We process personal data for:

1. Booking and stay management — performance of contract;
2. Legal obligations and public security reporting — legal obligation;
3. Payments and invoicing — contractual and fiscal obligations;
4. Operational communications (check‑in/out) — contractual necessity;
5. Marketing and newsletters — with explicit consent;
6. Service improvement and analytics — legitimate interest;
7. Claims and disputes handling — legitimate interest and legal obligation.
   
   

Mandatory provision

Fields marked as mandatory in forms are necessary to provide the service; failure to provide them may prevent booking completion or service provision.

Data retention 

We retain personal data for the time necessary for the purposes indicated:

• • Accounting and fiscal records: 10 years;
• • Contractual data: for the duration of the relationship and statutory limitation periods;
• • Marketing data: until consent withdrawal. Retention criteria consider legal obligations, contractual needs and protection of the Controller’s rights.
  
  

Disclosure and transfers

Data may be disclosed to public authorities, service providers (e.g., ErmesHotels for the booking engine, hosting providers, payment processors), transport companies and activity partners. External parties act as Processors under contract. International transfers to third countries may occur where processors or sub‑processors use data centers abroad; such transfers will be subject to appropriate safeguards (standard contractual clauses or equivalent).

Security

We implement appropriate technical and organizational measures to protect personal data (access controls, encryption where applicable, backups, internal procedures). Data breaches will be handled according to GDPR procedures.

Data subject rights

You may exercise rights under Articles 15‑22 GDPR: access, rectification, erasure, restriction, portability, objection and withdraw consent. To exercise your rights or for information: info@magiadellaspromonte.com. You may lodge a complaint with the competent Data Protection Authority.

Children

Services are not directed to persons under 16 years old; we do not knowingly collect personal data from minors without parental consent.

Cookies and tracking

Cookie use is described in the separate Cookie Policy. Consent is required for non‑essential cookies.

Changes to this notice

We may update this Notice; the latest version will be published on the website with the revision date.

Contact details

For privacy inquiries and to exercise your rights: Email: info@magiadellaspromonte.com