Privacy policy

Email

info@stofnerhof.it

PEC (certified email)

stauder.tanja@pec.it

Phone

+39 0471 622422

We have not appointed a data protection officer, because the conditions of Art. 37 GDPR are not met. For any questions about data protection, you can reach us using the contact details above.

When you open the website, our hosting provider’s server automatically records technical data: IP address, date and time, the page requested, browser and operating system, and the page visited before. We need this data to deliver the website, run it reliably and fend off attacks.

The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The logs are deleted after 7 days. In the event of a security incident, we keep the affected entries until the incident has been resolved.

The website is maintained by tc solution GmbH, Eisackstraße 3, I-39100 Bolzano, and hosted by Limitis GmbH, Gampenstraße 95 s, I-39012 Merano (BZ). The contact form also runs on its servers. Both companies act as processors under Art. 28 GDPR.

When you write to us, call us or use the contact form, we process your details to answer your enquiry and make you an offer: name, email address, phone number if given, travel dates, number and ages of guests, and your message. The form forwards your details by email to info@stofnerhof.it. Required fields are marked; without them we cannot prepare an offer.

The legal basis is taking steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR) and, for general enquiries, our legitimate interest in answering them (Art. 6(1)(f) GDPR). If no booking results, we delete the enquiry after 24 months.

For your booking we process the contract data: name, address, contact details, travel dates, fellow travellers, payment details and your correspondence with us. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). If you book for other people as well, you also give us their data. Please inform your fellow travellers about this privacy policy.

On arrival we are legally obliged to collect and pass on further data. In each case the legal basis is Art. 6(1)(c) GDPR.

• Registering guests with the police

  Data

  Name, date and place of birth, nationality, identity document details

  Recipient

  Bolzano Police Headquarters (Questura) via the “Alloggiati Web” portal

  Legal provision

  Art. 109 Consolidated Public Security Act (Royal Decree no. 773/1931)

• Municipal tourist tax

  Data

  Number, age and length of stay of guests

  Recipient

  Municipality of Sarntal

  Legal provision

  Provincial Law no. 9/2012

• Tourism statistics

  Data

  Country or province of origin, arrival, departure

  Recipient

  ASTAT / ISTAT

  Legal provision

  Provincial and national statistics regulations

• Accounting and tax

  Data

  Invoice data

  Recipient

  Tax adviser, tax authorities (electronic invoice via the Sistema di Interscambio)

  Legal provision

  Presidential Decree no. 633/1972, Presidential Decree no. 600/1973

We copy identity documents only as far as necessary for the registration and destroy the copy afterwards. Without these details we are not allowed to accommodate you.

If you book directly by email, phone or contact form, you pay by bank transfer, which our bank handles. On site you can also pay for your stay and farm products by card at the terminal. These payments are handled by Nexi Payments S.p.A., Milan, as an independent controller. If you book through Holidu or through Booking.com, payment is handled by the respective company, including by credit card. In none of these cases do we receive your full card details.

If you book through the Holidu (Holidu GmbH, Munich) or Booking.com (Booking.com B.V., Amsterdam) portals, the portal sends us the data needed for the booking: name, contact details, travel dates, number of guests and, if given, your message.

We process the data to perform the contract (Art. 6(1)(b) GDPR). Holidu and Booking.com are themselves responsible for processing on their platforms and for handling payments, and provide information about this in their own privacy policies.

Our website does not set any cookies and does not include any statistics, advertising or social media services. Fonts, images and videos come only from our own server. The only thing stored is your choice between the winter and summer view, in your browser’s local storage; no consent is required for this (Art. 122(1) Italian Privacy Code). Our cookie policy explains the details.

Your data is only shared with people and bodies who need it for the purposes described:

• members of our family and staff who are authorised to process data and bound to confidentiality
• tc solution GmbH and Limitis GmbH as processors for maintaining and hosting the website
• Holidu and Booking.com for bookings made through these portals
• our tax adviser, our bank and Nexi for card payments on site, and a lawyer in the event of a dispute
• authorities, where we are legally obliged to share data (Questura, municipality, tax authorities, ASTAT)

We do not sell data and do not pass it on to third parties for advertising purposes.

We process your data in the EU and do not transfer it to third countries. Whether Holidu and Booking.com process data outside the EU is explained in their privacy policies.

Server logs

7 days

Enquiries without a booking

24 months

Booking and invoice data

10 years from the end of the booking year (Art. 2220 Civil Code, Art. 22 Presidential Decree no. 600/1973; this is also the general limitation period under Art. 2946 Civil Code)

Receipts for guest registration (Alloggiati Web)

5 years

After that we delete or anonymise the data, unless a retention obligation or ongoing proceedings prevent this.

The website is always transmitted in encrypted form (TLS). On our side, only the people who need your data for your enquiry, booking and stay have access to it. Our processors are contractually obliged to protect your data in line with the state of the art (Arts. 28 and 32 GDPR).

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)).

Right to object under Art. 21 GDPR:where we process data on the basis of our legitimate interest, you can object at any time on grounds relating to your particular situation. You can object to direct marketing without giving reasons.

An informal message to info@stofnerhof.it is enough. We reply within one month.

You can also lodge a complaint with the Italian data protection authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or with the supervisory authority in your country of residence (Art. 77 GDPR). Independently of this, you can take legal action (Art. 79 GDPR).

We do not make automated decisions or carry out profiling within the meaning of Art. 22 GDPR.

We only process data of children under 14 if their parents provide it when booking (Art. 2-quinquies Italian Privacy Code).

We update this policy when our website or the legal situation changes. The version published here at any given time applies.