How we handle your data
This page explains, in plain words, what happens to the information you give us through this website. In short: the only personal data this site collects is what you type into the date request form, and we use it only to answer you about those dates. Nothing is sold, nothing is used for advertising, and there are no cookies. The data controller, that is the person who decides how your data is used, is Vera Sciarrino, the host of Luxury Villa Vera Mondello Apartments. For any question or request about your data you can write to the host on WhatsApp at +39 329 416 2327 or by email at villavera.mondello@gmail.com. The website is built and run by sitage on the host’s behalf: for the data that passes through the site, sitage acts as data processor (GDPR art. 28), follows the host’s instructions and uses nothing for its own purposes.
When you send a date request, we receive your arrival date and the number of nights (the departure date is worked out from those two), the number of guests and whether your dates are flexible, an email address or a phone number (at least one, so that we can reply), and the message you write, if you write one. When you simply visit, the server that delivers the pages sees the technical data every website receives: your IP address, your browser and device, the page you asked for and when. Our visit counter records only totals (which page, which site you came from, browser, system, screen size and country) and never your IP address. There is no account, no login and no profiling. We do not buy or enrich this data, we never use it for advertising, and we never sell it.
We use your request to answer you about those dates and to carry on the conversation if you reply; the legal basis is the steps you ask for before a possible booking contract (GDPR art. 6(1)(b)). We use technical data to deliver this site and keep it secure, we count visits and clicks as totals to know which pages are useful without identifying anyone, and we quote guest reviews without names to show what past guests said. In these three cases the legal basis is our legitimate interest (art. 6(1)(f)), and you can object at any time, as explained below.
You do not have to give us any of this. Using the form is entirely up to you: you can also ask on Airbnb, on Booking.com or on WhatsApp. If you do use it, the dates, the number of nights and guests and one way to reach you are needed to answer, and without them the form cannot be sent; the message is optional. There are no automated decisions: a person reads every request, nothing about you is decided automatically, and nothing is used to build a profile of you.
To run the site we use a few services, which handle your data only to provide their service, under a data processing agreement or their own terms.
Cloudflare (Cloudflare, Inc., USA) hosts this site and delivers every page. Like any web server, it sees technical data such as your IP address, your browser and the page you asked for, and uses it to deliver the page and to block abuse. It also receives the date request form, stores it in a database run for the host, and emails it to the host. Your IP address is not stored with it: to slow down spam it is only turned into a one-way code that changes every hour. Before the form is sent, Cloudflare Turnstile checks that a person, not a program, is filling it in, using technical data from your browser. Date requests are stored inside the EU (Cloudflare’s EU jurisdiction), while pages are delivered from a worldwide network, with servers inside and outside the EU. Date requests are kept there for 12 months from when you send them, then deleted automatically; its technical logs are short-lived, under Cloudflare’s own terms. Its terms are in the Cloudflare privacy policy.
Web3Forms (Web3Creative, India) receives the date request form and forwards it by email to the host. To filter spam, it may check your IP address and email address with CleanTalk or Akismet. Its servers are in the United States (Amazon Web Services), with providers in the EU and the US. Its copy is deleted automatically after 30 days. Its terms are in the Web3Forms privacy policy.
Gmail (Google) is the host’s mailbox: your request arrives there, and the host replies from it. The mail sits in Google data centres, inside and outside the EU. It is kept for 12 months from your last message, then deleted. Its terms are in the Google privacy policy.
GoatCounter (GoatCounter, Ireland) counts page views and a few clicks, without cookies. Your IP address is used for a moment to work out the country, and is never stored. Its servers are in Finland and Germany (Hetzner), inside the EU. Only totals are kept, and they contain nothing that identifies you. Its terms are in the GoatCounter privacy policy.
Beyond these, your data is seen only by the host and, for the site’s technical side, by sitage, and it is not shared with anyone else. If you write to us on WhatsApp, that conversation happens on WhatsApp, which handles it under its own terms.
Some of these services are based outside the European Union, or use servers there, and each transfer is covered by a safeguard the GDPR recognises. Cloudflare and Google are certified under the EU–US Data Privacy Framework, which the European Commission found adequate on 10 July 2023, and they also use the EU standard contractual clauses. Web3Forms uses the EU standard contractual clauses (Commission Decision 2021/914), set out in its data processing agreement. GoatCounter keeps its data inside the EU, so no transfer takes place. Ask us and we will point you to a copy of these safeguards.
Date requests are kept for 12 months from your last message, then deleted from the host’s mailbox. If your request turns into a booking, the booking records are kept for as long as the law requires, or follow the rules of the platform you booked through. The copy stored on Cloudflare is deleted automatically 12 months after you send the request; for up to 30 days after that it can still be restored from Cloudflare’s backups, then it is gone. Web3Forms, which carries the form, keeps its own copy for 30 days, then deletes it automatically. If you would like any of it deleted sooner, tell us and we will do it. Visit counts are totals with nothing that identifies you, and are kept as long as they are useful.
Under the GDPR (articles 15 to 21) you can ask at any time to see the data we hold about you and get a copy, to correct it if it is wrong or incomplete, to delete it, to restrict its use while a question is being resolved, to receive the data you gave us in a common format or have it sent to someone else, and to object to any use based on our legitimate interest. To do so, write to the host on WhatsApp or at villavera.mondello@gmail.com and say what you would like done; no special wording is needed. It is free, and we will reply within one month. We may ask a question to make sure the request really comes from you. If you think your data has been handled wrongly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma (garanteprivacy.it), or to the authority of the EU country where you live or work.
The guest reviews on the home page were written on Airbnb and Booking.com, where they are public, and are quoted as they appear there, without the reviewer’s name: we show only their country, the platform and the month, with a link to our public page on that platform, where the full review can be read. If you wrote one and would rather it were not quoted here, tell us and we will remove it. Links to our listings on Airbnb and Booking.com, and to WhatsApp, take you to those companies’ own websites, where their privacy policies apply. The links to the listings carry a short tag that tells the platform the visit came from this site; it contains nothing about you.
If we change how any of this works, we change this page at the same time. This notice was last updated on .