Last updated: 23 October 2026

1. Data controller

The controller of the personal data collected through the website https://www.villa-aroi.com is:

Controller: Susanna Brigato
Address: Viale degli Oleandri – 96018 Pachino (SR)
Email: info@villa-aroi.com

For any request concerning the processing of personal data, you may contact the controller at the email address indicated above.

2. What personal data we process

Depending on the actions carried out by the user, the Villa Aroi website may involve the processing of the following categories of data:

– Contact data: first name, surname, email address, telephone number and other information voluntarily provided by the user.
– Information contained in messages: information included in enquiries concerning the property, availability, services and stays.
– Guest feedback data: first name, surname, check-in date and answers to the feedback form questions. The email address is optional.
– Booking enquiry data: information required to check availability and manage enquiries through the booking platform used.
– Technical browsing data: information that may be collected by IT systems and technical services used to operate and secure the website, such as IP address, date and time of the request, browser and device information, and requested resources.

The data actually collected depends on the features used, the fields completed by the user and the configuration of the services available on the website. Users are asked not to enter unnecessary personal information.

3. Purposes and legal bases of processing

Personal data are processed for the following purposes, insofar as they are relevant to the service requested.

A. Responding to information requests

Data provided by email or through other contact channels are used to answer questions about Villa Aroi, availability, services and stay conditions.
Legal basis: taking steps at the request of the data subject prior to entering into a contract, where applicable, pursuant to Article 6(1)(b) of the GDPR.

B. Managing availability enquiries and bookings

Data required to check availability and manage bookings may be processed through the booking system used by the property and any services involved in completing the booking.
Legal basis: taking steps prior to entering into a contract or performance of a contract, where applicable, and compliance with relevant legal obligations.

C. Collecting and reviewing guest feedback

Data submitted through the feedback form are used to understand guests’ experiences, assess the service provided and identify possible improvements.
Legal basis: to be confirmed according to how the feedback is actually used and the interests pursued by the controller. Processing must be limited to the information necessary for this purpose.

D. Complying with legal obligations

Necessary data may be processed to comply with administrative, tax, accounting and other obligations imposed by the laws applicable to the business.
Legal basis: compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR.

E. Ensuring website operation and security

Certain technical data may be processed to keep the website operating, prevent misuse, handle technical errors and protect IT systems.
Legal basis: where applicable, the controller’s legitimate interest in website security and proper operation, while respecting the rights and freedoms of data subjects.

F. Managing cookies and external services

Cookies and similar technologies are used in accordance with the preferences expressed by the user and the applicable settings. Services requiring consent must not be activated before valid consent has been given, where required by law.

For further information, please refer to the Villa Aroi Cookie Policy.

4. Guest feedback form

Villa Aroi provides a page dedicated to guest feedback, accessible through a link in the property’s information app or through its direct web address.
The form, created using Happy Forms, allows guests to share their experience by answering questions about their stay. The requested data include first name, surname, check-in date and answers to the form questions. The email address is optional. The data are processed to collect and review guest feedback, understand their experience and identify possible improvements to the service provided. Responses submitted through the form are received by the controller by email. If provided, the guest’s email address may be used for communications relevant to the feedback. The form also contains a link to Google’s review page. Posting a review on Google is a separate choice from sending private feedback to Villa Aroi and is subject to Google’s terms and privacy notice. Providing data is voluntary. Users are asked not to enter unnecessary personal information. Responses received by email are kept for an indicative period of 12 months, unless longer retention is necessary for a legitimate reason or to comply with legal obligations. The controller applies this retention criterion to feedback emails and deletes them when they are no longer necessary. Under the current configuration, the controller receives responses by email and does not use Happy Forms’ internal response-storage feature. This does not exclude the possibility of technical records being kept by the form or server.

5. InReception booking system

The website incorporates a script that displays a feature for checking availability. The booking is subsequently completed through an external platform. Using this feature may involve the transmission of technical data and, depending on the service configuration, data relating to availability searches or bookings. Data processing through the platform is also subject to the privacy notice of the relevant provider, available on InReception’s official website.

6. Google Maps and other external services

The website incorporates a Google Maps widget to show the property’s location and help users find it. Loading and using the map may involve the transmission to Google of technical data, such as the IP address and information about the browser and device being used. Google’s processing of data is also governed by the provider’s privacy notice: Google Privacy Policy

The widget is currently blocked by the consent-management system until the user gives the consent required to load it. The configuration must be checked periodically to ensure that it respects the user’s stated preferences. The website may also use Google Fonts and other external technical resources. The actual configuration of these services must be checked to determine whether resources are loaded locally or requested from external servers. For details about the cookies and technologies used, please refer to the Cookie Policy.

7. Hosting and email providers

The Villa Aroi website is hosted by Aruba. The email account info@villa-aroi.com is used to receive and manage communications and requests submitted by users, including responses to the feedback form. Technical providers may process personal data to the extent necessary to provide their respective services, in accordance with their roles, contractual terms and applicable safeguards. Messages received by email are retained for as long as necessary for the purposes for which they were collected and are then deleted, unless further retention is necessary to comply with legal obligations or protect rights. The controller periodically checks the settings of the services used, access to email accounts and any retention policies applied by providers.

8. Recipients of data

Personal data may be processed, to the extent necessary for the purposes stated, by the following parties:

– website hosting and technical infrastructure providers;
– email and communication service providers;
– providers of tools for managing contact and feedback forms;
– the booking-platform provider, within the scope of the activities actually performed;
– providers of external services actually used;
– consultants and public authorities, where required by law.

Providers processing data on behalf of the controller must be identified and classified according to their respective roles and applicable agreements. Other providers may act as independent controllers for processing activities under their responsibility. Data are not disclosed to recipients other than those relevant to the stated purposes, except where required by law or where another applicable legal basis exists.

9. Transfers of data to third countries

Some external technical services may involve the processing or transfer of personal data outside the European Economic Area or Switzerland. The controller checks the location of the services actually used and any safeguards applicable to international transfers, such as adequacy decisions or other safeguards provided for by applicable law. Definitive information about transfers will be updated based on the services actually used and the information supplied by the relevant providers.

10. Retention periods

Personal data are retained for as long as necessary to achieve the purposes for which they were collected and, afterwards, for any period required by law or necessary to protect the controller’s rights. In particular:

– Guest feedback: emails containing responses to the feedback form are kept for an indicative period of 12 months, unless longer retention is legitimately necessary.
– Information requests: messages are retained for as long as necessary to handle the request and any subsequent steps.
– Bookings and administrative documents: data are retained in accordance with applicable legal and tax obligations.
– Technical data and logs: retention periods depend on providers’ policies and documented security requirements.
– Data processed by external services: the periods set by the providers apply and must be checked in relation to processing carried out for the property.
The controller reviews and updates retention criteria according to the purposes and applicable obligations.

11. Providing data

Providing data through contact and feedback forms is voluntary. Failure to provide essential information may prevent the controller from responding to a request or processing feedback. Providing data necessary to manage a booking or comply with legal obligations may, however, be necessary for those purposes. Users may choose not to use external services embedded in the website. In that case, some features, such as displaying the map, may remain unavailable until the required consent is given.

12. Data subject rights

In the cases and within the limits provided for by applicable law, data subjects may exercise the following rights:

– access to their personal data;
– rectification of inaccurate data and completion of incomplete data;
– erasure of data, where the relevant conditions are met;
– restriction of processing;
– objection to processing, in the cases provided for by law;
– data portability, where applicable;
– withdrawal of consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
Requests may be sent to info@villa-aroi.com. Data subjects may also lodge a complaint with the competent supervisory authority in accordance with the laws applicable to the processing.

13. Cookies and consent management

The website uses Complianz to manage the consent banner and preferences relating to cookies and similar technologies.
Preferences may be changed or consent withdrawn through the consent-management features available on the website. For information about the categories of cookies used, their purposes and the available options, please consult the Villa Aroi Cookie Policy.

The presence of a banner does not replace the need to configure scripts and external services correctly so that users’ preferences are respected.

14. Data security

The controller adopts technical and organisational measures appropriate to the context and risks of processing, with the aim of protecting personal data against unauthorised access, loss, alteration or improper disclosure.
External providers must handle data in accordance with the terms and safeguards applicable to the services actually used.

15. Changes to this privacy notice

This Privacy Policy may be updated if the website, the services used or applicable law changes.
The updated version will be published on this page, with the revision date indicated.
Contact for privacy matters: info@villa-aroi.com