Questa pagina è anche disponibile in Italiano.
Last updated: 6 September 2026
This notice describes how personal data collected through www.bedandbreakfastdari.com is processed. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
Processing that takes place outside the website — guest registration on arrival, the reporting of guest details to the public security authorities and tax obligations — is described in section 7 and is the subject of a separate notice handed over at check-in.
1. Data controller
Riccardo Villa, acting as a natural person
Accommodation "B & B Da Rì" — CIN IT087015C1ZZBJBA4Y
Via Umberto, 150 — 95129 Catania (CT), Italy
Telephone: +39 095 2165060 — +39 331 2891672
E-mail: [email protected]
The accommodation is run on a non-business basis: the Controller is a private individual and does not hold an Italian VAT number. The establishment is identified by the National Identification Code (CIN) shown above.
For any question concerning the processing of personal data you may write to the e-mail address above.
Data Protection Officer (DPO): not appointed. The processing does not fall within the cases set out in Article 37(1) GDPR: the Controller is not a public authority, does not carry out regular and systematic monitoring on a large scale and does not process special categories of data on a large scale.
2. Data we collect and why
2.1 Availability request form
It appears on the home page and on the Rooms and Breakfast, Recreational Activities and Agatha of Sicily pages, as well as on the corresponding Italian pages.
Data collected: name, e-mail address, telephone number, number of guests, arrival date, departure date and any free text entered in the "Additional details" field. Together with the data you enter, the form transmits the referring page and the address of the page it was sent from.
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to your availability and quotation request, and taking the pre-contractual steps you asked for | Pre-contractual measures (Art. 6(1)(b) GDPR) | 24 months from the last contact, unless the request becomes a booking |
| Establishing, exercising or defending legal claims, in the event of disputes | Legitimate interest (Art. 6(1)(f) GDPR) | Until the limitation period expires |
Providing the data marked as mandatory is necessary for us to reply: without it the request cannot be processed. The free-text field is optional.
Warning. The form is not intended to collect data belonging to the special categories referred to in Article 9 GDPR. Please do not enter health-related information in the notes field — for example allergies, intolerances or mobility requirements — or other personal conditions. If you need to tell us about such requirements it is preferable to do so by telephone when confirming your booking; if you nevertheless choose to communicate them through the form, the processing will be based on explicit consent under Article 9(2)(a) GDPR, expressed by voluntarily sending the information, and will be limited to what is necessary to organise your stay.
2.2 Contact form
It appears on the Contatti and Contacts pages.
Data collected: name, e-mail address and message text. The form includes a mandatory checkbox by which you declare that you have read this notice.
| Purpose | Legal basis | Retention |
|---|---|---|
| Replying to your requests for information | Pre-contractual measures (Art. 6(1)(b) GDPR) where the request concerns a possible stay; legitimate interest in replying to communications received (Art. 6(1)(f) GDPR) in other cases | 24 months from the last contact |
As stated on the Contacts page, your e-mail address is not used for promotional purposes: we do not send newsletters and we do not pass addresses on to third parties.
2.3 Browsing data
The IT systems and software procedures that operate this website acquire, in the course of their normal operation, certain data whose transmission is inherent in the use of Internet communication protocols: IP addresses, browser and operating system type, addresses of requested resources, time of the request and response status code.
| Purpose | Legal basis | Retention |
|---|---|---|
| Ensuring the correct functioning and security of the site, detecting anomalies and abuse | Legitimate interest in system security (Art. 6(1)(f) GDPR) | Retained by the hosting provider for as long as necessary for security and diagnostic purposes, according to its service policies |
This data is not used to identify you and is not linked to data collected through the forms.
2.4 Website usage statistics
| Purpose | Legal basis | Retention |
|---|---|---|
Measuring use of the site through Google Analytics 4 (property G-7HW0K838TB) | Consent (Art. 6(1)(a) GDPR), given through the cookie banner and withdrawable at any time | _ga and _ga_7HW0K838TB cookies: 400 days. Data in the Google Analytics platform: 14 months |
Data is collected in pseudonymised form and serves to understand which pages are most visited and through which channels visitors arrive. We do not profile individual users and we do not use Google Analytics advertising features. Cookie details are set out in the Cookie Policy.
2.5 Form protection
| Purpose | Legal basis | Retention |
|---|---|---|
| Telling human visitors from automated submissions and protecting the forms from abuse, through Cloudflare Turnstile | Legitimate interest in site security and abuse prevention (Art. 6(1)(f) GDPR) | No cookie and nothing stored on your device. Data processed by Cloudflare under its own notice |
The service receives the IP address and some technical characteristics of the browser and device, which it uses to determine whether the request comes from a person or an automated system. It asks the visitor no questions, sets no cookies and does not track browsing across sites. Cloudflare's privacy policy applies.
2.6 Map of the accommodation
The Contatti and Contacts pages contain a Google Maps map showing where we are. The map is blocked until you give your consent: before your choice, no request is sent to Google's servers.
| Purpose | Legal basis | Retention |
|---|---|---|
| Showing the location of the accommodation and helping you reach us | Consent (Art. 6(1)(a) GDPR), given through the banner and withdrawable at any time | No cookie is set. Data processed by Google under its own notice |
Once activated, the map is loaded from Google's servers, which receive your IP address, the address of the page and your browser's technical characteristics. It sets no cookie, verified both on load and while interacting with the map. Google's privacy policy applies.
2.7 Typefaces
The fonts used by the site are hosted on our own servers and served directly from the site's domain. They are not downloaded from Google servers and none of your data is transmitted to Google Fonts.
3. Who we share data with
Personal data may be disclosed to:
- Aruba Business S.r.l. — website hosting services (Processor under Article 28 GDPR);
- Google Ireland Limited — browsing statistics, only where you have consented, and, subject to consent, map display;
- Cloudflare, Inc. — anti-spam protection of the forms through Turnstile and management of the domain's DNS records;
- Google LLC — provider of the e-mail service through which we receive messages sent from the forms;
- IT service providers responsible for the technical management of the site (Processors);
- public security authorities, in the cases provided for by law and described in section 7;
- tax and accounting advisers of the Controller, for statutory obligations.
Data is neither transferred nor sold to third parties for marketing purposes.
4. Transfers outside the European Union
Use of the services described above may involve transfers of personal data to the United States of America, in particular to Google LLC and Cloudflare, Inc.
Transfers take place on the basis of the European Commission adequacy decision of 10 July 2023 concerning the EU-U.S. Data Privacy Framework, to which Google LLC and Cloudflare, Inc. adhere, supplemented by the standard contractual clauses approved by Implementing Decision (EU) 2021/914 and by additional technical and organisational measures. The list of certified organisations is available on the Data Privacy Framework website.
No other transfers to third countries take place.
5. How long we keep the data
| Category of data | Period |
|---|---|
| Availability requests and contact messages not followed by a booking | 24 months from the last contact |
| Data relating to stays actually taken | See section 7 |
| Receipts and tax documentation | Until 31 December of the fifth year following the year the tax return was filed, the assessment deadline under Article 43 of Presidential Decree 600/1973 |
| Analytics cookies | 400 days |
| Cookie consent record | 365 days |
| System logs | Managed by the hosting provider according to its service policies |
At the end of the period, data is deleted or irreversibly anonymised, save where it needs to be retained for the defence of legal claims.
6. How we protect the data
The site is served exclusively over HTTPS with a valid certificate. Access to the administration area is restricted to authorised personnel. The forms are protected by anti-spam systems. Data is stored on servers located within the European Union and access to the mailbox receiving the messages is protected by personal credentials.
7. Processing connected with your stay
If your request becomes a booking, guest data is also processed for purposes that do not depend on the website:
- reporting guest identity details to the Italian State Police Portale Alloggiati, mandatory under Article 109 of the Consolidated Law on Public Security (Royal Decree 773/1931) and the Ministerial Decree of 7 January 2013. Legal basis: legal obligation (Art. 6(1)(c) GDPR). The report is made within 24 hours of arrival and the data is retained as provided for by the applicable sector rules;
- statistical reporting to the competent body and municipal tourist tax, where due. Legal basis: legal obligation (Art. 6(1)(c) GDPR);
- issuing receipts and tax obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR). As the accommodation is run on a non-business basis, the bookkeeping obligations of Article 2220 of the Italian Civil Code do not apply; documentation is retained until 31 December of the fifth year following the year the tax return was filed, the assessment deadline under Article 43 of Presidential Decree 600/1973.
A specific notice covering this processing is handed over at check-in.
8. Minors
The site is not directed at minors and does not knowingly collect their data. Bookings are made by adults. Where minors travelling in the group are indicated in the request, their data is provided by whoever holds parental responsibility and is processed solely to organise the stay.
9. Automated decision-making
We carry out no profiling and no automated decision-making producing legal effects or similarly significantly affecting you, within the meaning of Article 22 GDPR.
10. Your rights
You may exercise at any time the rights set out in Articles 15-22 GDPR, and in particular:
- obtain confirmation that processing is taking place and access the data concerning you;
- obtain the rectification of inaccurate data or the completion of incomplete data;
- obtain the erasure of the data in the cases provided for by Article 17;
- obtain the restriction of processing in the cases provided for by Article 18;
- receive in a structured format the data processed on the basis of consent or of a contract by automated means (portability, Article 20);
- object to processing based on legitimate interest (Article 21);
- withdraw your consent at any time and as easily as you gave it, without affecting the lawfulness of processing carried out beforehand. For analytics cookies it is enough to reopen the preferences panel from the icon at the bottom left of every page.
Requests should be sent to [email protected]. We reply within one month of receipt, a period that may be extended by two months in particularly complex cases.
If you believe the processing infringes the applicable law you may lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, Italy — www.garanteprivacy.it), without prejudice to your right to seek a judicial remedy.
11. Changes to this notice
This notice may be updated to reflect changes in the law or in the services used by the site. Each version shows the date of the last update at the top. Material changes will be notified with adequate notice and, where processing is based on consent, your consent will be requested again.