Data Controller
The controller of personal data, including data related to deposit payments, is BNB MaryGrace di Maria SCHIAVETTA, based in Alghero, Via S. Macciotta 5, Tax Code SCHMRA69E68D150O, reachable at the email address bbmarygrace.alghero@gmail.com, certified email (PEC) MARYGRACE@POSTECERT.IT, and/or telephone number +39 0110437099.
Data processed and payment methods
The website only collects a booking request: it does not process deposits or balances, use online payment gateways, or collect or retain full card details. The property later sends confirmation of availability, the amount due and bank details by email or WhatsApp.
The bank transfer is made outside the website through banking institutions. The B&B may process payment data supplied for the deposit or balance, such as IBAN details and transfer receipts, including information visible in any receipt sent by the guest.
Credit card payment data is not retained by the Controller, as the transaction is handled by an authorized third party or banking institution at the property.
The property issues non-fiscal receipts.
Purposes and legal bases
Personal data and payment data (e.g. IBAN, transfer receipts) provided when paying the deposit are processed for the following purposes:
- Managing the booking and collecting the deposit and balance (legal basis: performance of a contract, Art. 6.1.b GDPR).
- Fulfilling tax and accounting obligations related to issuing receipts/invoices (legal basis: legal obligation, Art. 6.1.c GDPR).
- Handling any disputes, refunds, or withdrawals (legal basis: legitimate interest of the Controller, Art. 6.1.f GDPR).
Processing methods and retention
Data is processed using IT and paper-based tools, with security measures adequate to prevent unauthorized access, loss, or destruction. Credit card payment data is not retained by the Controller, as the transaction is handled by an authorized third party (payment gateway/banking institution), as indicated in point 3.4. Data is retained for as long as necessary for the purposes stated above and, in any case, for the period required by tax regulations (10 years) for accounting data.
Data recipients
Payment data may be shared with: credit institutions and/or payment system operators, the Controller's tax/accounting advisors, and competent authorities where required by law. These parties act as independent controllers or, where applicable, as data processors pursuant to Art. 28 GDPR.
Any transfers outside the European Union
Should the payment service provider (e.g. SumUp, international card networks) involve a transfer of data to non-EU countries, such transfer takes place in compliance with the safeguards set out in Articles 44 et seq. GDPR (e.g. standard contractual clauses, adequacy decisions).
Data subject rights
Pursuant to Articles 15–22 GDPR, the data subject has the right to request, at any time, access to their data, rectification, erasure, restriction of processing, and data portability, as well as to object to the processing, by writing to bbmarygrace.alghero@gmail.com or to the certified email (PEC) marygrace@postecert.it. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
Nature of providing data
Providing the data necessary for the deposit payment is mandatory in order to conclude and manage the stay contract: failure to provide such data will make it impossible to confirm the booking.
