Casa Raffa

Privacy policy

This notice explains, under Article 13 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003, how we process the personal data of people who visit the Casa Raffa website or contact us through the website, by email or on WhatsApp.

1. Data controller

The data controller is Raffaele Piscitella, as operator of La Casita di Raffa (CIN IT001272C2K8VEGX45) and La Casita di Raffa 1 (CIN IT001272C2S25VZDAX), based in Turin, Italy. For any question about your data, write to casaraffaitaly@gmail.com. No Data Protection Officer (DPO) has been appointed, as one is not required.

2. What data we process

  • Data you give us: through the request form, your full name, email, phone number (optional), residence of interest, stay dates, number of guests and any message; if you write to us by email or WhatsApp, the data contained in that conversation. Please do not include unnecessary information in your message, especially health data or identity documents.
  • Browsing data: the servers hosting the website automatically record some technical data (such as IP address, date and time of the request, page visited, browser type), which is needed for the site to work and stay secure.

3. Why we process it and on what legal basis

  • To answer your request for availability or information and, if you wish, to arrange your booking: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
  • To meet legal obligations if you stay with us (for example reporting guests to the police, the city tourist tax, statistical surveys and tax obligations): legal obligation (Art. 6(1)(c) GDPR). The data needed for these obligations is collected at booking or check-in, not through the website.
  • To keep the website secure and prevent spam: the controller's legitimate interest (Art. 6(1)(f) GDPR).

We do not use your data for marketing, we never sell it, and we carry out no profiling or automated decision-making.

4. Providing your data

The fields marked as required in the form are needed for us to reply: without them we cannot handle your request. All other data is optional.

5. How we process data

Data is processed electronically by the controller, with appropriate technical and organisational measures to protect it against unauthorised access, loss or disclosure. The website uses an encrypted connection (HTTPS).

6. Who may receive your data

  • Netlify, Inc., which hosts the website and collects form submissions, appointed as data processor (Art. 28 GDPR), and its sub-processors (for example for form spam filtering).
  • Google, as the provider of the email service on which we receive messages.
  • WhatsApp (Meta), only if you choose to contact us on WhatsApp; WhatsApp then processes data under its own privacy policy, as an independent controller.
  • Public authorities (such as the police, the City, the Region and the tax authority) and professionals who assist us with tax obligations, only if you stay with us and within the limits set by law.

Your data is never made public.

7. Transfers outside the European Union

Some providers (Netlify, Google, Meta) may process data in the United States. Such transfers rely on the safeguards provided by the GDPR: the European Commission's adequacy decision on the EU-US Data Privacy Framework for certified providers (Art. 45) or the Commission's standard contractual clauses (Art. 46).

8. How long we keep data

  • Requests that do not lead to a booking: no more than 12 months after the last contact, then deleted.
  • Data relating to completed stays: for the period required by applicable law (for example up to 10 years for tax records).
  • Browsing data: only as long as needed for website security, under the hosting provider's policies.

9. Cookies

The website uses no cookies or similar tracking technologies, and no analytics or advertising tools. Fonts are hosted on the site itself, with no calls to external services. This is why no cookie banner is shown.

10. Your rights

At any time you can exercise your rights under Articles 15–22 GDPR: access to your data, rectification, erasure, restriction of processing, portability and objection to processing based on legitimate interest. Just write to casaraffaitaly@gmail.com: we will reply within one month.

If you believe the processing breaches the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

11. Minors

Booking requests must be sent by adults.

12. Changes

This notice may be updated. The version in force is always the one published on this page.

Last updated: October 2026.