Privacy Policy
Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Italian Privacy Code”).
This policy describes how Vineria Aperta S.r.l. processes the personal data of those who visit the website www.cortefrancigena.it, request information, or book a stay or an experience at Corte Francigena.
Last updated: 30/9/2026
1. Data Controller
Vineria Aperta S.r.l.
Registered office: Via Cagliari, 11 – 00198 Rome (RM), Italy
Accommodation: Corte Francigena, Via Ferretti, 12 – Castelnuovo dell’Abate, 53024 Montalcino (SI), Italy
VAT no.: 01570100527 – Tax code: 01570100527 – REA: RM 1791421
Email: info@cortefrancigena.com – Certified email (PEC): vineriaaperta@pec.it – Tel.: +39 366 711 3711
Data Protection Officer (DPO): not appointed
- What data we process
a) Browsing data
During normal use, the systems that run the website collect certain technical data: IP address, browser and device type, operating system, pages visited, date and time of the request. This data is used to operate the website, keep it secure and, only with your consent, produce statistics.
b) Data you provide
When you email us, call us or contact us on WhatsApp, we process the data you give us: first name, surname, contact details, dates of interest, number of guests and the content of your request.
c) Booking data
To book a stay or an experience, we process personal and contact details, dates of stay, group composition (including any minors), payment details and any special requests. Online bookings are made through the Passepartout booking system: payment card details are handled directly by the payment service provider and are not stored by us
- d) Data required by law during your stay
On arrival we must identify each guest by means of a valid identity document and send their details to the Police Headquarters (Questura) (Art. 109 of the Consolidated Public Security Act – T.U.L.P.S.) via the Alloggiati Web portal. We also process the data required for ISTAT statistical surveys on tourist flows and for managing the tourist tax of the Municipality of Montalcino.
e) Data on allergies or intolerances
If you take part in a tasting or a cooking class, you may tell us about food allergies or intolerances. This is health data: we process it only with your explicit consent, solely to prepare the service safely, and we delete it at the end of the experience.
f) Cookies and tracking tools
For cookies and similar tools, please see the Coolie Policy where you will find the up-to-date list and can change your choices at any time.
3. Why we process data, on what legal basis and for how long
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to requests for information or quotes (email, phone, WhatsApp) | Pre-contractual measures at your request (Art. 6(1)(b) GDPR) | 12 months from the last contact, if the request does not turn into a booking |
| Managing the booking, the stay and the experiences purchased | Performance of the contract (Art. 6(1)(b) GDPR) | For the duration of the relationship and then 10 years for accounting and tax records |
| Guest registration and notification to the Police Headquarters (Alloggiati Web) | Legal obligation (Art. 6(1)(c) GDPR; Art. 109 T.U.L.P.S.) | Data sent within 24 hours of arrival; transmission receipt kept for 5 years. We do not keep copies of identity documents |
| ISTAT statistical surveys, tourist tax, tax obligations | Legal obligation (Art. 6(1)(c) GDPR) | For the periods set by the applicable laws (10 years for tax documents) |
| Allergies and intolerances for tastings and cooking classes | Explicit consent (Art. 9(2)(a) GDPR) | Until the end of the experience |
| Aggregate statistics on website use (Google Analytics 4) | Consent (Art. 6(1)(a) GDPR; Art. 122 Italian Privacy Code) | [14 months] |
| (optional) Personalised advertising and remarketing ([Google Ads / Meta Pixel]) | Consent (Art. 6(1)(a) GDPR; Art. 122 Italian Privacy Code) | As set out in the Cookie Policy |
| (optional) Sending offers by email to past guests, for similar services | Legitimate interest (Art. 6(1)(f) GDPR; Art. 130(4) Italian Privacy Code); you may object at any time | Until you object and in any case no longer than [24 months] from the last stay |
| (optional) Newsletter and promotional communications | Consent (Art. 6(1)(a) GDPR) | Until consent is withdrawn |
| Website security, fraud prevention, protection of our rights, including in court | Legitimate interest (Art. 6(1)(f) GDPR) | For as long as necessary and, in the event of a dispute, until its final outcome |
4. How we process data
We process data using electronic and, where necessary, paper-based tools, adopting appropriate technical and organisational measures to protect it against unauthorised access, loss or destruction. Data is accessed only by authorised and trained staff, to the extent required by their duties.
5. Who we share data with
Data may be processed on our behalf, under a contract binding them to comply with the GDPR (Art. 28), by the following suppliers appointed as data processors:
- Passepartout – online booking system;
- Palazzina Creativa – website hosting and maintenance;
- Google Ireland Ltd – statistics (Google Analytics 4), maps (Google Maps) and, if activated, advertising (Google Ads);
- (optional) Meta Platforms Ireland Ltd – Meta Pixel;
- Monte dei Paschi di Siena and Banca Fideuram – payment processing;
- Studio Boanini – accounting and tax compliance;
- Palazzina Creativa – management of the website and advertising campaigns.
We also share data, as independent controllers, with:
- public authorities where required by law (Police Headquarters, Municipality of Montalcino, ISTAT, Italian Revenue Agency);
- partners delivering certain experiences, limited to name, number of participants and information needed for the service: Podere Le Ripi, Mastrojanni, Vineria Aperta WineBar, Vintage Tours.
- booking portals (e.g. Booking.com, Airbnb) when the booking is made through them: in this case the portal’s privacy policy also applies.
If you contact us via WhatsApp, the conversation also passes through the systems of WhatsApp Ireland Ltd, which processes it in accordance with its own privacy policy. Data is never disclosed to the public or sold. The up-to-date list of data processors is available on request.
6. Transfers of data outside the European Union
Some suppliers (for example Google and Meta) may also process data in the United States. In these cases the transfer is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, for participating companies, or on the standard contractual clauses approved by the Commission (Art. 46 GDPR).
7. Is providing data mandatory?
Providing booking data and data required by law is necessary to stay at the property: without it we cannot confirm your booking or welcome you. Consent to statistics, advertising and newsletters, on the other hand, is optional, and refusing it has no consequences for your stay. We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you.
8. Your rights
At any time you may ask us to:
- access your data and receive a copy of it (Art. 15 GDPR);
- rectify or complete it (Art. 16);
- erase it, where there is no legal obligation requiring us to keep it (Art. 17);
- restrict its processing (Art. 18);
- receive it in a structured format and transmit it to another controller (portability, Art. 20);
- object to processing based on legitimate interest and, at any time and without giving reasons, to direct marketing (Art. 21);
- withdraw any consent given, without affecting the lawfulness of processing carried out before withdrawal (Art. 7).
To exercise your rights, write to info@cortefrancigena.com. We will reply within one month, extendable by two months in more complex cases. If you believe that the processing infringes the GDPR, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.
9. Minors
The website is not intended for children under 14. Data of minors staying with their family is provided by the parent or person exercising parental responsibility and is processed solely for legal purposes and for managing the stay.
10. Changes to this policy
We may update this policy to reflect changes in legislation or in the services offered. The version in force is always published on this page, with the date of the last update.