Privacy Policy

Borgo Prino S.r.l. — VAT no. IT01774410086
Via T. Littardi 70, 18100 Imperia (IM), Italia
info@villarappis.com

Borgo Prino S.r.l. is the company that runs Villa Rappis.

• Data you send us through the contact form: name, email, message and, if you provide them, phone number and departure date. We also record the language of the page you write from.
• Data you send us directly by email or WhatsApp.
• Technical browsing data: like any website, the server automatically logs IP address, date and time, requested page, browser and referring page.
• Anti-bot check on the form: when you start filling in the contact form, Cloudflare Turnstile receives your IP address and technical signals from your browser (for example browser and device type) to tell people apart from automated programs.
• Technical data from the booking bar: at the bottom of every page is the Beddy search bar, which your browser loads from Beddy’s servers: they receive your IP address and technical browser data, as with any content loaded from another site. The bar sets no cookies (see the Cookie Policy).

We do not ask for, and do not wish to receive through the site, special categories of data (for example health data): please do not include them in your message.

• Replying to your requests for information, availability or a quote: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Showing the booking bar, so you can check availability and book directly from the site: our legitimate interest in offering online booking (Art. 6(1)(f) GDPR).
• Protecting the website against abuse and cyber attacks (server logs, automatic blocking of addresses behaving maliciously, an anti-bot check and a limit on form submissions): our legitimate interest in security (Art. 6(1)(f) GDPR).

We do not use your data to send you advertising or newsletters, and we do not subject it to automated decision-making.

Form fields marked with * are needed so we can reply; without them we cannot handle your request. The other fields are optional.

• Requests by form, email or WhatsApp: for as long as needed to reply and to manage any stay that follows; if the request does not lead to a booking, no longer than 24 months after the last contact.
• Technical server logs: 10 days, after which they are deleted automatically. Addresses blocked by the intrusion-prevention system stay in its records for at most 7 days.

Form messages are not stored on the website’s server: they reach us by email. To limit abuse, the server keeps the time of each submission together with an encrypted fingerprint (hash) of the IP address, from which the address cannot be recovered, and deletes it within 20 minutes; this data is not included in backups.

The data is not sold or published. It is processed by us and, on our behalf and only for the purposes described, by these providers appointed as data processors:

• Hetzner Online GmbH (Germany) — hosting of the website and server logs;
• Brevo (Sendinblue SAS, France) — delivery of the emails generated by the contact form;
• Google Ireland Limited (Google Workspace) — the info@villarappis.com mailbox where we receive messages;
• Cloudflare, Inc. — domain management, network protection and the anti-bot check on the contact form (Turnstile).

Protection against attacks. The server uses CrowdSec (CrowdSec SAS, France): when an IP address behaves maliciously (for example intrusion attempts), it is blocked and reported to the CrowdSec network, which shares these reports to protect other sites. Normal browsing is not affected. Legal basis: our legitimate interest in security (Art. 6(1)(f) GDPR).

Booking bar and booking system. They are provided by Zucchetti Hospitality S.r.l. (Italy) under the Beddy brand. For payments the booking system uses Stripe (Stripe Payments Europe, Limited, Ireland), which for fraud prevention also processes your browser’s technical data as an independent controller, under its own privacy policy. Stripe is not loaded on this site’s pages.

Some of these providers may also process data outside the European Union (in particular in the United States). Such transfers are covered by the EU-U.S. Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission.

• Completing a booking — searching in the bar or pressing “Book” opens the Beddy booking system (villarappis.beddy.io), over the page or in a new tab: it has its own cookie notice, and the data you enter there to book and pay is governed by the notices published in that system.
• Google Maps — the map loads only if you press “Show the map”. From then on Google receives your IP address and may set cookies, under its own privacy policy.
• WhatsApp — the button opens WhatsApp: messages are also processed by WhatsApp Ireland Limited under its privacy policy.

You can ask us at any time for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest (Arts. 15–22 GDPR). Write to info@villarappis.com: we reply within one month.

If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the country where you live.

The site uses only technical cookies and no analytics, advertising or profiling cookies; the booking bar sets no cookies. The details are in the Cookie Policy.