Last updated: 16 October 2026
This notice explains how we process the personal data of people who visit www.locandailpino.it, contact us or book a stay, in accordance with Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003. The Italian version of this notice prevails in case of discrepancies.
1. Data controller
Locanda Il Pino, Via Cellolese 4, 53037 San Gimignano (SI), Italy, VAT no. 01250990528. Email: locandailpino@gmail.com – Tel. +39 347 707 2469.
2. What data we process
- Browsing data: IP address, browser type, pages visited and times, recorded automatically by the server for the operation and security of the website.
- Data you give us when you contact us: name, email, phone number and the content of your message, when you write to us or call us.
- Booking data: first name and surname, email, phone number, dates of stay, number of guests, services requested and any special requests entered in the booking form.
- Payment data: if you pay online, card details are handled directly by Stripe or PayPal; we never see or store your full card number.
- Guest data on arrival: personal details and identity document data, required by Italian law for all accommodation providers.
3. Why we process it and on what legal basis
- To answer your requests and send you quotes (pre-contractual measures, Art. 6(1)(b) GDPR).
- To manage your booking, stay, payments and any cancellations (performance of a contract, Art. 6(1)(b) GDPR).
- To comply with legal obligations: reporting guests to the Police (Art. 109 TULPS), tourism statistics, the San Gimignano tourist tax, tax and accounting obligations (legal obligation, Art. 6(1)(c) GDPR).
- To keep the website secure and prevent abuse (legitimate interest, Art. 6(1)(f) GDPR).
We do not use your data for profiling or send you advertising without your consent.
4. How long we keep it
- Booking data and tax documents: for the period required by tax and civil law (normally 10 years).
- Data reported to the authorities by law: for the period set by the applicable regulations.
- Information requests not followed by a booking: for the time needed to reply, and in any case no longer than 24 months.
- Browsing data: for the technical period set by the hosting provider.
5. Who may receive it
Data is processed by the controller and authorised staff. It may also be processed by providers acting on our behalf as data processors:
- Aruba S.p.A. (website hosting);
- Freetobook Ltd (online booking system);
- Stripe and PayPal (online payments);
- tax and accounting advisers.
Data is disclosed to public authorities only when required by law. Some providers may process data outside the European Union (for example in the United Kingdom or the United States): in these cases transfers are based on European Commission adequacy decisions or standard contractual clauses.
6. Your rights
You can ask at any time to access, correct or delete your data, restrict or object to its processing, and receive it in a portable format (Arts. 15–22 GDPR), by writing to locandailpino@gmail.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
7. Providing your data
Contact and booking data are necessary to answer your requests and manage your stay; guest data is required by law. Without this data we cannot confirm your booking.
8. Cookies
For information about cookies, please see our Cookie Policy.