privacy policy

ONE BELVEDERE TUSCANY

ACCOMMODATION · RESTAURANT · SPA · TASTINGS

WEBSITE PRIVACY POLICY

WEBSITE AND JOB APPLICANTS

Website https://onebelvedere.com — provided pursuant to Articles 13–14 of Regulation (EU) 2016/679

Version 1.0 — July 2026

Data Controller

The Data Controller of personal data is ONE BELVEDERE SARL, VAT No. 04398131005 / Tax Code 00310770524, with registered office at Loc. Casanova dei Carfini, Castellina in Chianti (SI) 53011 and operational headquarters at Loc. Belvedere, 1 — 53036 Poggibonsi (SI), represented by its legal representative Natacha Le Cardiet Fazal Karim, who can be contacted at the e-mail address [email protected], certified e-mail (PEC) [email protected], tel. 0577 1607365, and by ordinary mail at the registered office address indicated above.

Categories of Data Collected

Through the website https://onebelvedere.com, the Data Controller may process the following categories of personal data:

Browsing data: the IT systems and software procedures used to operate the website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (for example IP addresses, access logs, device identifiers, browser and operating system, pages visited).
Data voluntarily provided through contact forms: identification and contact data (first name, surname, e-mail, telephone number) and the content of the request, provided by the user in order to receive information or quotations.
Data for bookings and online purchases (e-commerce): identification and contact data, data relating to the requested stay/service, and payment data necessary to conclude and perform the contract.
Data for newsletter subscription: e-mail address and any identification data provided by the user who subscribes to the service.
Cookies and similar technologies: as described in the website’s Cookie Policy, to which reference is made.
Job application data (CV): curriculum vitae, identification and contact data, educational qualifications, experience and professional qualifications, transmitted through the website, the contact form or by e-mail by candidates, either spontaneously or in response to a recruitment search.

Purposes, Legal Basis and Retention

The data collected through the website are processed for the following purposes:

Website operation and IT security (browsing data and technical cookies): the legal basis is the legitimate interest of the Data Controller in providing and securing the service (Article 6(1)(f) GDPR); the data are retained for the technically necessary period and, for logs, for the periods required by law.
Responding to requests sent through contact forms: the legal basis is the performance of pre-contractual measures taken at the request of the data subject and/or the legitimate interest in responding (Article 6(1)(b) and (f) GDPR); the data are retained for the time necessary to handle the request.
Management of bookings and online purchases: the legal basis is the performance of the contract or pre-contractual measures (Article 6(1)(b) GDPR); for invoicing and related accounting and tax obligations, compliance with a legal obligation (Article 6(1)(c) GDPR), with tax data retained for 10 years pursuant to Articles 2214 and 2220 of the Italian Civil Code and applicable tax legislation.
Sending newsletters and promotional communications: the legal basis is the consent of the data subject (Article 6(1)(a) GDPR); the data are processed until consent is withdrawn, which may be done at any time, including via the unsubscribe link contained in each communication.
Profiling/analytics cookies: the legal basis is the consent of the data subject, given through the cookie banner; for retention periods, reference is made to the Cookie Policy.
Personnel selection: evaluation of applications and CVs received, including through the website. Legal basis: the performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR) and, for unsolicited applications not relating to a specific position, the legitimate interest of the Data Controller in evaluating the profiles received (Article 6(1)(f) GDPR); the data are retained for 6 months from receipt of the application.

Job Applications and Personnel Selection

Since applications are often received through the website, the contact form or the Data Controller’s e-mail address, it is specified that CVs and job application data received are processed exclusively for the purpose of evaluating the candidate’s profile and managing the selection process, in accordance with the legal bases and retention periods indicated above. Providing the data is necessary in order to participate in the selection process: failure to provide the data makes it impossible to evaluate the application.

The data subject is invited not to include in the CV or application special categories of data (Article 9 GDPR), such as data relating to health, religious beliefs or trade union membership, where such data are not relevant to the professional assessment; if such data are nevertheless provided voluntarily, they will be processed only where strictly necessary and within the limits permitted by law. Job application data are processed by persons authorized to process data who are responsible for management and human resources, identified in writing, and are not communicated to third parties or disseminated, except where required by law.

Processing Methods and Security

Processing is carried out using IT and telematic tools, according to logic strictly related to the purposes indicated and in compliance with the principle of data minimization. The Data Controller adopts appropriate technical and organizational measures to ensure data security, including perimeter network protection (firewall), antivirus software, personal access credentials, backups and a compliant cookie banner with granular consent.

Nature of the Provision of Data

The provision of browsing data is connected with the use of Internet protocols. For the purposes of responding to requests, bookings and purchases, the provision of data marked as mandatory is necessary: failure to provide such data prevents the request from being processed or the contract from being concluded and performed. The provision of data for newsletters and non-technical cookies is optional and subject to consent, which may be freely withdrawn.

Recipients and Authorized Persons

The data may be communicated, exclusively for the purposes indicated above, to:

persons authorized to process data (staff responsible for managing the website, bookings and administration), identified in writing;
external data processors pursuant to Article 28 GDPR, such as the website and hosting provider, the manager of the booking/e-commerce platform, any online payment service providers and the newsletter delivery platform;
tax and/or judicial authorities, where required by legal obligations or upon specific request.

The data are not subject to dissemination.

Transfer of Data to Third Countries

The Data Controller does not transfer data outside the European Economic Area. Certain third-party services (in particular statistical analysis tools and social platforms) may involve the transfer of data to third countries: such transfer is legitimized by adequacy decisions of the European Commission or by the adoption of appropriate safeguards pursuant to Articles 44 et seq. of the Regulation.

Rights of the Data Subject

Pursuant to Regulation (EU) 2016/679 (GDPR) and national legislation, the data subject may, in accordance with the procedures and within the limits provided by applicable law, exercise the following rights:

request confirmation as to whether personal data concerning him or her exist and obtain access to them (Article 15);
know their source, receive them in an intelligible form and obtain information concerning the logic, methods and purposes of the processing;
request their updating, rectification, integration, erasure, transformation into anonymous form or blocking of data processed unlawfully (Articles 16 and 17);
right to restriction of processing (Article 18) and right to object (Article 21);
right to withdraw consent and right to data portability (Article 20);
right to lodge a complaint with the supervisory authority — Garante per la protezione dei dati personali (Article 77).

To exercise his or her rights or for any clarification, the data subject may contact the Data Controller using the contact details indicated above, or the data protection consultant.

Changes to this Privacy Notice

The Data Controller reserves the right to amend or update this privacy notice, including as a result of changes to applicable legislation or to the services offered through the website. Any changes will be published on this page together with the date of the update.