The data controller for personal data processed through this website is Mediterraneo Luxury Apartments.

For any privacy-related request or to exercise your rights under Regulation (EU) 2016/679, you can write to mediterraneoapt@gmail.com or u.carini@gmail.com, or contact +39 388 399 9804.

Browsing data: while using the website, technical data such as IP address, browser information, device information, date and time of the request, and requested resources may be processed as necessary for operation and security.

Data voluntarily provided by the user: through the contact form we collect full name, email address, phone number, preferred apartment, check-in and check-out dates, number of guests, and any optional message sent by the user.

Technical preferences: the website stores the selected language through a technical cookie required to keep the browsing experience consistent across pages.

Interactions with third-party services: opening WhatsApp links, social links, or the embedded map may involve data processing by the relevant third-party providers under their own privacy policies.

Handling availability enquiries, pre-contractual information requests, and follow-up communications: the legal basis is the performance of pre-contractual measures taken at the data subject's request under Art. 6(1)(b) GDPR.

Technical management of the website, security, abuse prevention, and storage of the selected language: the legal basis is the controller's legitimate interest in ensuring functionality, reliability, and security of the service under Art. 6(1)(f) GDPR.

Compliance with legal obligations, requests from competent authorities, or protection of the controller's rights: the legal basis is compliance with legal obligations and, where applicable, the controller's legitimate interest under Art. 6(1)(c) and (f) GDPR.

At the time of writing, data collected through the contact form is not used for automated marketing, newsletters, or commercial profiling.

Providing the data requested in the contact form is necessary in order to receive and manage an availability or information request. Failure to provide the required data may prevent the controller from responding effectively.

The optional message field is not mandatory. Users are invited not to include special categories of personal data or any information that is not necessary for the request.

Personal data may be processed by parties providing technical or organizational services related to website operation and enquiry handling, strictly within the scope of their respective functions.

Contact form submissions may also be transmitted and managed through the external form service configured for the website. At the time of writing, the project is designed to use Formspree; the provider's documentation states that services are hosted on AWS infrastructure in the United States and that Standard Contractual Clauses are relied upon for data transfers.

Pages embedding Google Maps or linking to WhatsApp, Instagram, and Facebook may involve the disclosure of personal data and browsing data to those third-party providers, which operate under their own privacy policies and, where applicable, as independent controllers.

Where technical providers or integrated services process data outside the European Economic Area, transfers take place using the mechanisms provided by Articles 44 and following of the GDPR, where applicable.

The website uses a technical cookie to store the language selected by the user. This cookie is necessary for website operation and does not require prior consent, without prejudice to the duty to provide information.

At the time of writing, no first-party analytics cookies or profiling cookies appear to be active on the website.

The embedded Google map may load third-party content and may involve the use of cookies or similar tools by Google according to Google's own policies. Users should therefore also consult Google's privacy information.

Data submitted through the contact form is kept for the time necessary to manage the request and any related follow-up and, as a rule, no longer than 12 months from the last meaningful contact, unless further retention is required to protect the controller or comply with legal obligations.

Technical browsing data is kept for the time strictly necessary for website operation, security, and maintenance, according to the technical retention times applied by the providers involved.

The technical language cookie remains active for up to 12 months unless deleted earlier by the user.

In the cases provided for by Articles 15-22 GDPR, the data subject may request access to personal data, rectification, erasure, restriction of processing, data portability where applicable, and objection to processing based on legitimate interest.

The data subject may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) through the channels indicated at www.garanteprivacy.it, without prejudice to any other remedy available by law.

The website does not use automated decision-making processes or profiling activities based on the data submitted through the contact form.