Privacy Policy

HOME TRAVEL SOLUTION S.R.L. (hereinafter "the Controller", "we" or "us"), operating the website Tenuta Collebrunacchi, informs you — as data subject — about the processing of your personal data when you visit this website or contact us, in accordance with EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by D.Lgs. 101/2018.

1. Data Collected and Purposes

1.1 Contact form

When you submit a request via our contact form, you provide: full name, email address, optional preferred date, and a free-text message. This data is transmitted through Formspree (Formspree, Inc., USA), our form-processing provider, which forwards it to our email address (tenutacollebrunacchi@gmail.com). Booking and contact data submitted through this website is processed and stored securely on Supabase (Supabase Inc., USA) and transmitted via Resend (Resend Inc., USA) for email confirmations. Payment data is processed exclusively by Stripe (Stripe Inc., USA) and never stored on our servers.

Purpose: To respond to your enquiry about our truffle hunting experience.
Legal basis: Art. 6(1)(b) GDPR — processing necessary for pre-contractual measures.
Retention: Data is retained in our mailbox for up to 36 months or until you request deletion.

1.2 WhatsApp

Our website provides a direct link to WhatsApp (operated by Meta Platforms, Inc., USA). If you choose to contact us via WhatsApp, your conversation data is processed by Meta under their own privacy policy available at whatsapp.com/legal/privacy-policy. We process the content of messages received to respond to your enquiry.

Purpose: Customer communications and enquiry management.
Legal basis: Art. 6(1)(b) GDPR — pre-contractual measures / Art. 6(1)(a) — consent by initiating contact.
Retention: Up to 36 months.

1.3 Navigation data (server logs)

This website is a static HTML file served locally or from a hosting provider. If hosted online, the web server may collect standard access logs (IP address, browser type, referring URL, timestamp) for security and technical maintenance purposes only.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in security.
Retention: Up to 30 days, then automatically deleted.

1.4 Cookie consent (localStorage)

We store your cookie consent preference in your browser's localStorage under the key hts_cookie_consent. This is a client-side technical mechanism; the data never leaves your device. See our Cookie Policy for full details.

2. Third-Party Services

Data transfers to the United States are based on Standard Contractual Clauses (SCC) adopted by the European Commission pursuant to Art. 46(2)(c) GDPR and/or the EU–US Data Privacy Framework where applicable.

3. Analytics and Profiling — Consent-based

This website uses Google Analytics 4 (Google LLC, USA) and Microsoft Clarity (Microsoft Corporation, USA) to analyse how visitors interact with our website (pages visited, session duration, heatmaps). These tools are loaded only if you click "Accept all" in the cookie banner on your first visit. If you choose "Essential only", no analytics scripts are loaded.

Legal basis: Art. 6(1)(a) GDPR — your explicit consent.
Retention: Google Analytics data is retained for 14 months (default GA4 setting). Microsoft Clarity data is retained for 13 months.
Opt-out: You may withdraw consent at any time via the Cookie Policy page (Reset my consent preference button), or by installing the Google Analytics opt-out browser add-on.

We do not build behavioural profiles for advertising purposes, and we do not sell, rent, or share personal data with third parties for marketing purposes.

4. Data Retention

We retain personal data only for as long as necessary for the purposes described above or as required by applicable law. In particular:

• Contact and enquiry data: up to 36 months from last contact.
• Accounting and fiscal records related to bookings: 10 years pursuant to Art. 2220 Italian Civil Code.
• Server access logs: up to 30 days.
• Cookie consent preference (localStorage): stored until you clear your browser data.

5. Your Rights (Art. 15–22 GDPR)

You have the right to:

• Access (Art. 15): obtain confirmation of whether we process your data and receive a copy.
• Rectification (Art. 16): request correction of inaccurate personal data.
• Erasure / Right to be forgotten (Art. 17): request deletion of your data where there is no overriding legal ground.
• Restriction of processing (Art. 18): request that we limit how we use your data.
• Data portability (Art. 20): receive your data in a structured, machine-readable format.
• Object to processing (Art. 21): object to processing based on legitimate interest.
• Withdraw consent (Art. 7(3)): where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, contact us at tenutacollebrunacchi@gmail.com or hometravelsolution@pec.it. We will respond within 30 days as required by Art. 12 GDPR.

6. Right to Lodge a Complaint

If you believe that the processing of your personal data violates GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali):

7. Changes to this Policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. We encourage you to review this page periodically. Material changes will be communicated where required by law.

Informativa in italiano (sintesi)

Il titolare del trattamento è HOME TRAVEL SOLUTION S.R.L., Via Donizetti 21/2, 50053 Empoli (FI) — P.IVA 07367870487 — email: tenutacollebrunacchi@gmail.com. I dati personali (nome, email, messaggio) forniti tramite il modulo di contatto vengono trattati esclusivamente per rispondere alle richieste degli utenti e non vengono ceduti a terzi per finalità commerciali. Per esercitare i diritti previsti dagli artt. 15–22 GDPR è possibile contattare il titolare agli indirizzi sopra indicati. In caso di reclamo è possibile rivolgersi al Garante Privacy (garanteprivacy.it).

I dati forniti in fase di prenotazione (nome, email, numero di partecipanti, dati di pagamento) vengono trattati per l'erogazione del servizio richiesto. I pagamenti sono gestiti da Stripe Inc. Le email di conferma sono inviate tramite Resend Inc. I dati sono conservati su Supabase Inc. Tutti i fornitori operano in conformità al GDPR tramite clausole contrattuali standard.