Privacy policy

1. Controller

2. Principles of data processing

We process personal data only to the extent necessary to operate this website, to respond to your enquiries or to comply with legal obligations. The legal bases are in particular Article 6(1)(a) GDPR (consent), (b) (contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interests). No automated decision-making, including profiling, takes place.

3. Server log files

When you visit this website, our hosting provider automatically processes technical access data: IP address, date and time of the request, page requested, HTTP status code, browser and operating system, and the previously visited page (referrer). This data is needed to deliver the website and to keep it secure and stable. The legal basis is Article 6(1)(f) GDPR. Log data is kept only for as long as necessary for these purposes and is then deleted automatically. It is not combined with other data sources.

4. Hosting by Vercel

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Server-side processing takes place in Vercel’s Frankfurt am Main region (fra1). Static content such as images and scripts is delivered via a global server network, usually from a location close to you. A data processing agreement under Article 28 GDPR is in place with Vercel. Any transfers to the United States are covered by the EU-U.S. Data Privacy Framework and, additionally, by standard contractual clauses (Article 46(2)(c) GDPR).

5. Cookies and local storage

This website uses only a small number of strictly necessary storage functions. We do not use cookies for analytics or advertising without your consent.

• Consent storage: your choice in the cookie banner is saved under the name “wft-consent” in your browser’s local storage (localStorage). You will be asked again after 180 days.

This necessary storage is based on Article 6(1)(f) GDPR and, under Article 122(1) of the Italian Personal Data Protection Code (Legislative Decree No. 196/2003), does not require consent. External content such as the Google Maps map is only loaded once you allow the “External content” category in the cookie banner (Article 6(1)(a) GDPR). You can change or withdraw your choice at any time via the “Cookie settings” link in the website footer.

6. Google Analytics 4

If you consent to the “Analytics” category in the cookie banner, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse how the website is used. This involves setting cookies and processing usage data such as pages viewed, time spent on the site, device and approximate location. Google Analytics 4 does not store complete IP addresses. Data may be transferred to Google LLC in the United States (EU-U.S. Data Privacy Framework). The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings.

7. Enquiry form and contact

You can use the enquiry form to ask about availability and prices without obligation. For this purpose we process the following details:

• name
• email address
• phone number (optional)
• preferred apartment
• arrival and departure dates
• number of guests
• your message

We use this data solely to reply to your enquiry and, where applicable, to send you a quote. The legal basis is Article 6(1)(b) GDPR (pre-contractual measures taken at your request). The same applies if you contact us directly by email or phone.

Form data is not stored in a website database but forwarded to us by email. To send it, we use Resend, Inc., San Francisco, USA, as a processor under Article 28 GDPR. Transfers to the United States are based on standard contractual clauses.

Providing your data is voluntary. However, we cannot process your enquiry without the details marked as required.

We keep your enquiry for as long as necessary to deal with it. If no booking is made, the enquiry is deleted [[TODO: Löschfrist für Anfragen ohne Buchung festlegen]]. If a booking is made, the related records are subject to the statutory retention obligations, in particular under tax law.

8. Spam protection by Cloudflare Turnstile

To protect the enquiry form against automated access (spam), we use Cloudflare Turnstile, provided by Cloudflare, Inc., San Francisco, USA. Turnstile uses technical characteristics such as IP address, browser data and interaction signals to check whether a request comes from a human. The legal basis is our legitimate interest in a working form that is protected against misuse (Article 6(1)(f) GDPR). Turnstile does not set cookies for advertising or analytics purposes.

9. Google Maps

To show where our farm is located, we embed a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded once you allow the “External content” category in the cookie banner. Until then, a placeholder is shown in its place. When the map loads, your IP address and other technical data are transmitted to Google, and data may also be transferred to Google LLC in the United States (EU-U.S. Data Privacy Framework). Google may also set cookies. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings.

10. Recipients of data

We only share your data with service providers that process it on our behalf (Article 28 GDPR) and with providers of embedded content where you have allowed it to load:

• Vercel Inc., USA: website hosting
• Resend, Inc., USA: delivery of enquiries by email
• Cloudflare, Inc., USA: spam protection (Turnstile)
• Google Ireland Limited, Ireland: map display (Google Maps), only with consent
• Google Ireland Limited, Ireland: Google Analytics 4, only with consent

We do not sell your data or share it with third parties for their advertising purposes.

11. Transfers to third countries

Some of the services we use process data in the United States. For certified providers, transfers are based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR), otherwise on standard contractual clauses (Article 46(2)(c) GDPR).

12. Your rights

You have the following rights at any time:

• right of access (Article 15 GDPR)
• right to rectification (Article 16 GDPR)
• right to erasure (Article 17 GDPR)
• right to restriction of processing (Article 18 GDPR)
• right to data portability (Article 20 GDPR)
• right to object to processing (Article 21 GDPR)
• right to withdraw consent with effect for the future (Article 7(3) GDPR)

To exercise these rights, simply send an informal message to helga.morandell@hotmail.com. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). In Italy, this is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

13. Data security

This website is transmitted exclusively in encrypted form via HTTPS (TLS). We also take appropriate technical and organisational measures to protect your data against loss and unauthorised access.

14. Changes to this privacy policy

We update this policy whenever legal requirements or the services we use change. The current version is always available on this page.