Privacy Policy
Privacy Policy
Information under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) · Last updated: 20 October 2026
This policy explains how we process the personal data of people who visit www.zaluna.com, write to us or ask us for a quote. Details on cookies and other tracking tools are in the Cookie Policy.
1. Data controller
Albergo Zaluna di Bosin Gianni & C. s.a.s.
Loc. Zaluna, 2 – 38037 Predazzo (TN), Italy
VAT no. IT01673910228
Email: info@zaluna.com · Phone: +39 0462 576126
We have not appointed a Data Protection Officer (DPO), as this is not required for our business. For any privacy question you can write to the address above.
2. What data we process
Browsing data
When you visit the website, the server automatically records some technical data, such as IP address, date and time of the request, page visited, browser type and operating system. This data is needed to run the website, protect it from abuse and solve technical problems; it is not used to identify you.
Data you give us
- Enquiry form (“Enquiry” and “Info” pages): first name, last name, email, phone, arrival and departure dates, number of adults, number and ages of children, whether you travel with dogs and their size, and any message.
- Email and phone: the data you choose to give us when you contact us directly.
Please do not include unnecessary data in your messages, especially health data or other special categories of data. If you tell us about special needs (for example food intolerances) to organise your stay, we will use them for that purpose only.
Children’s data
To prepare an accurate offer we only ask for the ages of the children travelling with you, never their names. The website is not aimed at minors and we do not knowingly collect data provided directly by children under 14.
Where visits come from
If you reach the website from a campaign (for example a Google Ads advert or a newsletter), the page address contains parameters that identify the campaign (UTM parameters) and, for Google Ads, a click identifier (gclid, gbraid or wbraid). During your visit these parameters are carried over to the website’s internal links, without saving anything in your browser, and if you send us an enquiry they are attached to it together with the name of the website you came from. We use them internally only, to understand which campaigns generate enquiries.
Only if you consent to the “Marketing” category in the cookie banner does the website also remember this information between visits, with 30-day cookies, and may we share the click identifier with Google Ads to measure campaign results.
Statistics and advertising
Only with your consent, given by category in the cookie banner, the website uses Google Analytics 4 for statistics on how pages are used (pages visited, where visits come from, clicks on phone, email and WhatsApp) and Google Ads to measure the enquiries and calls generated by our adverts and to show you our adverts on other websites (remarketing). These tools are loaded with Google Tag Manager only after your consent: without consent no Google script is loaded. Details are in the Cookie Policy.
3. Why we process data and on what legal basis
| Purpose | Legal basis | How long |
|---|---|---|
| Answering your requests for information and quotes and preparing the offer | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) | 24 months from the request, then the data is deleted; if you book, the booking periods apply |
| Managing your booking and stay | Performance of the contract (Art. 6(1)(b) GDPR) | For the duration of the relationship and then for the periods required by law |
| Complying with legal obligations (for example tax, accounting and public security obligations related to the stay) | Legal obligation (Art. 6(1)(c) GDPR) | For the periods set by law (10 years for accounting records) |
| Protecting the website and forms from abuse and spam and keeping them secure | Legitimate interest of the controller (Art. 6(1)(f) GDPR) | For as long as strictly necessary |
| Knowing which campaign an enquiry comes from (campaign parameters in the page address, attached to the enquiry) | Legitimate interest of the controller in assessing the effectiveness of its promotion (Art. 6(1)(f) GDPR); nothing is saved in your browser | For as long as the enquiry |
| Remembering where you came from across visits, measuring campaign results in Google Ads (enquiries and calls) and showing you our adverts on other websites (remarketing) | Consent (Art. 6(1)(a) GDPR) given through the cookie banner (Marketing category) | 30 days in your browser for our own cookies; for Google’s cookies see the Cookie Policy |
| Statistics on how the website is used, with Google Analytics 4 | Consent (Art. 6(1)(a) GDPR) given through the cookie banner (Statistics category) | According to the Google Analytics retention setting, at most 14 months |
| Showing the Google Maps map | Consent (Art. 6(1)(a) GDPR) given through the cookie banner or the button on the map | See the Cookie Policy |
| Defending our rights in case of disputes | Legitimate interest of the controller (Art. 6(1)(f) GDPR) | For the duration of any dispute |
The data marked as required in the forms is needed to answer you: without it we cannot prepare the offer. All other data is optional. We do not make decisions based solely on automated processing, including profiling.
4. How we process data
Data is processed electronically, with technical and organisational measures that protect it from unauthorised access, loss or disclosure: encrypted connection (HTTPS), access limited to authorised staff, spam protection that does not ask you to solve captchas.
5. Who we share data with
Data is processed by authorised hotel staff and, where needed, by suppliers acting as processors on our behalf under an agreement pursuant to Art. 28 GDPR:
- the website hosting provider, with servers in the European Union;
- the agency that runs and maintains the website (Digitalianlab);
- Scidoo (scidoo.com), the online booking system that opens with the “Book” button;
- our email service provider.
With your consent, data is also processed by Google Ireland Limited and Google LLC: for Google Analytics as a processor on our behalf; for Google Ads and Google Maps as an independent controller, under its own privacy policy. If you accepted marketing cookies, the advert click identifier may be shared with Google Ads to measure campaign results. Data may also be disclosed to authorities where required by law (for example the registration of guests with the police). We do not sell data or give it to third parties for their own marketing.
6. Transfers outside the European Union
We process data in the European Union. Some suppliers, such as Google, may also process it in the United States: in that case the transfer is based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework or on the standard contractual clauses approved by the Commission.
7. Your rights
At any time you can ask us:
- for access to your data and a copy of it (Art. 15);
- to correct inaccurate data (Art. 16);
- to erase your data (Art. 17) or restrict its processing (Art. 18);
- for portability of the data you gave us (Art. 20);
- to object to processing based on legitimate interest (Art. 21), and in any case to receiving promotional messages;
- to withdraw your consent, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).
To exercise your rights, write to info@zaluna.com: we will reply free of charge within one month. You can change your cookie choices at any time from Cookie settings.
If you believe that the processing breaches the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.
8. Links to other websites
The website contains links to external websites, for example the Scidoo booking system, our social media profiles and local tourism websites. These websites have their own privacy policies, which we encourage you to read.
9. Changes
We may update this policy when our services or the law change. The date of the last update is shown at the top. If the changes concern processing based on consent, we will ask for your consent again.
