Privacy & cookies.

01The short version

02Who is responsible for your data, and how to contact them

The data described on this page is handled by two separate controllers. Each decides for their own business and is responsible only for their own processing.

Janik S.n.c.: the website and Life Cafè & Restaurant

Janik S.n.c. di Malinverno Jacopo & C. (an Italian general partnership, “Janik S.n.c.” on this page), Viale Italia 200, 58022 Follonica (GR), Italy, Companies Register of Maremma e Tirreno no. 01372330538, VAT IT01372330538, REA GR-118303. It runs this website and Life Cafè & Restaurant. It is the controller for browsing data, the data handled through the Shop page and the data of the authors of the reviews shown on the site (sections 3, 4 and 7), for messages about the website, the restaurant, events or the pieces in the Shop (section 6) and, where needed, for the small amount of room-guest data used for breakfast and the restaurant discount (section 9.8). For the Google map, it is responsible for collecting the data and passing it to Google when you tap (section 5).

Niccolò Malinverno: the Life House B&B rooms

Niccolò Malinverno, a private individual, runs the three Life House B&B rooms in Follonica (GR) as a private bed and breakfast, not as a business (CIN IT053009C1TX9PNPE5, Italy’s national registration code for guest accommodation). He is the controller for the data of anyone who asks about the rooms, books them or stays in them (sections 6 and 9).

How to contact them

For both controllers: email niccomali97@gmail.com, phone +39 344 747 6221. It’s a single point of contact. The inbox is Niccolò Malinverno’s personal one: he reads and handles messages meant for Janik S.n.c. on its behalf and under its instructions, and doesn’t use them for the rooms; messages about the rooms he handles as controller. You can also write to Janik S.n.c. by post at its registered address.

If you’re writing to exercise your rights, tell us whether it’s about the website or the restaurant (Janik S.n.c.) or about the rooms (Niccolò Malinverno). If you don’t say, we’ll treat it as addressed to both.

Neither controller has appointed a data protection officer (DPO), as they aren’t required to for what they do (Article 37 GDPR).

On this page, “we” means whichever controller the section is about: Janik S.n.c. in sections 3, 4, 5, 7, 8 and 10, and Niccolò Malinverno in section 9, except where Janik S.n.c. is named. In section 6 it depends on what you’re asking about; in the general sections, it means each of them for their own processing.

03Browsing data

When you open a page, your browser sends the server hosting it the technical data needed to show it to you. The site is hosted by Vercel Inc. For every request, Vercel receives and logs, among other things:

• your IP address;
• the date and time;
• the address of the page or file requested and whether the request succeeded;
• your browser and operating system, with their versions;
• the page you came from, if you arrived from another site and your browser passes it on;
• a technical fingerprint of the encrypted (TLS) connection, which Vercel uses for security.

From your IP address, Vercel works out your approximate city and country, not your exact location.

We use this data to show you the site, keep it running properly and protect it from abuse and cyberattacks. We don’t use it to find out who you are, and we don’t combine it with other data. The only exception is investigating an attack on the site or a computer crime: in that case we may hand the relevant data to the authorities that ask for it.

Vercel handles this data on our behalf as a data processor (Article 28 GDPR), under its data processing agreement. Vercel also uses some technical and traffic data to keep its own platform secure and to improve its services: for those purposes it decides for itself and acts as an independent controller, under its own privacy notice.

If you connect from Italy, pages normally reach you from a Vercel server in Europe (Frankfurt). But Vercel is based in the United States and mainly processes data there (section 12).

Legal basis: our legitimate interest in running the site securely (Article 6(1)(f) and Recital 49 GDPR).

How long it’s kept: visit logs stay available to us in Vercel’s dashboard for no more than 30 days. We only look at them to fix technical or security problems, and we don’t export them unless they’re needed to investigate an attack; in that case we keep only the logs needed, and only for as long as the investigation requires. When our contract with Vercel ends, Vercel deletes the data it handles on our behalf, as its data processing agreement provides. Vercel keeps its own technical and security logs for as long as it needs them for those purposes, as its privacy notice explains.

04The Shop page

The Shop page (/en/shop, or /shop in Italian) shows our own pieces. The names, descriptions and photos of the pieces aren’t hosted on our site: we manage them with Sanity, a content service provided by Sanity US Inc. (United States). When you open the Shop page, your browser connects to Sanity’s servers on its own, without you clicking anything: i0p995i4.apicdn.sanity.io for the text and cdn.sanity.io for the photos.

To respond, Sanity receives your IP address, the technical data every browser sends (date and time, the content requested, your browser and operating system) and, as the source of the request, just our site’s address, not the specific page. Our site sends Sanity nothing else, and the Shop page uses no cookies. No other page on the site connects to Sanity.

Sanity handles this data on our behalf as a data processor (Article 28 GDPR), under its data processing agreement. For its own technical logs, which it uses among other things to keep its service secure and prevent abuse, Sanity decides for itself and acts as an independent controller, under its own privacy policy.

Sanity says its main systems run on Google Cloud in Belgium, with a backup copy in another region it doesn’t name. The text and photos, however, travel over Google’s global network, which may deliver them from a node near you, including outside the European Union (section 12).

Legal basis: our legitimate interest in showing you the page you opened (Article 6(1)(f) GDPR). This connection is strictly necessary to show you the page you asked for, so we don’t ask for your consent (Article 122(1) of the Italian Privacy Code).

How long it’s kept: Sanity says it deletes or anonymises its own logs within 90 days. If we download recent request logs from Sanity’s dashboard, which include IP addresses, we only do so to fix a technical problem or deal with abuse, and we delete the file as soon as the problem is solved.

05The Google map

On our home page the Google map doesn’t load by itself. Instead there’s a panel with our address, a “Show the map” button and a notice: until you tap the panel, the site doesn’t contact Google.

If you tap the panel, your browser loads the map from Google’s servers: first maps.google.com, then www.google.com and other Google addresses such as maps.googleapis.com and maps.gstatic.com. From that moment Google receives your IP address, your browser’s technical data and our site’s address, not the specific page. Google may also read or set its own cookies, including cookies used for advertising such as the NID cookie, which Google describes on its cookies page. The site doesn’t give the map permission to ask for your location.

Janik S.n.c., which chose to put the map on the site, is responsible for collecting your data and passing it to Google when you tap. That’s why Janik S.n.c. only lets the map load after you tap, informs you through the notice in the panel and on this page, collects your consent and handles your requests about the connection to Google. Google alone is responsible for the data it receives, for keeping it secure and for what it does with it afterwards, as an independent controller under its privacy policy: for people living in the European Economic Area or Switzerland the controller is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for people living in the United Kingdom it is Google LLC (United States). You can exercise your rights against either Janik S.n.c. or Google.

Legal basis: your consent, which you give by tapping the panel after reading the notice and, if you like, this privacy notice, linked just below the panel (Article 6(1)(a) GDPR; Article 122 of the Italian Privacy Code).

Your consent only covers the page in front of you. We don’t remember your choice: every time the page reloads, the map is closed again. You can withdraw your consent at any time: going forward, simply don’t open the map again; to close it straight away, reload the page. You can delete any cookies Google has already set in your browser settings. Withdrawing your consent doesn’t affect anything that happened before. If you’d rather not open the map, the same section has our address and an “Open in Maps” link (section 8).

How long it’s kept: we keep nothing, because the site doesn’t record your tap. For the data Google receives, the periods in its privacy policy apply.

06Email and phone

The site shows an email address and a phone number. Tapping them opens your email app or starts a call: until you write or call, we receive nothing.

If you email or call us, we handle the details you give us: your name, email address or phone number, what you’re asking and the date. We use them to reply and, if you ask, to book you a table or a room. We don’t use your contact details to send you marketing.

Who the controller is depends on what you ask. Messages about the website, Life Cafè & Restaurant, events or the pieces in the Shop are handled by Janik S.n.c. Messages about the rooms are handled by Niccolò Malinverno; if they lead to a booking, section 9 applies. There’s a single phone number, so about the rooms you may also speak to someone who works at Life Cafè & Restaurant: they only take your name, contact details and the dates you want, and pass the request on to Niccolò Malinverno, on his behalf.

The inbox niccomali97@gmail.com is a free Gmail account, a service provided by Google Ireland Limited. For this free service there’s no agreement between the controllers and Google appointing Google as a data processor (Article 28 GDPR). Google handles the data under its own privacy policy, which names Google Ireland Limited as controller for users in the European Economic Area. Google scans messages automatically, for example to spot spam and viruses, and says it doesn’t read or scan Gmail messages to show ads. Google may also process this data in the United States (section 12).

Legal basis: for booking requests, steps you ask us to take before entering into a contract (Article 6(1)(b) GDPR); for any other request, our legitimate interest in replying to you (Article 6(1)(f) GDPR); for health information, your explicit consent (Article 9(2)(a) GDPR), which we’ll ask you to confirm when you share it.

If your message includes information about your health, such as an allergy or an accessibility need, we use it only to arrange what you’ve asked for, and delete it with the rest of your request (for the rooms, at the end of your stay). You can withdraw your consent at any time by asking us to delete it.

How long it’s kept: we delete emails, messages and notes about your request within 12 months of our last exchange. If your request leads to a room booking, the periods in section 9 apply; if it concerns a dispute that’s still open, we keep it until the dispute is settled.

07Google reviews on our Restaurant page

On our Restaurant page and its Italian version we show three reviews posted on our Google listing, “Life Pratoranieri”. For each one we show the author’s first name and surname initial, the star rating, when it was posted (month and year) and the text, either as written or trimmed at the start or end; on the English page the text stays in the original Italian. We also show the average rating and the number of reviews given by Google, with a link to the listing where you can read them all.

We didn’t get this data from the authors: we took it from Google Maps, where the authors posted it and where anyone can read it. That’s why we’re telling you about it here (Article 14 GDPR). Controller: Janik S.n.c.

The reviews are published on this website, so anyone visiting it can read them. Like every page, they’re stored on our behalf by our hosting provider, Vercel, which processes data in the United States (sections 11 and 12), and the site’s technical manager can see them (section 11).

The aim is to show what the restaurant is like in the words of people who’ve been here. We only show reviews posted on our own listing, with the shortened name and a link to the source. We check the listing regularly: if an author deletes or edits their review on Google, we remove or update it here too.

Legal basis: our legitimate interest in presenting the restaurant through our customers’ opinions (Article 6(1)(f) GDPR).

How long it’s kept: for as long as the review stays on Google, and in any case no longer than two years after it was posted; then we take it off the site and also delete the earlier versions of the site that contain it, which our hosting provider keeps.

If you wrote one of these reviews, you can ask us to remove it: email niccomali97@gmail.com. You don’t have to give a reason. We’ll do it without delay, and within 15 days of your request at the latest, including in the earlier versions of the site kept by our hosting provider.

08Links to other sites

The site links to Instagram (at the bottom of every page), Google Maps (“Open in Maps”, on the home page) and our Google listing (“Read them all on Google”, on the Restaurant page). Until you tap them, those services receive nothing from our site. They open in a new tab and are set up so that your browser doesn’t tell those sites where you came from, not even our site’s name. Once you open them you’ve left our site, and Instagram’s and Google’s own privacy policies apply.

This page also links to the privacy documents of the providers and authorities it mentions. Those links open in the same tab: if you tap one, that site only receives our site’s address as the source, not the specific page.

The email and phone links open apps on your device (section 6). The “Book now” and “Book” buttons on our Rooms page take you to the room booking page (section 9).

09Booking and staying in the rooms

This section is about Niccolò Malinverno, the controller for the data of anyone who books or stays in the Life House B&B rooms. Here “we” means him and anyone who helps him run the rooms, who handles data only on his instructions (Article 29 GDPR). Contact: niccomali97@gmail.com, +39 344 747 6221. Janik S.n.c. handles booking data only on Niccolò Malinverno’s behalf, when its staff take a request about the rooms over the phone (section 6), and for itself only what’s needed for breakfast and the restaurant discount (9.8). Who receives the data is in section 11; your rights towards Niccolò Malinverno and how to complain are in section 13.

9.1 From this website to the booking page

This website doesn’t collect any booking details. The “Book now” and “Book” buttons on the Rooms page are plain links to Life House’s online booking page, which Niccolò Malinverno runs on the Lodgify service (niccolo-malinverno.lodgify.com). The site loads nothing from Lodgify and passes it no data at all. When you tap one of those buttons you leave this website: as with any website you open, Lodgify receives your IP address and your browser’s technical data and, as the source, just this website’s address, not the specific page.

On the booking page, browsing data (IP address, date and time, pages viewed, browser and operating system) is handled by Lodgify on Niccolò Malinverno’s behalf, to show you the page and protect it from abuse. The page also loads a traffic measurement tool from Cloudflare (Cloudflare Web Analytics), which Cloudflare says doesn’t follow individual visitors from one site to another.

Legal basis: Niccolò Malinverno’s legitimate interest in running the booking page securely and measuring its visits (Article 6(1)(f) GDPR).

How long it’s kept: for as long as Lodgify keeps its own technical logs for the security of its service.

9.2 Your booking

On the booking page, or in the enquiry form on the booking site, you enter the details it asks for, such as your first name and surname, email, phone number, arrival and departure dates, number of guests and any requests. We use them to manage your booking or enquiry, to get in touch with you before and during your stay and to get your room ready. If your requests include information about your health, what we say in section 6 applies. Your accommodation contract is with Niccolò Malinverno: Lodgify only provides the software. We don’t use your data to send you marketing; if we ever want to, we’ll ask you separately.

If you book for other people too, you give us their details: please show them this section. When they arrive and we check their ID, we tell each guest where to read this notice. If you book through an online booking platform, that platform passes us the booking details (such as names, contact details, dates and number of guests); for what happens on its own platform it is an independent controller with its own privacy policy.

The enquiry form on the booking site uses Google’s reCAPTCHA service to block spam, as the form itself says: Google receives technical data about your device and browser and handles it under its own privacy policy.

Legal basis for spam protection: Niccolò Malinverno’s legitimate interest in protecting the form from spam (Article 6(1)(f) GDPR).

9.3 Payment

If you pay online by card, the card number is handled by the payment service provider connected to the booking page (you can ask us which one it is): Lodgify says it doesn’t directly collect or store card numbers, and Niccolò Malinverno doesn’t receive them. We only get the result of the payment and the details needed to identify it, such as the amount, the date and the last digits of the card. If the booking terms include later payments or a security deposit, the card stays registered with the payment provider for as long as those operations require. If you pay another way, for example by bank transfer, we handle the payment details: who paid, how much and when.

The payment provider handles the data under its own privacy policy, which you’ll find on the payment page. Depending on the provider, it carries out the payment either on Niccolò Malinverno’s behalf or as an independent controller; for some purposes, such as fraud prevention and anti-money-laundering checks, it always decides for itself, as an independent controller.

9.4 When you arrive: ID and police registration

By law we can only accommodate guests who have a valid photo ID (Article 109 of the Italian Consolidated Law on Public Security, “TULPS”). When you arrive, we check in person that the document matches the person showing it. Without ID we can’t put you up.

Within 24 hours of arrival (6 hours if the stay is no longer than 24 hours) we send the Questura (police headquarters) in Grosseto, through the State Police’s Alloggiati Web portal, the following details for each guest: date of arrival and length of stay, surname, first name, sex, date and place of birth, and nationality. We also send the type, number and place of issue of each guest’s ID; for a family, one spouse’s or civil partner’s ID is enough, with the other partner’s and any under-18 children’s details, and for an organised group, the group leader’s (Decree of the Italian Minister of the Interior of 7 January 2013, as amended by the Decree of 16 September 2021).

We don’t keep photocopies or photos of your ID for police registration: if we receive a copy to send the details, we delete it as soon as the portal issues its receipt, as the Italian Data Protection Authority has told guesthouses to do (statement of 29 April 2026). We also delete the other details we collect only for the police (sex, date and place of birth, nationality, and the type, number and place of issue of your ID) as soon as the receipt arrives, as required by the Decree of the Italian Minister of the Interior of 7 January 2013 (Article 4-bis). Your name and the dates of your stay are kept only in the booking details and payment records, for the periods in section 9.10. The only copy of your ID that may be kept is the one attached to a tourist tax exemption form, if you ask for an exemption (9.6). Of the registration itself we keep only the portal’s receipt, which shows how many forms we sent on a given day, without your details. The data we send is handled as controller by the Italian Ministry of the Interior, Department of Public Security, which keeps it for no more than five years.

9.5 Official tourism statistics

Every day we record guests’ arrivals and departures on the online platform designated by the Tuscany Region, with the information required for official statistics, such as country or Italian region of residence, as required by Tuscany Regional Law 61/2024 (Article 72) and by the duty to take part in official statistical surveys (Article 7 of Legislative Decree 322/1989). That’s why we ask for your country or town of residence. ISTAT, Italy’s national statistics office, receives only aggregate figures, meaning the number of arrivals and nights by country or region of residence, protected by statistical confidentiality (Article 9 of Legislative Decree 322/1989).

9.6 Tourist tax

From 1 April to 31 October the Comune di Follonica (the local council) charges a tourist tax per person per night, for up to 15 consecutive nights. We collect it for the council and every quarter we report the number of overnight stays and the amounts collected: figures only, no names. During checks the council can ask to see the tax records.

Some exemptions have to be claimed on the council’s self-declaration form, which you only fill in if you ask for an exemption. The form contains your personal details, your residence, your Italian tax identification number (codice fiscale) and a copy of your ID and, for some exemptions, health information (for example for a person who isn’t self-sufficient and receives the Italian attendance allowance, “indennità di accompagnamento”). We use the form only to apply the exemption and keep it as evidence for the council’s checks. If the form contains health information, before we accept it we’ll ask the person the information is about, or their legal representative if they can’t give it themselves, for written consent to handle it.

9.7 Income tax

We keep payment records (receipts and booking summaries) with your name, the dates of your stay and the amounts: Niccolò Malinverno uses them for his income tax return and keeps them to show it’s correct if it’s audited. If he uses an accountant or a tax assistance centre (CAF) for his tax return, they see them too; in the event of an audit, so does the Agenzia delle Entrate (the Italian Revenue Agency).

9.8 Breakfast and the restaurant discount

Breakfast is part of your stay with Niccolò Malinverno and is served at the café of Life Cafè & Restaurant, which is run by Janik S.n.c. The 15% discount on lunch and dinner at the restaurant, on the other hand, is offered to room guests by Janik S.n.c. To serve you breakfast and apply the discount, the café only needs to know you’re staying in one of the rooms.

If your name is needed for that, the café gets only your name and the dates of your stay. You give them to the café yourself, or Niccolò Malinverno passes them on. Janik S.n.c. uses them only for breakfast and the discount, and doesn’t keep them after you leave.

Legal basis: for Niccolò Malinverno, who lets the café know you’re a guest, performance of your accommodation contract, which includes breakfast (Article 6(1)(b) GDPR), and, for the discount, his legitimate interest in getting it to you (Article 6(1)(f) GDPR); for Janik S.n.c., its legitimate interest in recognising room guests in order to serve breakfast and apply the discount (Article 6(1)(f) GDPR).

9.9 Lodgify and the booking page

Lodgify is booking software provided by Codebay Solutions Limited, Lakeside House, 4 Smith Way, Grove Park, Leicester LE19 1SX, United Kingdom (Companies House no. 05903966). It handles booking data on Niccolò Malinverno’s behalf as a data processor (Article 28 GDPR), under the data processing agreement that forms part of its terms of service. Lodgify uses its own suppliers and says some of them process and store data outside the European Economic Area, without publicly naming them (section 12): you can ask us which ones.

The booking page isn’t part of this website and has its own cookie notice, where you can accept or reject cookies. According to the cookie policy published on that page, Niccolò Malinverno is the controller of the page’s cookies, except for the Google Analytics ones, for which Codebay Solutions Limited is the controller, both on the page and during payment. The functional cookies remember things like your currency and country; the Google Analytics ones only switch on if you accept them in the notice.

9.10 Legal bases, required data and how long we keep it

Legal basis: it depends on the purpose.

• Booking, payment and stay, including letting the café know, where needed, that you’re a guest, for breakfast: performance of your accommodation contract and steps you ask us to take beforehand (Article 6(1)(b) GDPR).
• Police registration, official statistics, the tourist tax and the income tax return: legal obligations (Article 6(1)(c) GDPR).
• Letting the café know, where needed, that you’re a guest so you get the discount; running the booking page securely, measuring its visits and protecting the enquiry form from spam (9.1 and 9.2); keeping payment records for as long as the Agenzia delle Entrate can audit them; protecting ourselves in case of disputes: legitimate interest (Article 6(1)(f) GDPR).
• Health information on the exemption form: the explicit consent of the person it’s about, which we ask for in writing, in a separate sentence, when the form is handed to us (Article 9(2)(a) GDPR); to keep it after use, the need to establish or defend a right in case of checks or disputes (Article 9(2)(f) GDPR).
• Health information in your requests: your explicit consent (section 6).

Without your booking details we can’t confirm your booking. The law requires your ID when you arrive: without it we can’t put you up. You only give us exemption details if you claim an exemption.

How long it’s kept: it depends on the data.

• Booking and stay details (contact details, country or town of residence, messages, special requests): up to 24 months after you leave, or after the planned date if the booking was cancelled, to deal with questions, complaints or disputes; if a dispute is open, until it’s settled.
• Browsing data on the booking page: for as long as Lodgify keeps its own technical logs for the security of its service (9.1).
• Details collected only for the police (sex, date and place of birth, nationality, and the type, number and place of issue of your ID) and copies of your ID, except the one attached to an exemption form: deleted as soon as the Alloggiati Web portal issues its receipt (Article 4-bis of the Decree of the Italian Minister of the Interior of 7 January 2013). If you’re exempt from the tourist tax because of your age, we keep only that fact with the tourist tax records, not your date of birth.
• Alloggiati Web receipts (which don’t contain your details): 5 years.
• Payment and tourist tax records, including exemption forms: until 31 December of the sixth year after the year of your stay or, if later, the year you paid, the period during which the Agenzia delle Entrate and the council can still audit that year (Article 43 of Presidential Decree 600/1973; Article 1(161) of Law 296/2006).
• Questions or availability requests that don’t lead to a booking: 12 months after our last exchange (section 6).
• Health information given in a request: deleted at the end of your stay (section 6).
• Name and dates Janik S.n.c. uses at the café for breakfast and the discount: Janik S.n.c. doesn’t keep them after you leave (9.8).

10Cookies and your browser

This site uses no cookies of its own, except in the rare security check described below, and doesn’t store any other data about you in your browser using things like localStorage, sessionStorage or IndexedDB. We use no analytics, advertising or profiling tools. Apart from that check, third-party cookies can only come in through the site if you open the map (see the end of this section). The visual effects (the cursor, the animations, the boxes that open when you hover) run in your browser and never send your mouse position anywhere: at most they load the images they show from our site, like any page does (section 3).

As with any website, your browser keeps only a few technical items, the same for every visitor:

• a copy of the site’s files (cache), so it loads faster: your browser treats stylesheets, scripts and fonts as up to date for a year and images and videos for a day, and rechecks pages on every visit; the copies stay until you clear them or the browser needs the space;
• an instruction to open the site only over a secure connection (HTTPS), valid for two years from your last visit;
• on the Shop page, copies of the photos that come from Sanity, which your browser may treat as up to date for up to a year, and, when you open a piece, an address like /en/shop#p-piece-name in the tab’s history: it’s there for the Back button and isn’t sent to anyone.

These are technical items needed for the site to work and stay secure: they aren’t used to recognise you and don’t require your consent (Article 122(1) of the Italian Privacy Code). That’s why you won’t see a cookie banner. You can clear them whenever you like in your browser settings.

Beyond these, there’s just one case where our hosting provider stores something in your browser: if Vercel’s security system finds the traffic suspicious, it may ask your browser to pass a quick automatic check. If it passes, Vercel stores a technical item that lasts one hour and only serves to spare you the same check again. This is also a technical item, used only to keep the site secure, so it doesn’t require your consent (Article 122(1) of the Italian Privacy Code).

Apart from that check, third-party cookies only come in through the site if you open the map: Google may then read or set its own cookies, including advertising ones, and you give your consent by tapping the panel (section 5). If you tap a “Book” button you leave this website: on the booking page, its own cookie notice and cookie policy apply (section 9.9).

11Who receives your data

Your data is handled by the controllers and by the people who work with them, who are authorised and given written instructions (Article 29 GDPR). It’s also handled, on the controllers’ behalf, by these providers, acting as data processors (Article 28 GDPR):

The following also receive data:

• Google: for the map, as an independent controller of the data your browser sends it when you open it (Google Ireland Limited; for people living in the United Kingdom, Google LLC; section 5); for the Gmail inbox we use as our contact address, which Google Ireland Limited provides without an agreement appointing it as a data processor and whose messages it handles under its own privacy policy (section 6); for the reCAPTCHA service on the booking site’s enquiry form, under its own privacy policy (section 9.2);
• Cloudflare, which provides the traffic measurement tool loaded by the booking page (section 9.1);
• the payment service provider connected to the booking page, if you pay online: on Niccolò Malinverno’s behalf or as an independent controller, depending on the provider (section 9.3);
• Janik S.n.c.: where needed for breakfast or the discount, the names and dates of stay of room guests (section 9.8);
• by law, and only for room guests: the Questura in Grosseto and the Italian Ministry of the Interior (Alloggiati Web); the Tuscany Region, the lead council of the local tourism area or the union of councils that collects and checks the data by law, and ISTAT (official statistics; ISTAT gets aggregate figures only); the Comune di Follonica (tourist tax); the Agenzia delle Entrate (tax audits);
• any accountant or tax assistance centre (CAF) that helps Niccolò Malinverno with his tax return;
• online booking platforms, as independent controllers, if you book through one of them (section 9.2);
• courts or police, if they ask us for it under the law.

We don’t sell your data or pass it on to anyone for marketing. We don’t publish the data of people who visit the site, contact us or stay in the rooms. The reviews in section 7 are texts their authors had already made public on Google.

12Transfers outside the European Economic Area

The European Economic Area (EEA) is made up of the European Union plus Iceland, Liechtenstein and Norway. Some data leaves the EEA:

• Vercel (sections 3 and 7) is based in the United States and mainly processes data there. The transfer relies on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023; Article 45 GDPR): Vercel Inc. is listed as certified on the official list. Its data processing agreement also includes the standard contractual clauses approved by the Commission (Implementing Decision (EU) 2021/914; Article 46 GDPR).
• Sanity (section 4) says its main systems are in Belgium, but the company providing the service, Sanity US Inc., is based in the United States, some of its suppliers process data there too, and the text and photos may pass through Google network nodes outside the European Union. Sanity isn’t listed as certified under the Data Privacy Framework: transfers rely on the standard contractual clauses (Implementing Decision (EU) 2021/914; Article 46 GDPR) included in its data processing agreement.
• GitHub (section 7) is based in the United States. The transfer relies on the same adequacy decision given for Vercel: GitHub is listed as certified on the official list.
• Lodgify (rooms only, sections 9.1 and 9.9): Codebay Solutions Limited is based in the United Kingdom, which is covered by a European Commission adequacy decision, renewed on 19 December 2025 and valid until 27 December 2031 (Article 45 GDPR). Lodgify says some of its suppliers process and store data outside the European Economic Area, without publicly naming them or the countries involved. Its data processing agreement allows these transfers to recipients in countries that ensure an adequate level of data protection, but doesn’t say by what means (for example standard contractual clauses). The Cloudflare tool loaded by the booking page (section 9.1) may also process data outside the EEA. You can ask us for the list of these suppliers, the countries where they process data and the safeguards used for each transfer, and get a copy of them.
• Google (the map after you tap it, the Gmail inbox and reCAPTCHA on the booking site’s enquiry form, sections 5, 6 and 9.2) may process data outside the EEA as well, for example in the United States at Google LLC, which takes part in the Data Privacy Framework. Google decides on and manages these transfers itself, under its own privacy policy.
• The payment provider (section 9.3) states in its own privacy policy whether it transfers data outside the EEA and with what safeguards; for payments it carries out on Niccolò Malinverno’s behalf, you can ask us which safeguards apply and get a copy.

You can ask us for a copy of the safeguards used for transfers made by the providers that handle data on the controllers’ behalf (Vercel, Sanity, Lodgify and, when it acts on Niccolò Malinverno’s behalf, the payment provider) by emailing niccomali97@gmail.com. The text of the standard contractual clauses is published on EUR-Lex.

13Your rights

Where the GDPR allows, you can ask each controller, for its own processing:

• to tell you whether it holds data about you and to give you a copy (Article 15);
• to correct or complete it (Article 16);
• to delete it (Article 17);
• to restrict how it’s used (Article 18);
• to give it to you in a commonly used, machine-readable format, or send it to another controller, for data you gave us that we process by automated means on the basis of a contract or your consent (Article 20);
• to stop using it where we rely on our legitimate interest, if you object (Article 21, see the box below).

You can withdraw at any time the consents you give us: the one you give by opening the map (section 5), the one for health information in your requests (section 6) and the one for health information on the tourist tax exemption form (section 9.6). Withdrawing doesn’t affect anything that happened before. Without the health information we can’t apply an exemption that depends on it, and we still keep a form you’ve already handed in as evidence for the council’s checks (section 9.10).

Some data we can’t delete before the periods set out in section 9: tourist tax records, including exemption forms, because the Comune di Follonica needs them for its checks and requires us to keep them, and payment records for the rooms, because we need them to show the tax return is correct if it’s audited (Article 17(3)(b) and (e) GDPR).

To exercise your rights, email niccomali97@gmail.com or call +39 344 747 6221; you can also write to Janik S.n.c. by post at Viale Italia 200, 58022 Follonica (GR), Italy. It’s free. We’ll reply without undue delay and within one month at the latest. If your request is complex or we receive a lot of them, we may take two more months: if so, we’ll tell you within the first month and explain why. If you email us, we’ll reply by email unless you ask otherwise. If we have reasonable doubts about who you are, we may ask for the information we need to confirm it. If we can’t act on your request, we’ll tell you why within one month and remind you that you can complain to a supervisory authority or go to court (Article 12 GDPR).

If you’d like to know how we weighed our legitimate interest against your rights and freedoms, just ask and we’ll explain.

Complaints

If you think the way your data is handled breaks the law, you can complain to the Italian Data Protection Authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy, certified email (PEC) protocollo@pec.gpdp.it (it only accepts messages sent from another PEC address). Instructions and the complaint form are on the Garante’s website (in Italian). You can also go to the supervisory authority in the EU country where you normally live or work or where the alleged breach took place (Article 77 GDPR), or to court (Article 79 GDPR).

14Other information

Required and optional data

You don’t have to give us any data to browse the site, beyond the technical data your browser sends automatically (section 3). Emailing or calling us is up to you. To book and stay in the rooms, we need the details required by the contract and by law (section 9).

Automated decisions

We don’t make decisions based solely on automated processing, and we don’t profile you (Article 22 GDPR). The payment provider may run automated fraud checks on online payments, as described in its own privacy policy.

Updates

We update this notice when the services we use, the way we handle data or the law change. The date at the top shows the latest version. If something important changes, such as a new provider, a new use of your data or a new controller, we’ll flag it clearly at the top of this page before the change takes effect.

This notice is also available in Italian at /privacy: both versions say the same thing.