Privacy
and Cookie Policy

01Data controller

The data controller is:

02Data processed, purposes and legal bases

2.1 Browsing and security data

The systems that operate the website may collect IP addresses, request dates and times, pages visited, referring addresses, browser and device types, operating systems, technical identifiers and information about errors or access attempts.

These data are processed to provide the website, ensure its security, prevent abuse and fraud, diagnose faults and protect the controller’s rights. The legal basis is the controller’s legitimate interest in the security and proper operation of the systems (Article 6(1)(f) GDPR) and, where applicable, compliance with legal obligations (Article 6(1)(c) GDPR).

2.2 Contact enquiries

The Contact form collects your name, contact details and message so we can respond to your enquiry. Information about allergies, intolerances or dietary requirements is optional and is processed only with your separate explicit consent. You can also contact us directly by email or phone.

To protect the form from spam and abuse, technical data relating to the submission may be processed temporarily. The legal basis is the Controller’s legitimate interest in the security of the service (Article 6(1)(f) GDPR).

The data are used exclusively to respond to the enquiry and carry out the pre-contractual activities requested by the user. The legal basis is taking steps at the data subject’s request before entering into a contract (Article 6(1)(b) GDPR). Fields marked as mandatory are necessary to handle the enquiry.

2.3 Job applications and CVs

The “Work with us” page may collect identification and contact details, professional information, position preferences and CVs or other attachments.

Processing is aimed at assessing the application and potentially establishing an employment relationship, based on pre-contractual steps requested by the applicant (Article 6(1)(b) GDPR) and applicable employment obligations. Please do not include special-category data in your CV that are irrelevant to the application.

2.4 Bookings and services

Booking links lead to external platforms specialising in hotel and spa service reservations. Data entered on these platforms may include personal and contact details, information about the stay or requested services, special requests, billing details and information needed for payment.

Processing is necessary to handle availability enquiries, conclude and fulfil bookings, provide requested services and meet administrative, accounting, tax and public-security obligations (Article 6(1)(b) and (c) GDPR). Technical providers process data according to the roles and conditions established in their contracts and respective privacy notices.

2.5 Statistics and measurement

With consent to the Statistics category, Google Analytics 4 processes technical and browsing data to produce statistics on the use of the website.

The legal basis is the user’s consent (Article 6(1)(a) GDPR), which may be withdrawn at any time through the cookie preferences panel.

2.6 Advertising and campaign measurement

With consent to the relevant categories, Google Ads and Meta Pixel process identifiers and browsing data to measure campaign effectiveness and personalise advertising.

The legal basis is consent (Article 6(1)(a) GDPR). Refusing or withdrawing consent does not prevent use of the website’s essential functions.

2.7 External links

Maps, reviews, social networks and reservations are accessible through links to external websites, which apply their own privacy notices.

03Cookies and tracking tools

A technical cookie stores the preferences selected in the panel for 185 days. Optional categories — Google statistics, Google advertising and Meta — are initially disabled.

The Manage privacy button at the bottom of every page lets you accept, refuse or change optional categories at any time. Preferences expressed on this website do not extend to the booking platform, which has its own privacy policy.

Refusing or withdrawing consent does not restrict browsing or access to reservations.

Preferences and the information needed to document consent are retained for 365 days.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

04Data recipients

Data may be processed, to the extent necessary, by authorised staff and providers of technical, hosting, email, security, analytics, advertising and booking services. Google Analytics, Google Ads and Meta Pixel receive data only after consent to the relevant category.

Depending on the service, providers act as processors, independent controllers or joint controllers. Data may also be communicated to public authorities or other parties when required by law or necessary to protect a right.

05Transfers outside the EEA

Some providers may process data outside the European Economic Area. In such cases, transfers comply with Articles 44 et seq. GDPR, based on adequacy decisions, the Data Privacy Framework where applicable, Standard Contractual Clauses or other safeguards provided by law.

Providers’ privacy notices are available on their websites. For clarification about recipients and the safeguards applied, you can contact the Controller using the details on this page.

06Retention periods

• Contact data and related attachments: for as long as necessary to handle the enquiry and no longer than 12 months after the contact ends, unless legal obligations or the protection of a right require otherwise.
• Job applications and CVs: up to 12 months after receipt, unless an employment relationship is established or further retention is requested with justification.
• Booking and stay data: for the time needed to fulfil the relationship and subsequently for the periods required by civil, tax and accounting law, generally up to 10 years for documents subject to that obligation.
• Technical and security logs: for the time strictly necessary for operation, security and incident management, subject to requests from authorities or legal obligations.
• Data collected through cookies: for the periods indicated in the preferences panel and, where processing is based on consent, until consent is withdrawn.

After these periods, data are deleted or anonymised unless further retention is necessary to meet legal obligations or establish, exercise or defend a legal claim.

07Data subjects’ rights

In the cases provided for by the GDPR, data subjects may ask the controller for:

• access to their personal data;
• rectification or completion of inaccurate data;
• erasure of their data;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interests;
• withdrawal of consent at any time, without affecting processing already carried out.

Requests may be sent to info@lablancaresort.com. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority.

08Security

The Controller adopts technical and organisational measures appropriate to the risk to protect data from loss, unauthorised access, alteration or disclosure.

09Minors

Booking services are not intended for minors to enter into contracts independently. The controller does not knowingly seek to collect minors’ data through the website beyond information needed to manage a stay, provided by a person with parental responsibility or another authorised party.

10Updates to this notice

This notice may be updated following changes in law, technology or the services used. The current version is the one published on this page with its update date.

11Media credits

Opening video music: “In The Desert” by Savfk, used and adapted. The original work is distributed under the Creative Commons Attribution 4.0 International (CC BY 4.0).