Privacy policy

Privacy Policy pursuant to Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018

Last updated: January 2026

1. Data Controller

The Data Controller of the personal data collected through the Site is: Mauro Moisè Registered office: Via Mosse 376a, Montefiascone (VT) 01027 VAT number: IT02278350562 Email: info@madamemoise.com Phone: +393284168149

2. Location of data processing

The processing related to the Site’s services takes place at the Data Controller’s headquarters and/or at the premises of appointed data processors and is handled only by personnel authorized to process data. The data will not be communicated or disseminated except as indicated in this policy. The Site is intended for users located worldwide; the data will be processed in Italy.

3. Types of data processed

In the context of the Site’s activity, the following categories of personal data may be processed:

• Data provided voluntarily by the user: for example, name, surname, email address, telephone number, address (if provided during booking or contact) relating to requests for information, reservations, events, newsletters, and contact via phone/WhatsApp/email.
• Browsing data: such as IP address, Internet Protocol address, data relating to the device used, access time, pages visited, time spent, any clicks, referrer (site of origin), technical and/or profiling cookies (if active).
• Data consistent with the purpose of the processing: for example, preferences, any data relating to stays (number of guests, room type, arrival/departure date) if provided by the user.

4. Purpose and legal basis of the processing

The personal data indicated are processed for the following purposes and on the following legal bases: 4.1 Contractual/pre-contractual purposes

• Management of requests for information or product orders.
• Legal basis: performance of the contract or pre-contractual measures requested by the data subject (Article 6, paragraph 1, letter b) of the GDPR).

4.2 Purpose of fulfilling legal obligations

• Fulfillment of accounting, tax, civil, or regulatory obligations (e.g., communications to legally required bodies, document retention for the statutory period).
• Legal basis: legal obligation to which the Data Controller is subject (Article 6, paragraph 1, letter c) of the GDPR).

4.3 Direct marketing purposes (with consent)

• Sending newsletters, promotions, special offers related to the farm, events, and related services.
• Legal basis: express consent of the interested party (Article 6, paragraph 1, letter a) of the GDPR).
• Providing data for these purposes is optional; without consent, promotional material will not be sent.

4.4 Profiling purposes and/or cookies and similar technologies

• Analysis of user behavior on the Site to improve services and the browsing experience (e.g., analytics, technical and profiling cookies).
• Legal basis: depending on the type of cookie, this may be the legitimate interest of the Data Controller (Article 6, paragraph 1, letter f) of the GDPR) or the data subject’s consent (Article 6, paragraph 1, letter a) of the GDPR).
• In the case of non-essential cookies, the user’s explicit consent is required.

5. Processing Methods and Security

Personal data is processed using paper, computer, and electronic means. The Data Controller adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Articles 32-34 of the GDPR. Access to data is limited to designated personnel or any appointed external processors (e.g., IT, hosting, and marketing service providers). Personal data is not transferred to third countries outside the European Union without adequate safeguards.

6. Data retention period

Personal data will be retained for a period no longer than necessary for the purposes for which they are processed. In particular:

• Order management data: for the entire duration of the contractual relationship and for the period required by law (e.g., tax and archival regulations) following the completion of the order.
• Data for marketing/promotion purposes (if consent has been given): until consent is revoked or for a period of 3 years from the last interaction, unless otherwise provided by law or legitimate interest.
• Browsing data and cookies: variable periods based on the type (see the specific cookie policy).

7. Rights of the data subject

As a Data Subject, you have the right to request from the Data Controller access to your personal data, rectification, erasure (the “right to be forgotten”), restriction of processing, data portability (where applicable), and to object to processing. You may also withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Articles 15-22 of the GDPR). You can exercise these rights by sending a request to info@madamemoise.com or by registered letter to the Data Controller’s registered office. You also have the right to lodge a complaint with the Italian Data Protection Authority if you believe that the processing is not in compliance with the law.

8. Communication and dissemination of data

Personal data may be disclosed to:

• parties that provide outsourced services on behalf of the Data Controller, such as IT tools, hosting, maintenance, marketing, payment services;
• parties that provide data controllers or processors to whom it is necessary to disclose the data for contractual/legal purposes (e.g., tax authorities, competent authorities). The data will not be disclosed.

9. Transfer of data to third countries / international organizations

The transfer of personal data to third countries outside the European Union is not foreseen. If this is necessary, the Data Controller will ensure adequate guarantees compliant with Article 46 of the GDPR (e.g., European Commission standard clauses).

10. Cookies and similar technologies

The Site may use technical cookies and, with your consent, profiling cookies. For details, please refer to the specific “Cookie Policy” available on the Site. Users can manage their cookie preferences through their browser settings or via the cookie banner displayed when they first access the Site.

11. Profiling and Automated Decisions

No exclusively automated decisions are made that affect users (Article 22 GDPR). If automated profiling services are activated in the future, this Policy will be updated.

12. Updating the Policy

The Data Controller reserves the right to update this policy to reflect new regulations or developments in the services offered. Users are therefore encouraged to check this page periodically. In the event of substantial changes, the “last updated” date will be indicated.

Consent to Processing

By continuing to use the Site (e.g., browsing, completing contact/booking forms), users consent to the processing of their personal data as indicated in this Policy and the related Cookie Policy.