This is a translation: in case of differences, the Italian text prevails. Italian version

Privacy policy

Last updated: 1 November 2026

This notice explains how Domizia Ferraro (“we”) processes the personal data of those who visit villadomiziasicily.com, book or contact us, as required by Article 13 of Regulation (EU) 2016/679 (GDPR).

Data controller

Domizia Ferraro
Email: [email protected]
Phone: +39 339 471 3600

What data we process

Browsing data: IP address, browser and device type, pages visited, date and time. They are collected automatically by the systems that run and protect the site.
Form data: name, country, month of stay and review.
WhatsApp messages: your number, your profile name and what you write to us, including attachments.
Emails and phone calls: your email address or number, and what you write or tell us.
Booking data: name and contact details of the person booking, dates of stay and number of guests; on arrival, the details of the guests’ identity documents, as required by law.

In your messages, write only what your request needs: no health data or other special categories of data, such as religious beliefs or political opinions.

Why we use the data and on what legal basis

For each use we state the legal basis, i.e. the point of Art. 6(1) GDPR that allows it.

Replying to your requests and, if you ask, preparing a quote or an offer: pre-contractual measures taken at your request (point b).
Managing the contract arising from the request: performance of a contract (point b).
Managing the booking and the stay: performance of a contract (point b). Reporting guests’ details to the Questura (police) (Art. 109 of the Consolidated Law on Public Security) and, where required, to the Region and Municipality for statistics and the tourist tax: legal obligation (point c).
Replying to other messages, such as a report or a job application: legitimate interest in replying to those who write to us (point f).
Complying with legal obligations, such as tax and accounting obligations: legal obligation (point c).
Protecting the site from abuse and automated programs: legitimate interest in security (point f).
Establishing or defending a legal claim: legitimate interest (point f).

Mandatory and optional data

Giving us your data is your choice: without the data we need, however, we cannot reply to you.

All fields in the form are required for us to reply.

Booking data and the guests’ documents are required: without them, we cannot confirm the booking or welcome the guests.

When we ask for your consent, giving it is optional: if you say no, the site and the service still work.

How and for how long we keep the data

We process data electronically and, when necessary, on paper. Only authorised persons can see them, and we protect them with appropriate security measures.

The site has a password-protected private area from which Domizia Ferraro updates the content. Visitors do not access it and do not receive its cookies.

Browsing data are kept by the provider that hosts the site for as long as needed for security, according to its own rules.
Requests and messages that do not lead to a contract are kept for as long as needed to reply and follow up the negotiation, and in any case no longer than 6 months after the last contact.
To protect the form and the private area from abuse, the site briefly keeps, for 48 hours at most, a fingerprint of the IP address calculated with a secret key, which does not contain the address in plain text.
If a contract results from the request, we keep the data for its entire duration and then for 10 years, as the law requires for accounting and tax records (Art. 2220 of the Italian Civil Code).
Identity document data are needed for the mandatory report to the Questura: we keep them only for as long as the law requires.

Who receives the data

The data are neither sold nor disclosed to the public. Only the following parties may receive them, each for its own part:

persons authorised by Domizia Ferraro, bound by confidentiality;
OnlinePerTutti.com (T.H.K. Consulting Limited, Hong Kong), which built and manages the site: it processes data on our behalf, solely for the technical management of the site;
Cloudflare, Inc. (United States), which hosts and protects the site and provides the technical tools described on this page: it processes data on behalf of OnlinePerTutti.com, as its supplier;
WhatsApp Ireland Limited, if you write to us on WhatsApp: it processes messages as an independent controller (WhatsApp privacy policy);
the accountant and other advisers, banks and public authorities, when required by law or by the contract.

Data outside the European Union

Some of the providers listed are based outside the European Union, for example in the United States, and may process part of the data there. They do so with the safeguards provided for by the GDPR (Arts. 44-46):

for US companies that adhere to the EU-U.S. Data Privacy Framework, the European Commission’s adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795);
in other cases, the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914).

OnlinePerTutti.com (T.H.K. Consulting Limited) is based in Hong Kong, which is not covered by an adequacy decision of the European Commission. The data are stored on the systems of the providers listed above: T.H.K. Consulting Limited accesses them only for the technical management of the site, on our behalf.

For information on these safeguards, or a copy of them, write to [email protected].

Your rights

You can ask us at any time:

to see your data and receive a copy (access, Art. 15 GDPR);
to correct or complete them (rectification, Art. 16);
to delete them, when they are no longer needed or the law does not require us to keep them (erasure, Art. 17);
to restrict their use (restriction, Art. 18);
to receive them in a machine-readable format, to take them elsewhere (portability, Art. 20);
to object to their use based on our legitimate interest and, in all cases, to their use for marketing (objection, Art. 21).

If you have given your consent, you can withdraw it at any time: withdrawal does not affect what we did before (Art. 7(3)).

To exercise your rights, write to [email protected]. We will reply within one month. In more complex cases this period may be extended by a further two months: if so, we will tell you within the first month (Art. 12(3)).

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22).

Complaint to the Garante

If you believe that your data are being processed in breach of the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it (Art. 77 GDPR).

Which cookies and similar tools the site uses, and how you can manage them, is explained in the cookie policy.

Changes to this notice

This notice may change, for example if the site adds a feature or a regulation changes. The version in force is always this page, with the date at the top.