Privacy Notice pursuant to Articles 13 and 14 of Regulation
(EU) 2016/679 (“GDPR”).
Last updated: 11 September 2026
The Data Controller is:
B&B Magna Grecia
Contrada Maruca, 16
88046 Lamezia Terme (CZ) – Italy
Email:
info@bbmagnagrecia.it
Website:
https://bbmagnagrecia.it/
For information about the processing of your Personal Data or to exercise
your rights under the GDPR, you may contact the Controller using the email
address above.
This Privacy Notice describes the processing of Personal Data carried out
through bbmagnagrecia.it and its related services, including website
browsing, enquiries, user registration, bookings, stay management,
payments, reviews and communications with guests.
Certain specific services, including any online/self check-in or guest
identity verification services, may also be subject to a specific
supplementary privacy notice presented to the User before using the service.
Depending on the services used, we may process:
Personal Data may be provided directly by the User or, in the case of
technical and usage information, collected automatically when the website
is used.
Where certain information is identified as mandatory, failure to provide
it may make it impossible to provide the requested service, create an
account or complete a booking.
Users may also provide Personal Data concerning other people, such as
family members or other guests included in the same booking.
In such cases, the User confirms that they are authorised to provide that
information and, where necessary, have informed the relevant individuals
about the processing.
Where Personal Data are not obtained directly from the Data Subject, they
may originate from the person making the booking, an intermediary, a
booking platform or another person authorised to provide them.
The website does not normally request special categories of Personal Data.
Where a User voluntarily provides information concerning allergies,
dietary requirements, disabilities, personal conditions or special
requirements relating to the stay, such information will only be processed
insofar as necessary to manage the request and on the appropriate legal
basis provided by the GDPR.
Personal Data may be processed in order to:
Personal Data are processed where at least one of the following applies:
Where special categories of Personal Data are processed, such processing
will only take place where one of the conditions provided for by Article 9
GDPR applies.
During normal website use, the IT systems required to operate the website
may automatically collect information including IP address, date and time
of the request, requested page, browser, device, operating system and other
technical connection information.
This information may be used to operate the website, diagnose technical
problems, ensure system security, prevent unauthorised access and protect
the website against fraudulent or harmful activity.
The legal basis is the Controller’s legitimate interest under
Article 6(1)(f) GDPR.
Users may voluntarily provide Personal Data through contact forms, email,
telephone or other communication channels made available by the Controller.
Personal Data are used to respond to the enquiry, provide information,
prepare quotations or take pre-contractual steps requested by the User.
The legal basis is Article 6(1)(b) GDPR.
Where registration is available, Users may create an account by providing
the information requested by the relevant form.
Personal Data are processed to create and administer the account,
authenticate the User and provide access to restricted functions.
The legal basis is Article 6(1)(b) GDPR.
Users may request deletion of their account by contacting
info@bbmagnagrecia.it,
subject to information that must be retained for legal purposes or for the
establishment, exercise or defence of legal claims.
Where sign-in or registration through services such as Google or Facebook
is available, Users may voluntarily choose to use those services.
The relevant provider may provide the website with information authorised
by the User, such as account identifier, name, email address and profile image.
Third-party providers may also independently process information in
accordance with their own privacy notices.
Bookings and stays may be managed through services provided by
WuBook, including its booking engine and the
Zak property-management system used by the accommodation provider.
Information processed for this purpose may include name, surname, email
address, telephone number, stay dates, number and category of guests,
selected accommodation, additional services, guest requests and other
information required to manage the booking and stay.
Processing is necessary for pre-contractual measures and performance of the
accommodation contract under Article 6(1)(b) GDPR and for compliance with
applicable legal obligations under Article 6(1)(c) GDPR.
WuBook S.r.l. processes Personal Data required to provide its services in
accordance with the roles and responsibilities established by applicable
data-protection law and the relevant agreements with the Controller.
Personal Data may be processed in order to manage bookings, purchased
services and related payments.
Where a payment is handled by an external payment service provider,
information necessary to complete the transaction is processed by that
provider in accordance with its own privacy notice.
B&B Magna Grecia may receive information concerning the payment amount,
payment status, transaction identifier and payment method without
necessarily receiving the complete details of the payment instrument.
Processing is based on Article 6(1)(b) GDPR and, for administrative,
accounting and tax obligations, Article 6(1)(c) GDPR.
Where the website allows Users to submit reviews or comments, information
entered by the User, the User’s IP address and technical information may
be processed for publication, moderation, security and spam prevention.
Where Gravatar is used, an anonymised value derived from the User’s email
address may be sent to the service to determine whether an associated
profile image exists.
Following approval of a comment, any public profile image may be displayed
alongside the content submitted by the User.
The website may use Tawk.to to provide online chat assistance.
Information voluntarily entered in a conversation and related technical
information may be processed in order to provide assistance and respond
to enquiries.
Where the conversation relates to a booking or another service requested
by the User, processing is based on Article 6(1)(b) GDPR.
Non-essential cookies or tracking technologies associated with the service
are used on the basis of consent where required by applicable law.
The website may use Google Analytics, a service provided by Google Ireland
Limited, to obtain statistical information concerning website use.
Where the service involves the use of non-essential cookies or identifiers,
processing is based on the User’s consent pursuant to Article 6(1)(a) GDPR
where required by applicable law.
Users may refuse or withdraw consent through the website’s cookie-preference
management system.
Information processed may include Usage Data, browser and device information,
IP address and technical identifiers according to the configuration of the service.
The website may contain links to or content provided by external services,
including social networks, video services, maps, weather services or other websites.
In the case of ordinary external links, the external service is accessed
only when the User decides to follow the link.
Where embedded third-party content uses non-essential tracking technologies,
the relevant processing is based on consent where required by applicable law.
The website uses cookies and similar technologies.
Strictly necessary cookies may be used without consent where they are
required to operate the website or provide a service expressly requested
by the User.
Analytics, third-party functional, advertising, profiling or other tracking
technologies requiring consent are used according to the preferences
expressed by the User.
Users may change or withdraw their cookie preferences through the website’s
cookie-preference management system.
For further information about the categories of cookies used, providers,
purposes and retention periods, please see our
Cookie Policy
.
Personal Data may be processed by the Controller, authorised personnel
and collaborators and, where necessary, external service providers.
Recipients may include:
Where required, providers processing Personal Data on behalf of the
Controller are appointed as processors pursuant to Article 28 GDPR.
Certain providers may instead act as independent controllers for processing
carried out under their own purposes or legal obligations.
Personal Data are not sold or publicly disclosed, except where publication
is expressly requested by the User, such as when publishing a review or comment.
Where required by legislation applicable to accommodation providers,
certain guest information may be disclosed to competent authorities in
order to comply with public-security, administrative, tax or other legal obligations.
The legal basis is compliance with a legal obligation under
Article 6(1)(c) GDPR.
Some technology providers used by the Controller may involve processing of
Personal Data outside the European Economic Area.
Where this occurs, transfers are carried out in accordance with Articles
44 et seq. GDPR, on the basis of a European Commission adequacy decision
or other safeguards provided by the GDPR, including Standard Contractual
Clauses where applicable.
Data Subjects may request further information from the Controller using
the contact details provided in this Privacy Notice.
Personal Data are retained only for as long as necessary for the purposes
for which they were collected and thereafter for any period required by
applicable law.
Information relating to enquiries and communications is retained for the
time necessary to handle the request and for a reasonable subsequent period
where necessary to document the communications.
Account information is retained until the account is deleted or the service
is discontinued, subject to applicable legal obligations.
Booking, payment, invoice, administrative and accounting information is
retained for the periods required by applicable civil, tax and accounting
legislation, including up to 10 years where applicable.
Information processed to comply with legal obligations applicable to
accommodation providers is retained for the periods required by law.
Technical and security logs are retained for the period necessary to
ensure the security, integrity and proper functioning of the systems.
Information processed on the basis of consent is retained until consent
is withdrawn or the purpose has been achieved, unless another legal basis
permits or requires further retention.
At the end of the applicable retention periods, information is deleted,
anonymised or otherwise made no longer attributable to the Data Subject,
unless further retention is required by law.
Information required to respond to a request, create an account, complete
a booking, comply with legal obligations or provide a requested service
must be provided in order for the relevant service to be delivered.
Failure to provide mandatory information may make it impossible to provide
the requested service or complete a booking.
Information and consent relating to optional services, analytics, marketing
or other non-essential functionality remain optional, and refusal does not
prevent ordinary website browsing or the ability to make a booking.
The accommodation provider may process Personal Data concerning children
where necessary to manage a booking, a stay or comply with applicable legal obligations.
Such information is normally provided by a parent, guardian or responsible
adult and is used only for purposes connected with the stay and applicable
legal obligations.
Unless otherwise stated in a specific privacy notice relating to a particular
service, Personal Data processed through this website are not used to make
decisions based solely on automated processing which produce legal effects
concerning the Data Subject or similarly significantly affect them.
Personal Data are processed using electronic, telematic and, where
necessary, paper-based tools according to organisational methods and logic
strictly related to the purposes described in this Privacy Notice.
The Controller adopts appropriate technical and organisational measures
according to the level of risk in order to protect Personal Data against
loss, destruction, alteration, disclosure, unauthorised access or unlawful processing.
Access to Personal Data is limited to authorised persons and providers
requiring the information for the performance of their respective duties.
Where applicable, Data Subjects may exercise the rights provided by
Articles 15-22 GDPR, including the right to:
Withdrawal of consent does not affect the lawfulness of processing carried
out before consent was withdrawn.
Requests to exercise GDPR rights may be submitted free of charge to:
info@bbmagnagrecia.it.
The Controller will respond within the time limits established by applicable law.
Data Subjects also have the right to lodge a complaint with the
Italian Data Protection Authority (Garante per la protezione dei dati personali)
if they believe that their Personal Data are being processed in breach of
applicable data-protection legislation.
Website:
https://www.garanteprivacy.it/
Users may request deletion of their account and associated information by
contacting
info@bbmagnagrecia.it.
Account deletion does not require deletion of information that the
Controller must retain under applicable law or for administrative,
accounting or tax purposes or for the establishment, exercise or defence
of legal claims.
Certain services provided by the Controller may involve additional
processing of Personal Data beyond that described in this Privacy Notice.
In such cases, Users will receive a specific or supplementary privacy
notice containing the information required by applicable law before the
relevant Personal Data are collected or processed.
The Controller may amend or update this Privacy Notice as a result of
changes in legislation, technology, organisation or the services provided.
The most recent version will be published on this page together with the
date of the latest update.
Last updated: 11 September 2026
