Privacy
Privacy notice
Last updated: 24 October 2026
This notice explains how we process the personal data of people who visit the website, write to us or stay with us, as required by Art. 13 of Regulation (EU) 2016/679 (GDPR).
Data controller: Inspired by Irpinia (rete di imprese con soggettività giuridica), Via Circumvallazione 227, 83100 Avellino (AV), VAT no. 03107370649, REA AV-205333. Privacy contact: info@inspiredbyirpinia.org, PEC inspiredbyirpinia@pec.it.
Privacy officer: Alessandro Graziano
Browsing the website
The website uses no cookies, neither for profiling nor for analytics, and loads no fonts, maps or scripts from other websites: this is why there is no cookie banner. For security purposes, the server logs technical data about requests (IP address, date and time, page requested) and keeps them only for as long as necessary to detect abuse. Legal basis: legitimate interest in the security of the website (Art. 6(1)(f) GDPR).
Availability requests and contacts
Through the form we collect your name, email address, phone number (optional), dates, number of guests, chosen accommodation, message, language and IP address, solely to reply to you and, if you wish, to prepare your booking. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR); for this reason no consent is required. Without your name, email address, dates and number of guests we cannot reply to you; your phone number is needed only if you ask to be contacted on WhatsApp or by phone. Requests that do not lead to a booking are deleted after 12 months.
Bookings and stays
For stays, we process the data of the guest making the booking, the dates, payments and invoices. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and tax and accounting obligations (Art. 6(1)(c) GDPR). Accounting records are kept for 10 years, as required by law (Art. 2220 of the Italian Civil Code).
Guest identification and notification to the police
The law (Art. 109 of the Testo unico delle leggi di pubblica sicurezza, the Italian Consolidated Law on Public Security) requires us to notify the Questura (local police headquarters), through the Alloggiati Web service, of the personal details of all guests within 24 hours of arrival, checking their identity documents in person. Legal basis: legal obligation (Art. 6(1)(c) GDPR). If you use online check-in, your data and the photos of your documents are encrypted and visible only to authorised staff. Immediately after the notification we delete the photos and details of the documents, as indicated by the Garante per la protezione dei dati personali (the Italian Data Protection Authority); we keep only the receipt of the notification, for 5 years.
Tourism statistics
We report arrivals and overnight stays to the Regione Campania and to ISTAT (the Italian National Institute of Statistics) in aggregate form (number of guests and their origin, without names), as required by law. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
WhatsApp and booking platforms
If you message us on WhatsApp or choose to be contacted there, the service is provided by WhatsApp (Meta group), which processes your data as an independent controller, including outside the European Union, in accordance with its own privacy notice; you can always choose email or phone instead. If you book through Booking.com or Airbnb, the platform is an independent controller of the data collected on its own website and passes on to us the data needed for your stay.
Who processes your data
Your data are processed by authorised and trained staff and by the providers who help us, appointed as data processors (Art. 28 GDPR): the server provider (Aruba S.p.A., with data centres in Italy), the email providers (Aruba S.p.A., which hosts the mailbox, and Google, whose Gmail service we use to read and send it) and our tax adviser. We disclose them to public authorities only when required by law (Questura, Regione and ISTAT, tax authorities). We do not publish them, sell them or use them for advertising.
Transfers outside the European Union
Website and management system data remain in Italy. Email also passes through Google’s Gmail service, which may process it in the United States: the transfer is based on the European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, to which Google adheres. For other providers, any transfers outside the EU take place with the safeguards laid down in Arts. 45 and 46 GDPR.
Security
The website uses encrypted connections only (HTTPS); the management system is accessible only to staff, with role-based permissions and an access log; guests’ documents are encrypted.
Your rights
You may at any time request access to your data, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interest (Arts. 15–22 GDPR), by writing to the contact details given above: we will reply within one month. You may also lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it). We do not make automated decisions or carry out profiling.