Privacy Policy

Last updated: 24 September 2026

This Privacy Policy explains how personal data is collected, used and protected in connection with the website Amalfi Coast Resort – Villa Amalia and the services offered through it.

Personal data is processed in accordance with Regulation (EU) 2016/679 (“GDPR”), applicable Italian data protection legislation and the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

1. Data Controller

The Data Controller is:

Amalia Adinolfi
Villa Amalia – Amalfi Coast Resort
Via Massimo Marghieri 6
Cava de’ Tirreni (SA), Italy
Email: info@villamalia.com

Requests concerning privacy or the exercise of data protection rights may be sent to the email address above.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed when users:

visit or interact with this website;
submit an enquiry or contact request;
request information about availability or accommodation;
make or manage a reservation;
communicate with Villa Amalia in relation to a stay or requested service;
interact with third-party content or services integrated into the website.

Third-party websites and platforms accessed through external links are governed by their own privacy policies.

3. Categories of Personal Data

Depending on how the website and its services are used, the following categories of personal data may be processed:

Identification and contact data, such as name, surname, email address, telephone number and other contact information voluntarily provided by the user.

Booking and stay information, such as requested or confirmed dates, number of guests, booking details, special requests and information necessary to organise the stay and related services.

Communications, including messages and information voluntarily submitted through contact forms, email or other communication channels.

Payment and transaction information, where required to complete or manage a reservation. Payment card information processed through an external payment provider or booking platform is handled through the relevant provider’s secure systems.

Technical and browsing information, which may include IP address, browser and device information, technical logs and information generated when accessing or interacting with the website.

Additional personal data may be processed where required by applicable law or where voluntarily supplied by the guest for a specific purpose.

Users are requested not to provide unnecessary special-category personal data through general contact forms.

4. How Personal Data Is Collected

Personal data may be collected:

directly from the user through forms or communications;
during the booking and payment process;
through the booking platform used by Villa Amalia;
automatically when the website is accessed, to the extent permitted by applicable law;
through third-party services integrated into or linked from the website.

5. Purposes and Legal Bases for Processing

Personal data may be processed for the following purposes.

Enquiries and information requests

Data submitted through the website or other contact channels is processed in order to respond to enquiries, availability requests and requests for information.

The legal basis is the performance of pre-contractual measures taken at the request of the data subject and, where applicable, the legitimate interest of the Data Controller in responding to communications relating to its services.

Reservations and accommodation services

Personal data is processed to manage reservations, organise stays, communicate with guests and provide requested accommodation and related services.

The legal basis is the performance of a contract or pre-contractual measures taken at the request of the data subject.

Payments

Where payment is required, the information necessary to process the transaction may be handled through the booking and payment service provider.

The legal basis is the performance of the contract and, where applicable, compliance with legal obligations.

Administrative, accounting and legal obligations

Certain information may be processed and retained to comply with accounting, tax, public-security, regulatory or other obligations imposed by applicable law.

The legal basis is compliance with a legal obligation to which the Data Controller is subject.

Website operation, security and fraud prevention

Technical information may be processed where necessary to operate and secure the website, diagnose technical problems, prevent abuse and protect the website and its users.

The legal basis is the legitimate interest of the Data Controller in maintaining the security, integrity and proper functioning of the website, where applicable.

Consent-based processing

Where applicable law requires consent for a particular technology or processing activity, the processing will be based on the user’s consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Contact Forms

The website may provide forms through which users can request information concerning Villa Amalia, availability or accommodation.

Only information reasonably necessary to respond to the request should be provided. Information submitted through a form may also be transmitted by email to the Data Controller or authorised persons responsible for responding to the request.

Submitting a request does not automatically enrol the user in marketing communications.

7. Booking Service – AvaiBook

The website uses AvaiBook as a booking management service and booking engine.

When a visitor chooses to make a reservation, personal data necessary to manage the booking may be processed through AvaiBook’s systems. This may include identification and contact details, booking information and information necessary for payment or reservation management.

AvaiBook may process personal data in accordance with its own applicable contractual and privacy terms. Users are encouraged to consult the information provided by AvaiBook during the booking process.

8. Payments

Payments associated with reservations may be processed through the payment infrastructure provided by AvaiBook or other payment providers made available during the booking process.

Villa Amalia does not require users to send complete payment-card credentials through ordinary website contact forms or email.

Where payment information is entered directly into a third-party payment environment, the processing and security of that information are also subject to the terms and privacy practices of the relevant payment provider.

9. Recipients and Service Providers

Personal data may be made available, where necessary, to persons authorised by the Data Controller and to external providers used to operate the website and provide the requested services.

These may include, depending on the processing activity:

website hosting and technical infrastructure providers;
website maintenance and IT service providers;
email and communications service providers;
booking and reservation management providers;
payment service providers;
professional advisers, accountants or consultants where necessary;
competent public authorities where disclosure is required by law.

Personal data is not sold to third parties.

Where required by the GDPR, service providers processing personal data on behalf of the Data Controller are subject to appropriate data-processing arrangements.

10. Third-Party Content and Services

The website may contain or embed content supplied by third parties.

YouTube

Certain pages may contain videos provided through YouTube, a service operated by Google. Loading or interacting with embedded YouTube content may result in communications between the user’s browser and Google/YouTube systems and may involve the use of cookies or similar technologies, depending on the configuration of the embedded player and the user’s consent choices.

Where required, non-essential technologies associated with such content should be subject to the user’s consent.

Floorfy

The website may incorporate virtual tours or other interactive content provided through Floorfy. When such content is loaded or used, technical information may be transmitted to the service provider as necessary to deliver the embedded content.

Third-party providers process information according to their respective privacy policies and applicable contractual arrangements.

11. Cookies and Similar Technologies

The website may use cookies and similar technologies necessary for its operation and, where applicable, technologies associated with third-party services or embedded content.

Technologies that require consent under applicable law should not be activated until the user has provided the relevant consent.

Users may accept, reject or manage non-essential technologies through the consent-management mechanism provided on the website, where applicable.

Detailed and updated information about cookies, their purposes, providers and duration is provided in the separate Cookie Policy.

12. International Data Transfers

Some service providers or their infrastructure may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred to a country outside the EEA, the transfer will be carried out in accordance with the requirements of the GDPR and, where applicable, on the basis of an adequacy decision, Standard Contractual Clauses or another legally recognised transfer mechanism.

13. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected and thereafter where required to comply with legal obligations or establish, exercise or defend legal claims.

In particular:

enquiries and correspondence are retained for the period reasonably necessary to respond to and manage the request and any subsequent relationship;
booking and contractual information is retained for the duration of the contractual relationship and subsequently for the period required by applicable legal, accounting and tax obligations;
payment and accounting records are retained for the periods required by applicable law;
technical and security information is retained only for periods proportionate to the relevant technical or security purpose;
information processed on the basis of consent is retained until consent is withdrawn or until the relevant purpose or applicable retention period ends.

Different statutory retention periods may apply where required by law.

14. Security

The Data Controller adopts appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Nevertheless, no internet transmission or information system can be guaranteed to be completely secure.

15. Data Subject Rights

Subject to the conditions and limitations established by the GDPR, data subjects may exercise the rights provided by Articles 15–22 of the GDPR, including the right to:

obtain confirmation as to whether their personal data is being processed and obtain access to that data;
request rectification of inaccurate personal data;
request erasure of personal data where the applicable legal conditions are met;
request restriction of processing;
object to processing based on legitimate interests;
object at any time to processing for direct marketing purposes, where applicable;
receive personal data in a structured, commonly used and machine-readable format and request data portability where applicable;
withdraw consent at any time where processing is based on consent;
exercise rights relating to automated decision-making where applicable.

Requests may be sent to:

info@villaamalia.com

The Data Controller may request information reasonably necessary to verify the identity of the person making the request.

16. Right to Lodge a Complaint

Data subjects have the right to lodge a complaint with the competent supervisory authority if they believe that the processing of their personal data infringes applicable data protection law.

In Italy, the competent supervisory authority is the:

Garante per la protezione dei dati personali

The exercise of this right is without prejudice to any other administrative or judicial remedy available under applicable law.

17. Automated Decision-Making and Profiling

Villa Amalia does not use personal data collected through this website to make decisions based solely on automated processing that produce legal effects or similarly significantly affect users, unless otherwise specifically disclosed.

18. Children’s Data

The website and booking services are intended for adults arranging accommodation and related services.

Information concerning minors may be processed where necessary for a reservation or stay and supplied by a parent, guardian or other authorised adult, subject to applicable law.

19. Links to External Websites and Social Media

The website may contain links to external websites or social-media platforms. Following an external link may result in data processing by the operator of the destination website.

Villa Amalia does not control the independent processing activities of external websites, which are governed by their respective privacy policies.

20. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in the website, services, technologies used, legal requirements or data-processing activities.

The most recent version will be published on this page together with its date of last update.

21. Contact

For questions concerning this Privacy Policy or the processing of personal data, or to exercise rights under applicable data protection law, please contact: