Privacy Policy

This Privacy Policy applies exclusively to navigation on the site (from now on Site) accessible at the internet address and regularly registered by Fabrizio Mozzoni, Via S. Filippo 41, 53023 Siena - Italy, CF MZZFRZ62D23H321X

Data Controller, Data Processor and Data Processor

The owner, manager and person in charge of processing the data collected is Fabrizio Mozzoni, whose details have been previously reported.

Sources of personal data

The applications dedicated to the operation of this Site may detect, during their normal operation, some of your data (whose transmission is implicit in the use of Internet communication protocols), however not directly associated with you. The data collected may also include, by way of example but not limited to, the IP address, the domain names and the type of browser of the computers used to connect to the Site, the URI (Uniform Resource Identifier) addresses of the resources requests, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numeric code indicating the status of the response given by the server (success, error, etc.) and other parameters concerning the operating system and the IT environment you use. These data do not allow, in any case, to reach your identity and are therefore to be considered anonymous. Particular sources of personal data are indicated in the specific Privacy policy prepared for particular services offered by the Site or software used by it for its proper functioning and reported below.

Purpose of the processing

Your data will be transformed into anonymous data and processed in aggregate form for statistical purposes and to ensure continuity of service and to improve the site itself. If you do not agree with this practice, please do not browse the Website or use the services offered by it. The IP could, in some cases, be used for the exclusive purpose of blocking attempts to damage the Site itself, as well as activities constituting a crime under the laws in force. Particular purposes of the processing are set out in the specific Privacy Policy prepared for particular services offered by the Site or software used by it for its proper functioning and listed below.

Period of storage and methods of data processing

The data you provide and the Site collected are processed only for the time strictly necessary. They are processed electronically and aggregated for the purposes set out above. Specific methods of treatment are set out in the specific privacy policies set up for particular services offered by the Site or software used by it for its proper functioning and shown below.


For the purposes of browsing the site, the disclosure of personal data is not required except for anonymous and strictly necessary for the purposes indicated above. However there are sections of the site that require the creation of an authorization profile and the prior IT authentication to be browsed. The creation of the profile involves the communication to the Site of personal data further than the anonymous ones required for simple browsing. These data are used only to provide the services requested and processed according to the specific Privacy Policy prepared for this purpose and reported below.

Subjects or categories of subjects that can access or learn about the data

Direct access to your data is only permitted to the data controller indicated above. The hosting service provider is:

HOST S.p.A. - Corso Svizzera 185 - 10149 Turin - Welcome Italia Group

and can potentially have access to the data exclusively for technical reasons of necessity and urgency that require an intervention in order not to jeopardize the functionality and security of the Site.
Other services are or may be offered by other companies.
Information in this regard can be found in the Privacy policies prepared for each individual service and set out below.

Rights of the interested party (Chapter III of the Regulation)

Finally, it is important for you to know that the Code recognizes those concerned with the possibility of exercising specific rights, based on what is indicated in Articles 15 to 22 of Chapter III of the EU European Regulation 2016/679 and of which the main data are summarized below. site purposes:

Article 15: Access rights of the interested party

1. The interested party has the right to obtain from the controller the confirmation that the processing of personal data concerning him is being carried out and in this case, to obtain access to personal data and to the following information:
the purposes of the processing;
the categories of personal data in question;
the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if they are recipients of third countries or international organizations;
when possible, the period of storage of personal data provided or, if this is not possible, the criteria used to determine this period;
the existence of the right of the data subject to request the data controller to rectify or delete personal data or limit the processing of personal data concerning him or to oppose their processing;
the right to lodge a complaint with a supervisory authority; if the data is not collected from the interested party, all information available on their origin;
the existence of an automated decision-making process, including the profiling referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such treatment for the 'interested party'

2. If personal data is transferred to a third country or an international organization, the data subject has the right to be informed of the existence of adequate guarantees pursuant to Article 46 relating to the transfer.

3. The data controller provides a copy of the personal data being processed.

4. In case of further copies requested by the interested party, the data controller may charge a reasonable fee based on administrative costs. If the interested party submits the request by electronic means, and unless otherwise indicated by the interested party, the information is provided in an electronic format in common use.

Article 16: Right of rectification

The interested party has the right to obtain from the data controller the rectification of inaccurate personal data concerning him without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, also by providing a supplementary declaration.

Article 17: Right to cancellation ("right to oblivion")

1. The interested party has the right to obtain from the data controller the deletion of personal data concerning him without undue delay and the data controller has the obligation to delete personal data without unjustified delay, if one of the following reasons exists:

personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed;
the data subject withdraws the consent on which the processing is based in accordance with Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), and if there is no other legal basis for processing;
the data subject objects to the processing pursuant to Article 21, paragraph 1, and there is no legitimate prevailing reason to proceed with the processing, or he opposes the processing pursuant to Article 21, paragraph 2;
personal data have been processed illegally;
personal data must be deleted in order to fulfill a legal obligation under the law of the Union or of the Member State to which the data controller is subject;
personal data has been collected in relation to the offer of information society services referred to in Article 8, paragraph 1.

2. If the data controller has disclosed personal data and is obliged, pursuant to paragraph 1, to delete them, taking into account the available technology and implementation costs, he shall take reasonable, technical measures to inform the data controllers who are processing personal data of the data subject's request to cancel any link, copy or reproduction of his personal data.

3. Paragraphs 1 and 2 do not apply to the extent that processing is necessary:
for the exercise of the right to freedom of expression and information;
for the fulfillment of a legal obligation that requires the treatment foreseen by the law of the Union or of the Member State to which the holder of the treatment is subject or for the execution of a task carried out in the public interest or in the exercise of public powers of which the data controller is invested;
for reasons of public interest in the field of public health pursuant to Article 9 (2) (h) and (i) and Article 9 (3);
for archiving purposes in the public interest, scientific or historical research or for statistical purposes in accordance with Article 89, paragraph 1, to the extent that the right referred to in paragraph 1 is likely to render impossible or seriously prejudice the achievement of its objectives. treatment;
or to ascertain, exercise or defend a right in court.

Article 18: Right to limitation of processing

1. The interested party has the right to obtain the treatment limitation from the data controller when one of the following hypotheses occurs:
the data subject disputes the accuracy of personal data, for the period necessary for the data controller to verify the accuracy of such personal data; the processing is unlawful and the data subject opposes the deletion of personal data and requests instead that its use be limited;
although the data controller no longer needs it for the purposes of processing, personal data is necessary for the data subject to ascertain, exercise or defend a right in court;
the data subject has opposed the processing pursuant to Article 21, paragraph 1, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.

2. If processing is limited pursuant to paragraph 1, such personal data shall be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defense of a right in court or to protect the rights of another natural or legal person or for reasons of significant public interest of the Union or a Member State.

3. A data subject who has obtained the processing limitation pursuant to paragraph 1 shall be informed by the data controller before the limitation is withdrawn.

Article 19: Obligation to notify in the event of rectification or cancellation of personal data or limitation of processing

The data controller informs each of the recipients to whom the personal data were sent of any adjustments or deletions or limitations of the processing carried out pursuant to Article 16, Article 17, paragraph 1, and Article 18, except where proves impossible or involves a disproportionate effort. The data controller shall inform the data subject of these recipients if the data subject requests it.

Article 20: Right to data portability

1. The interested party has the right to receive in a structured format, commonly used and readable by automatic device, the personal data concerning him provided to a data controller and has the right to transmit such data to another data controller without impediments on the part of the data controller to whom he supplied them if:
the processing is based on consent pursuant to Article 6 (1) (a) or Article 9 (2) (a) or on a contract pursuant to Article 6 (1) (b) and processing is carried out by automated means.

2. In exercising their rights with respect to data portability pursuant to paragraph 1, the data subject has the right to obtain direct transmission of personal data from one data controller to the other, if technically feasible.

3. The exercise of the right referred to in paragraph 1 of this article is without prejudice to Article 17. This right does not apply to the processing necessary for the performance of a task of public interest or connected with the exercise of public powers referred to in the data controller is invested.

4. The right referred to in paragraph 1 must not affect the rights and freedoms of others.

Article 21: Right of opposition
[Omissis - v. complete pdf on page 101] Article 22: Automated decision-making relating to natural persons, including profiling
[Omissis - v. complete pdf on page 102]


Part of this site uses cookies, which are text files that are stored on your computer by the Site to enable it to analyze how users use it to exchange information between the server and the user.

No important data is exchanged via cookies. They allow the automation of some operations saving you complex procedures and are sometimes essential for the correct functioning of the Site.

Inside the cookies created by and by the services used it does not store your personal data that allow you to trace and / or know your identity directly and do not represent a risk to your privacy or the integrity of the computer systems you use to access the Internet communication network or the Site.

If you disagree with this practice, you can disable the use of cookies on your browser but this may cause difficulties when browsing the Site.

Any data collected or stored by cookies, in the manner specified above, are not transmitted to third parties, except when this is necessary for the correct functioning of the services provided by the Site and supplied to it by the same third parties.

Specific information regarding the use of cookies is present in the Privacy policies prepared for specific services offered by the Site and are set forth below.

Integrations to this Privacy policy

In relation to specific services offered to the Site and / or offered to you, specific Privacy policies have been prepared which are an integral part of this generic Privacy policy. Below are the links to the Privacy policies of the specific services:

Privacy policy on tracking of visits (Google Analytics)

B&B Bagni San Filippo
Via San Filippo 41 - Castiglione d'Orcia
52023 - Siena - Italia
This email address is being protected from spambots. You need JavaScript enabled to view it.