Privacy Policy

Who processes your data

The La Rocca company identified below is the controller for the management of this website and enquiries about the accommodation. DELIBARE GROUP SRL is a separate controller for processing relating to its restaurant activities. La Rocca's general contacts are also used for enquiries about Delibare, as stated on the restaurant page: please specify which business your enquiry concerns. Sharing the website does not imply unrestricted use of data for both companies' campaigns.

Browsing and website operation

The website is hosted on Cloudflare Pages. Delivering pages and securing the infrastructure involves processing technical data such as IP address, request date and time, requested resource, and browser and device information. Tophost manages the domain, DNS, email and redirect from the domain without www. Processing necessary to operate and protect the website is based on the legitimate interest in providing an accessible, secure service and preventing abuse (Article 6(1)(f) GDPR). This is not consent to advertising.

• Cloudflare privacy policy — opens in a new window
• Tophost privacy policy — opens in a new window

Enquiries and bookings

When you write or call, your contact details and enquiry are processed to respond. For enquiries about stays or services, the legal basis is taking pre-contractual steps at your request or performing a contract (Article 6(1)(b) GDPR); for general enquiries it is the legitimate interest in handling correspondence. Any legal obligations are based on Article 6(1)(c) GDPR. Providing information is optional, but without necessary details we may be unable to respond. Avoid sending personal information that is not needed for your enquiry.

This website does not directly collect room bookings or payments: the buttons open the external Slope platform. Information requested during booking and the associated processing are described in the notices available on that platform. Clicking the link does not itself constitute a completed booking.

• Slope booking platform — opens in a new window

Providers and external links

Data may be processed by the people responsible for handling enquiries and technical providers needed to deliver the service, notably Cloudflare for the website and Tophost for email and the infrastructure retained with that provider. Providers' responsibilities depend on the service and applicable agreements; you may ask the controller about recipients of your data. GitHub is used for code and deployment, not to track visitors.

Google Maps, Instagram, WhatsApp and review platforms are accessible through links rather than embedded widgets. Opening them takes you to external services with their own privacy notices. Review cards are static and no Tripadvisor widget is embedded. Website fonts and images are served locally, without browser requests to Google Fonts.

Google Analytics 4

Planned service, not active in this version of the website. Google Analytics 4 is planned to analyse visits and interactions with pages and links. It may process online identifiers, page views, events, traffic sources and technical device information. Activation will require consent to Analytics (Article 6(1)(a) GDPR). Before activation, we will update this notice with the account controller, contracting provider, actual events and retention periods. The website currently sends no data to Google Analytics.

• Google privacy policy — opens in a new window

Meta Pixel

Planned service, not active in this version of the website. Meta Pixel is planned to measure the effectiveness of Facebook and Instagram campaigns. It may send browsing events, online identifiers and technical browser and connection data to Meta, which may associate them with other data under its terms. Separate Advertising consent will be required, independently of Analytics. Before activation, we will specify the controller, roles and agreements with Meta, events, any remarketing, recipients and retention. The website currently does not load Meta Pixel or send these events to Meta.

• Meta privacy policy — opens in a new window

Data retention

For correspondence, the retention criterion is the time needed to respond to and handle the enquiry and any follow-up. If a contractual relationship arises, relevant documents are also retained for applicable obligations and the establishment or defence of rights within the relevant time limits. Technical infrastructure data follows providers' retention cycles for service delivery, error diagnosis and security. You may ask the controller about retention of data concerning you. The language preference's lifetime is described in the Cookie Policy; there is currently no website collection through GA4 or Meta Pixel.

Processing outside the European Economic Area

Cloudflare uses international infrastructure, so technical data should not be assumed to remain entirely in Italy or the European Union. Its data processing addendum describes contractual safeguards, including standard contractual clauses where applicable. You may contact the controller for information about transfers affecting your data and to obtain information about or a copy of applicable safeguards. Conditions for future transfers associated with GA4 and Meta Pixel will be specified before the services are activated.

• Cloudflare data processing addendum — opens in a new window

Your rights and requests

Where provided for by the GDPR, you may request access, rectification, erasure, restriction and data portability, and object to processing based on legitimate interests on grounds relating to your particular situation. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority. Write to the relevant controller using the contacts above. The website does not make solely automated decisions producing legal or similarly significant effects on individuals.

• Italian Data Protection Authority — opens in a new window