Privacy

1. Data controller

The data controller is Margherita Sileo, who runs B&B Barone as a family business without a VAT number.

• Controller: Margherita Sileo
• Italian tax code: SLIMGH67E63A519Z
• Address: Via Umberto I 2B, 85028 Rionero in Vulture (PZ)
• Email address: info@bnbbarone.it
• Telephone and WhatsApp: +39 371 425 7798
• Italian National Identification Code (CIN): IT076066C102423001

Given the size of the business, no data protection officer has been appointed. For any request concerning your data, you can write to the email address above.

2. Personal data we collect and why

We collect only the data needed to manage the booking and stay and to comply with legal obligations:

• First name, surname, email address, telephone number, stay dates, number and type of guests and any requests — to manage the booking and stay (performance of the contract).
• Identity document for each guest, shown on arrival — for the mandatory notification to the local Police Headquarters (Questura) through the Alloggiati Web portal within 24 hours (legal obligation).
• Aggregated data about the stay — for the statistical reporting on tourist flows required by law (legal obligation).
• Amounts, receipts and correspondence — for retaining documents and, where necessary, asserting or defending a legal claim.

For these purposes, your consent is not required: processing is necessary for the performance of the accommodation contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR). Providing this data is essential: without it, we cannot accept the booking.

3. Payments

The deposit is paid directly on the pages of the payment service provider (SumUp) and not on B&B Barone's systems. B&B Barone does not collect, process or store your card details: it only receives the transaction outcome and an identification code, which are needed to confirm the booking or arrange a possible refund.

SumUp processes payment data as an independent data controller, in accordance with its own privacy notice.

4. Disclosure of data to third parties

To provide the service, we use certain providers that process data on our behalf as data processors, each limited to their own task:

• a provider that hosts and makes the website available;
• a service for sending automatic confirmation emails;
• the payment provider (SumUp), which collects the deposit as an independent data controller.

We also disclose data to the competent authorities when required by law, in particular to the Questura for public security obligations. Your data are not sold or shared with third parties for marketing purposes.

5. Transfers outside the European Union

Some of the technical providers we use are based in the United States. In such cases, data is transferred on the basis of the EU–U.S. Data Privacy Framework — the framework recognised as adequate by the European Commission — supplemented by Standard Contractual Clauses.

The validity of the Data Privacy Framework was confirmed by the General Court of the European Union in its judgment of 3 September 2025 in Case T-553/23.

6. Retention period

We retain data for as long as necessary for the purposes for which it was collected and for the periods required by law:

• Booking and stay data — 10 years, to meet retention obligations and, where necessary, assert or defend a legal claim.
• Notifications to Alloggiati Web — for the periods established by public security legislation.
• Emails and messages — for as long as necessary to manage our relationship, after which they are deleted.

7. Cookies

This website does not use profiling cookies or analytics or tracking tools. Fonts are served from the website's domain, so browsing does not generate requests to third parties. For this reason, there is no cookie consent banner.

8. Your rights

As a data subject, you can exercise at any time the rights provided for by Articles 15 to 22 of the GDPR: the rights of access, rectification, erasure, restriction of processing, data portability and the right to object. To exercise them, write to info@bnbbarone.it: you will receive a response within one month.

Limits on erasure. Some data cannot be erased on request while legal obligations requiring its retention remain in force, in particular notification to the Questura and retention of accounting documents. In these cases, we will explain the reason for refusing the request.

If you believe that the processing of your data breaches the law, you have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority).

9. Changes to this notice

Any changes will be published on this page, together with an update to the date shown below. For each booking, the notice published when it was made applies. The conditions of the stay are set out in the terms and conditions.