Last updated: 16 July 2026
This policy explains how the personal data of users who browse this website and use the services of Secret Garden Relais is processed, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 («GDPR») and applicable Italian law.
Data Controller
Secret Garden Relais di Gennaro Staiano
Via Gottola 14 — 80063 Piano di Sorrento (NA), Italy
VAT 07598951213 — Tax code STNGNR86S03L845D
Email: info@secretgardenrelais.com — Certified email (PEC): secretgardenrelais@pec.it
Data processed, purposes and legal bases
- Booking data (first and last name, email, phone, stay dates, number of guests, any requests): processed to manage and fulfil your booking and provide the service. Legal basis: performance of a contract or pre-contractual measures — Art. 6.1.b GDPR.
- Payment data: online payments are handled by the provider Stripe; card details are entered and processed directly by Stripe and are not stored on our systems. Legal basis: performance of the contract — Art. 6.1.b GDPR.
- Contact form data (name, email, message): processed to reply to your enquiries. Legal basis: response to your request / legitimate interest — Art. 6.1.b/f GDPR.
- Browsing data and technical logs (IP address, browser type, access times): collected automatically to ensure the operation and security of the site. Legal basis: legitimate interest — Art. 6.1.f GDPR.
- Legal obligations (invoicing, tax and administrative duties). Legal basis: legal obligation — Art. 6.1.c GDPR.
Recipients of the data
Within the limits of the purposes above, data may be shared with parties acting as processors or independent controllers:
- Stripe Payments Europe, Ltd. — online payment processing (privacy policy).
- Google Ireland Ltd. — the Google Maps map embedded in the Contact page, loaded when you view the map (privacy policy).
- Website hosting provider and parties providing technical/administrative services on behalf of the Controller.
Data is not disclosed or sold to third parties for marketing purposes.
Transfer of data outside the European Union
Some providers (e.g. Stripe, Google) may process data outside the European Economic Area. In that case, the transfer takes place with adequate safeguards under the GDPR (e.g. the European Commission’s Standard Contractual Clauses).
Retention period
- Booking data and accounting/tax documents: for as long as needed to provide the service and, thereafter, for 10 years as required by law.
- Contact form data: for as long as needed to handle the enquiry and then deleted, unless otherwise required by law.
- Technical logs: for a limited period consistent with security purposes.
Your rights
You may exercise at any time the rights under Articles 15-22 GDPR: access to your data, rectification, erasure, restriction of processing, portability, objection to processing and withdrawal of consent (where given), without affecting the lawfulness of prior processing.
To exercise your rights, write to info@secretgardenrelais.com or to the certified email secretgardenrelais@pec.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
Cookies
Cookies are small text files that websites save on the user’s device. This site uses:
- Technical and functional cookies (no consent required): necessary for the site to work, for example to remember the chosen language (Polylang) and to manage the booking session. These are first-party cookies.
- Third-party cookies: activated only if you use features that require them — the Google Maps map on the Contact page and Stripe during payment. They are governed by the respective privacy policies listed above.
You can manage or disable cookies from your browser settings. Disabling technical cookies may affect some site features.
Changes to this policy
The Controller may update this policy; any changes will be published on this page together with the update date.