1. Data Controller
The controller of the personal data collected through this website is:
Daniele Gattuso
Cefalù, Sicily, Italy
Email: mont6.home@gmail.com
2. Personal Data Collected and Purposes
We collect and process the following data exclusively for the indicated purposes:
- Booking Data: Stay dates, number of guests, amount, booking status, and booking-attempt and payment identifiers. After payment, we also receive the name and email address entered at Stripe Checkout and store them with the booking. This information is used to reserve the dates, verify payment, send confirmation, and manage your stay, cancellations and refunds.
- Payment Data: Payment takes place on Stripe’s hosted checkout. Your full card number and security code (CVC/CVV) are not sent to this website or stored in our database. We receive transaction identifiers, the amount and payment status; Stripe may display partial payment-method details to the host, such as the card brand and last four digits, to identify a transaction and provide support.
- Enquiries and messages: If you contact us by email or WhatsApp, we use your contact details and message content to reply and arrange your stay. Do not send full card details through these channels. This website does not provide an identity-document upload form.
- Technical data: When you browse, the services that deliver and protect the website process request data such as IP address, date and time, requested page, browser information and errors. This supports website operation, troubleshooting and abuse prevention. The cookies section explains browser storage, the map and website statistics.
- Optional analytics: Only with your consent, Google Analytics 4 measures pages viewed, clicks on the booking form’s WhatsApp link and the email and phone links at the bottom of the page, the start of checkout and paid bookings. Clicks indicate that a contact link was opened; they do not prove that a message was sent or a call completed. For paid bookings, we send the amount in euros and an internal booking identifier, separate from Stripe identifiers. We do not send Google names, email addresses, messages, stay dates or the number of guests. Page addresses exclude query parameters and fragments; only the domain of a referring site is kept. We may associate one of the predefined labels on our links, such as Instagram or Facebook and the summer 2027 campaign. Google also receives technical data needed for the service and pseudonymous browser identifiers. We use these statistics to understand which journeys lead to an enquiry or booking, not for personalised advertising.
The data needed to confirm a booking and process payment is necessary for these services; without it, we cannot complete an online booking. A general consent to privacy processing is not required for this purpose. We do not use booking data to send newsletters or advertising.
3. Legal Basis for Processing
We process your data based on the following conditions:
- Performance of a contract or pre-contractual steps requested by you (Article 6(1)(b) GDPR): answering enquiries and managing bookings, payments, stays and support.
- Compliance with legal obligations (Article 6(1)(c) GDPR): tax and administrative records and stay-related duties, including reporting to the competent authorities. Any additional data required to identify guests is collected through arrival procedures, not through this website’s booking form.
- Legitimate interests (Article 6(1)(f) GDPR): protecting the website and bookings from abuse, diagnosing errors, measuring visits and performance in aggregate with Cloudflare Web Analytics without tracking cookies, and protecting rights in a dispute, to the extent necessary and taking account of individuals’ rights and freedoms.
- Consent (Article 6(1)(a) GDPR): optional Google Analytics 4 statistics and related browser storage. You can refuse or withdraw consent at any time through cookie preferences without affecting your ability to browse, contact us or book.
4. Services used and recipients
- Cloudflare hosts and protects the website, runs booking functions and stores booking records in its D1 database. It also provides the statistics described in the cookies section. Cloudflare privacy policy.
- Google provides Google Analytics 4 and processes the optional analytics data described on this page on our behalf, only after your consent. We do not use Google Signals, ad personalisation or Meta Pixel. Google privacy policy and data-processing terms applicable to Google Analytics.
- Stripe processes payments and helps prevent fraud. Depending on the service, it processes data on the host’s behalf or for its own purposes, including legal duties. Stripe privacy policy.
- Resend sends booking confirmations and service notices. It receives the email address, name and message content, including stay dates and amount. Emails are also handled by the host’s and recipient’s email providers. Resend privacy policy.
- OpenStreetMap Foundation receives technical data needed to deliver map images, such as your IP address. OpenStreetMap privacy policy.
- WhatsApp is involved only if you choose to follow its link and use the service to contact us. The link is not an embedded website chat. WhatsApp privacy policy.
Data may be disclosed to the competent authorities where required by law and to tax or legal advisers as necessary for their work. Booking data is not published on the website; the public calendar shows availability without guests’ names or contact details.
5. Processing outside the European Economic Area
Providers may process data outside the European Economic Area, including in the United States. Their terms describe transfer safeguards, including, where applicable, adequacy decisions and the European Commission’s standard contractual clauses. Resend states that its primary processing operations take place in the United States. Data is therefore not necessarily kept exclusively in Italy or the European Union.
You can read the published data-processing terms of Cloudflare, Stripe, Resend and Google, as well as the privacy notices of the other services listed above. For information about safeguards relating to your data, contact the controller using the email address on this page.
6. Data retention
Retention depends on the type of data and its purpose. The criteria are:
- Enquiries without a booking: the time needed to reply and complete follow-up correspondence, taking account of unresolved disputes.
- Bookings, payments and confirmations: management of the stay, cancellations, refunds and disputes, followed by the tax and administrative retention obligations applicable to each record. These criteria do not mean that copies of identity documents are retained for the same period.
- Booking attempts and technical logs: the time needed to verify transaction outcomes, prevent duplicates and abuse, and troubleshoot problems; an incident or dispute may require records to be kept while it is addressed. A payment attempt expiring does not automatically delete every related technical record.
- Google Analytics 4 statistics: user-level and event-level data is set to be retained for 2 months, without extending the period after new visits. Standard aggregated statistical reports are not subject to the same retention limit.
- Cookies and browser storage: according to the duration and arrangements described in the cookies section below, or until cleared by the user.
You can ask about retention for a specific booking and request deletion of your data. Requests are assessed in light of legal obligations and any need to protect legal rights.
7. Your rights
Subject to the conditions and limits in the GDPR, you may request access, rectification, erasure and restriction of processing. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may exercise data portability for data you provided that is processed by automated means based on a contract or consent. Write to mont6.home@gmail.com; proportionate information to verify your identity may be requested where necessary to protect your data.
You can withdraw consent to Google analytics at any time through cookie preferences. Withdrawal stops new measurements and does not affect the lawfulness of processing before withdrawal; it does not automatically erase data already sent. Contact the controller to exercise your rights over data already processed.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) or another competent supervisory authority, particularly in the EU Member State where you habitually reside or work, or where you believe an infringement occurred.
8. Cookies and preferences
You can use the website and book even if you refuse optional analytics. Google Analytics 4 starts only after your explicit choice: before consent or if you refuse, the site does not load Google Analytics or send it data, including cookieless signals. We do not use personalised advertising cookies or Meta Pixel.
- Language and booking — necessary: the mont6_lang cookie remembers your chosen language for one year. Browser session storage keeps selected dates and the booking-attempt identifier so you can resume the process without duplicating it.
- Cookie choice — necessary: browser local storage remembers your choice to accept or refuse analytics and the date of that choice for 180 days. Dismissing the former informational cookie notice does not count as consent to Google analytics.
- Google Analytics 4 — optional: the _ga and _ga_* cookies distinguish browsers and sessions for analytics. They are set only with consent, for up to 180 days from creation, without automatic renewal on each visit. They are not linked to Google Signals or ad personalisation.
- Campaign and booking counts — optional: with consent, browser session storage keeps predefined labels from the link you followed. Local storage also keeps a limited list of internal identifiers for bookings already measured, to avoid counting them more than once: it expires with your cookie choice, within a maximum of 180 days. These identifiers do not grant access to a booking.
Payment takes place on Stripe’s secure page, where Stripe manages its own security and fraud-prevention tools. The map loads images from OpenStreetMap, which receives technical request data such as your IP address.
Necessary cookies do not require consent. You can accept or refuse analytics in the banner, reopen preferences through the link below or “Cookie preferences” on the website, and change your choice at any time. Withdrawing consent removes Google Analytics cookies and optional campaign and counting storage without cancelling your booking. You can also clear site cookies and storage in your browser settings; this removes your saved preferences.
The site also uses Cloudflare Web Analytics to measure visits and performance, without cookies or local storage to track users. Read the privacy notices from Cloudflare, Stripe and OpenStreetMap.