Privacy notice

Version 2 – last updated: 13 November 2026

This is a translation of the Italian privacy notice (Informativa privacy). If the two versions differ, the Italian one prevails.

On this page we explain which personal data we collect through this website, why we collect them and how we handle them, as required by Article 13 of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

1. Who we are

Lido Residence, Vico I Palmasera 4, 08022 Cala Gonone (NU), Italy, is run as a family business by two firms, which share this website and its request form:

• Lido Residence, owner Sergio Cucca – VAT no. 01381930914;
• Lido Residence di Cucca Marilena, owner Marilena Cucca – VAT no. 01381920915.

As they decide together how to handle the data of the requests sent through the website, they are joint controllers (Art. 26 GDPR). They have agreed that:

• all requests arrive in a single email inbox;
• Sergio Cucca replies to you, both about your stay and about questions on your data;
• if you book, your stay is handled by the firm that owns the apartment, which for those data also takes care of the legal obligations (tax records, reporting guests to the police, tourist tax).

You can in any case exercise your rights against each of the two controllers.

For any question about your data you can write to lido.residence@tiscali.it or call +39 340 4920685. We have not appointed a data protection officer (DPO), as it is not mandatory for our business.

2. What data we collect

Requests sent with the form

When you use the "Check availability" form you send us: your name, email address, phone number (optional), arrival and departure dates, how many of you there are by age group (adults, teens, children, infants) and whether you need a cot, whether your dates are flexible, and any message. For minors we only ask how many there are, without names or other data.

Together with the request, your IP address, the date and time of sending and the page it was sent from are transmitted automatically.

Please do not write in the message any data that the request does not need, in particular health information. If you need an accessible apartment you can say so without going into detail: we will discuss it with you directly, and we will use this information only to organise your stay.

Emails and phone calls

If you write to us directly or call us, we handle the data you give us for the same purposes.

Browsing data

As with any website, the systems of our hosting provider, Cloudflare, automatically record some data whose transmission is part of using the Internet: IP address, date and time of the request, page requested, result of the request, browser type and operating system. They are used only to run the website and protect it from abuse and attacks: we do not use them to find out who you are or to profile you.

3. Why we use your data

• To answer your request for availability or information and, if you wish, to prepare your booking. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and, for simple requests for information, our legitimate interest in answering you (Art. 6(1)(f)).
• To filter spam sent with the form: your IP address and email are checked automatically by anti-spam services. The legal basis is our legitimate interest in protecting the form from abuse (Art. 6(1)(f)).
• For the security of the website, using browsing data only. The legal basis is our legitimate interest in protecting the website (Art. 6(1)(f)).
• For legal obligations, if your request leads to a booking: tax records, reporting guests to the public security authority, tourist tax. The legal basis is a legal obligation (Art. 6(1)(c)).

When we rely on legitimate interest, we have checked that it does not override your rights: you can ask us how we carried out this assessment.

We do not use your data for newsletters, advertising or profiling, and we do not sell them or pass them on to others for their own purposes.

4. Do you have to give us your data?

No, but without your name, email, dates and number of guests (the fields with an asterisk) we cannot answer your request. Phone and message are optional.

5. Who can see your data

Your data are handled only by us, the controllers, and by the family members we authorise to help us run the business. To run the website and the form we rely on these providers:

• Web3Creative (India), which runs the Web3Forms service: it receives the form data and forwards them to our email inbox. It handles the data on our behalf as a processor, under its data processing agreement. It in turn uses Amazon Web Services (servers in various regions of the world), Cloudflare (global network) and Hetzner (Germany and Finland). To block spam, the IP address and email of the sender are checked by CleanTalk Inc. and Automattic Inc. (Akismet), in the United States. The up-to-date list of its providers is in annex 3 of the agreement published at web3forms.com/dpa.
• Smeraldo S.p.A. (Milan, Italy), which provides the Tiscali email service: it hosts the inbox in which we receive and keep the requests.
• Cloudflare, Inc. (United States): it hosts the website, protects it from attacks and records the browsing data. It handles the data on our behalf as a processor.

We do not disclose your data to anyone else, except when required by law (for example, if you stay with us, reporting guests to the police). If you ask, we will tell you the specific recipients your data have been disclosed to.

6. Transfers outside the European Union

Some providers handle the data outside the European Economic Area:

• India (Web3Creative – Web3Forms). There is no European Commission adequacy decision for India: the transfer is based on the standard contractual clauses approved by the Commission (Implementing Decision (EU) 2021/914), included in the Web3Forms data processing agreement. The anti-spam services CleanTalk and Akismet (United States) receive the data through Web3Forms, which must impose equivalent protection obligations on them.
• United States (Cloudflare). The transfer is based on the EU-U.S. adequacy decision (EU-U.S. Data Privacy Framework), which Cloudflare has joined, and in addition on the standard contractual clauses.

You can ask us for a copy of these safeguards by writing to lido.residence@tiscali.it. The text of the standard clauses is published on eur-lex.europa.eu and the list of certified companies on dataprivacyframework.gov.

7. How long we keep the data

• Requests that do not become a booking: we delete them from our inbox within 12 months. Web3Forms keeps a technical copy for up to three years, then deletes it automatically.
• Bookings: for the periods set by law: ten years for tax and accounting records, five years for the receipts of the guest reports to the police and for tourist tax records.
• Browsing data: we do not keep or consult these logs. In the Cloudflare dashboard we only see overall statistics, without data on individual people. Cloudflare keeps them for as long as needed for the security of the service, according to its privacy policy, which does not state a precise period.

8. Cookies

This website does not set cookies or use any other storage on your device (such as local storage) for profiling, advertising or statistics, and it does not embed content from other websites: fonts and map are hosted on the website itself. This is why we do not ask for any consent.

Only in case of suspicious traffic, our hosting and security provider, Cloudflare, may set technical security cookies, for example __cf_bm (which expires after 30 minutes of inactivity) or cf_clearance (after an anti-bot check). They are used to tell people apart from automated programs and, like all technical cookies, do not require your consent. The full list is on developers.cloudflare.com.

Some buttons lead to external websites, such as Google Maps, TripAdvisor or the reviews on Google. They open only if you click them, and from then on the privacy policies of those websites apply. Your browser only tells the external website the address of our website as the referring page.

9. Your rights

At any time you can ask us to:

• know which data we hold about you and receive a copy (access, Art. 15);
• correct or complete them (rectification, Art. 16);
• delete them (Art. 17);
• restrict their use (Art. 18);
• receive them in a machine-readable format (portability, Art. 20).

Right to object

You can object at any time, on grounds relating to your particular situation, to the processing based on our legitimate interest: answering simple requests for information, website security and spam filtering (Art. 21).

How to exercise them

Just write to lido.residence@tiscali.it: we will reply within one month. You can contact either of the two controllers.

If you believe your data are not being handled correctly, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work, or go to court.

10. Automated decisions

We do not take decisions based solely on automated processing, including profiling. However, the form's spam filter may automatically block a message mistaken for spam: if you do not get a reply within 48 hours, call us or write to us directly.

11. Changes to this notice

If we change the processing in a significant way, for example with new providers, new purposes or new transfers outside the European Union, we will update this page before the change takes effect and, if we still hold your data, we will let you know by email. Previous versions of this notice are available on request.