Personal data privacy notice under Article 13 of Regulation (EU) 2016/679

Version 2026.09.23 - last updated: 27 September 2026.

Download the privacy notice as a PDF (opens in a new tab)

This notice covers data collected through the online booking form and, when the user gives consent, website usage statistics. The acknowledgement required in the form does not constitute consent to promotional communications or Google Analytics.

1. Data controller

2. Personal data processed

The form and related payment process may process:

• registration number, vehicle type, selected package, arrival date and time and expected departure;
• first name, last name, email address and, if provided, reference, telephone number and notes;
• if an invoice is requested, company name, Italian VAT number, Italian tax code, address, postcode, town or city, province, certified email address and SDI recipient code;
• booking and payment identifiers and status, amount, currency, technical events and data necessary to prevent errors or fraud;
• only after consent to analytics cookies, a pseudonymous browser identifier, pages viewed and statistical events relating to scrolling, outbound clicks and downloads; data entered in the booking and payment data are not sent to Analytics;
• technical connection data, such as IP address, browser type, date and time, transmitted to the providers of static resources required to display fonts and icons.

Full card details are not collected by the website: payment takes place on the payment service provider's pages.

3. Purposes and legal bases

• managing the request, booking, access to the site, 24-hour vehicle supervision and monitoring service, payment and service communications, on the basis of taking steps at the data subject's request before entering into a contract and performing that contract (Article 6(1)(b) GDPR);
• complying with administrative, accounting, tax and legal obligations (Article 6(1)(c) GDPR);
• protecting people, property, IT systems and payments, preventing abuse and fraud, and establishing, exercising or defending the controller's rights, in pursuit of the related legitimate interest (Article 6(1)(f) GDPR);
• delivering the fonts and icons necessary to present the website through specialist providers, in pursuit of the legitimate interest in providing readable, consistent and secure pages (Article 6(1)(f) GDPR);
• producing page-usage statistics through Google Analytics 4 exclusively after the user has given consent (Article 6(1)(a) GDPR).

Consent is not required for the purposes listed above other than Google Analytics. Google Analytics remains disabled until the user makes a positive choice. Any promotional communications or periodic feedback requests will be managed separately and, where required by applicable law, only with prior consent.

4. Requirement to provide data

First name, last name, registration number, email, stay details, invoice choice and acknowledgement of the notice are required to use online booking. Failure to provide them prevents completion of the request. Other fields are optional, except for tax details when an invoice is requested.

5. Processing methods and automated decisions

Data is processed using IT systems and appropriate organisational and technical measures. The website does not make decisions based solely on automated processing that produce legal or similarly significant effects on the data subject. The payment provider may apply its own fraud checks in accordance with its privacy notice.

6. Recipients

Data is not publicly disclosed or sold. To the extent necessary, it may be processed by authorised personnel and by hosting, email, IT support and payment providers, including Aruba and Stripe, as well as the static resource providers Google Fonts, cdnjs/Cloudflare and jsDelivr. For accepted analytics data only, Google Ireland Limited is also involved in the applicable privacy role. Data may also be disclosed to advisers, authorities or other parties where required by law or necessary to protect a right.

7. Transfers outside the European Economic Area

Some providers, particularly those involved in payments, statistics and distribution of static resources, may process data outside the European Economic Area. In such cases, transfers take place on the basis of an adequacy decision or other safeguards under Chapter V of the GDPR. Further information about the safeguards applied may be requested from the controller or found in the providers' privacy notices.

8. Retention

• booking and contractual relationship data is retained for the time necessary to manage the service and subsequently for up to 10 years for legal obligations and the protection of rights;
• administrative, accounting and tax documents are retained for the periods required by applicable law, normally 10 years from the last entry;
• technical data and events are retained for the period necessary for security, anomaly management and transaction disputes, unless further retention is required by law or by an authority;
• Google Analytics user- and event-level data is configured for a two-month retention period without reset on new activity; analytics cookies have a maximum duration of six months without automatic renewal. Aggregated statistical reports may follow different retention periods.

At the end of the applicable periods, data is deleted or anonymised unless litigation or an authority's request justifies further retention.

9. Video surveillance

Processing of images in video-monitored areas is separate from online booking and is indicated before entry. Video surveillance contributes to the site's security, supervision and 24-hour monitoring measures. The complete related notice, including specific purposes and retention periods, may be requested from the controller using the contact details above.

10. Usage statistics and consent

Google Analytics 4 is blocked until the user makes a positive choice. Google Signals, advertising personalisation, collection of user-provided data, granular location and device data, and form interactions are disabled. Payment-return pages are excluded from measurement.

Consent may be refused or withdrawn at any time through “Review cookie choices” in the footer. Withdrawal does not affect the lawfulness of processing carried out before it was withdrawn. Details about cookies, the provider and settings are available in the cookie policy.

11. Data subject rights

The data subject may request access, rectification, erasure, restriction of processing and data portability where applicable, and may object to processing based on legitimate interests. Requests may be sent to info@areasostanovara.com. Exercising these rights does not affect retention obligations required by law.

12. Complaint

If the data subject believes that processing infringes the law, they may lodge a complaint with the Italian Data Protection Authority (opens in a new tab) or contact the competent supervisory authority.