Privacy Policy
Last updated: October 12, 2026
This page tells you what happens to your personal data when you leave us an address for the newsletter, or when you write to us. It is a legal document, but we would like it to be genuinely readable: if anything here is unclear, ask us and we will explain it.
Who handles your data
The data controller is Santa Bona Srl, with its registered office at Via Piave 30, 31020 Vidor (TV), Italy — VAT number IT05581590261. It is the company that runs the Abbazia di Santa Bona; on this page we simply call it the Abbazia.
On any matter concerning your data you can write to us at abbazia@abbaziadisantabona.com or telephone +39 393 3654898. We have not appointed a data protection officer: the Abbazia answers you directly, at the same contact details.
When we collect your data
We collect the information you provide when you request a newsletter subscription, complete a booking form or contact us by email. There is no account to create and we do not use this information to profile you.
The server hosting the website may record technical access data — IP address, date and time, requested page and browser type — to operate the service and identify faults or abuse. This processing is based on our legitimate interest in keeping the website secure and available (art. 6(1)(f) GDPR). These logs are separate from form submissions and are not used for advertising.
The hosting provider manages technical logs and their rotation. The 30-day period described below applies to the website’s form records and does not automatically change server log retention. To ask about the periods applied to those logs, write to abbazia@abbaziadisantabona.com.
Subscribing to the newsletter
The form at the bottom of the page asks for your email address and a consent choice, together with a link to this notice. We collect your subscription request for communications from the Abbazia: news, open days, restoration work and proposals for weddings and events.
Newsletter delivery is currently suspended: Mailchimp is not connected to the forms and contains no Abbazia contacts. We send neither newsletters nor automated double-confirmation emails. Before restarting the service or sharing data with an external provider, we will update this notice and verify that valid consent is available.
The website records the submission date and time, browser information, page of origin, language and consent choice, including the wording shown and its revision. These details help us manage the request and document your choice. IP addresses are not stored in new form submissions. Older records may contain technical data collected under the previous configuration; the retention period below also applies to them.
The forms use an invisible honeypot field to help prevent automated submissions. These checks run within the website and use neither reCAPTCHA nor external anti-spam services. Some checks may temporarily process the request’s IP address and retain, for one day, a counter associated with a code derived from that address. This code is not the IP address in the clear and is separate from subscription data. Disabling IP storage in submissions does not prevent these temporary checks.
Submissions marked as spam may be reviewed and deleted earlier; the same 30-day retention period applies to them. The form sets no cookies and does not require your browser to contact external services.
If you write to us
When you write to the address published on the website, we use your contact details and message to reply and handle your enquiry.
The booking forms ask for your name, email address, phone number, number of people and notes. They also record the language, requested event and consent choice. We use this information to handle the booking or prepare for a meeting. Contact details received through a booking or by email are not added to the newsletter.
Why we process this data, and on what grounds
| Why | What data | Legal basis | For how long |
|---|---|---|---|
| Recording a newsletter subscription request | Email address and consent choice | Your consent, art. 6(1)(a) GDPR | 30 days in website records; deletion at the first available daily check |
| Documenting the consent choice | Email, date and time, browser, page of origin, language, choice, consent wording and revision; any historical technical data | Obligation to demonstrate consent, art. 6(1)(c), read with art. 7(1) | 30 days, together with the submission stored on the website |
| Handling bookings and replying to enquiries | Name, email, phone, number of people, notes, language, event and technical submission data | Steps requested before an agreement, art. 6(1)(b); for other enquiries, legitimate interest in replying, art. 6(1)(f) | 30 days for website submissions. Correspondence and event documents follow the separate periods described below |
| Preventing automated submissions and form abuse | Honeypot field and, for some checks, temporary counters associated with codes derived from the IP address | Legitimate interest in protecting the website, art. 6(1)(f) | Technical counters: one day; stored spam submissions: 30 days, unless deleted earlier |
| Operating the website and identifying faults or attacks | Technical access logs | Legitimate interest in keeping the website secure and available, art. 6(1)(f) | Log retention and rotation managed by the hosting provider for technical purposes, separately from form records |
How consent is given, and how it is taken back
Consent for a newsletter subscription request is given by ticking the box in the form. It is freely given: you can contact us, visit the Abbazia and request a booking without subscribing. The current configuration does not include a second email confirmation.
You may withdraw consent or request deletion of your subscription request by writing to abbazia@abbaziadisantabona.com, without having to give a reason. Withdrawal applies from that point onwards and does not affect processing carried out beforehand while consent was valid.
Who we pass your data to
Submissions are recorded in the website database. They may be accessed by authorised people handling the Abbazia’s enquiries and, for their respective technical activities, by the hosting provider and maintenance provider, according to their roles and confidentiality obligations.
Mailchimp is disconnected and receives no data collected through the forms. We neither sell nor pass on contact details for advertising. Information is disclosed to authorities when required by law.
How long we keep your data
Form submissions on the website. Newsletter requests and bookings, with their technical data and consent evidence, have a retention period set to 30 days from submission. Permanent deletion takes place at the first available daily automated check after that period. The same rule applies to submissions marked as spam, which we may delete earlier. Consent evidence is deleted with the submission, with no separate newsletter archive.
Correspondence. Emails received and form notifications delivered to the mailbox are separate records: deleting a submission from the website does not automatically delete those emails. We keep correspondence for as long as needed to reply and follow up an enquiry and, if no event results, within twenty-four months. Civil and tax retention obligations still apply to event or contract documents.
Backups. Restricted website backups are used to recover from faults and follow a separate retention cycle. Information deleted from form records may remain in a backup until that backup expires or is replaced. The 30-day submission period does not mean simultaneous deletion from backups or the hosting provider’s technical logs.
No profiling, no automated decisions
We do not use form information to build profiles and do not make decisions affecting individuals solely through programs. Analytics and marketing services are not currently enabled. The map is a local image; Google Maps opens only when you choose its link.
Your rights
Articles 15 to 22 of the GDPR give you a series of rights that you may exercise at any time, free of charge.
| Right | What you can ask for |
|---|---|
| Access (art. 15) | To know whether we process data concerning you, and to receive a copy of that data |
| Rectification (art. 16) | To correct a wrong address or an incomplete detail |
| Erasure (art. 17) | To ask for your data to be deleted: always, when you withdraw a consent; and in the other cases the article provides for, for example when we no longer need it for the purpose you gave it to us for |
| Restriction (art. 18) | To freeze the processing while we look into an objection of yours |
| Portability (art. 20) | To receive your data in a format another service can read, or to ask us to send it directly to whomever you name, where that is technically possible |
| Objection (art. 21) | To object to those forms of processing that rest on our legitimate interest |
| Automated decisions (art. 22) | Not to be subject to a decision taken solely by a program. We take none here, as we wrote above |
| Withdrawal of consent (art. 7(3)) | To withdraw your consent to the newsletter, as easily as you gave it |
To exercise them, a message to abbazia@abbaziadisantabona.com is all it takes. There are no forms to fill in and nothing to pay. We reply within one month; if the request is a complex one that period may be extended by two months, but in that case we will tell you within the first month and explain the reason. Should we have a reasonable doubt about who is writing to us, we may ask you for something more — for instance, to write to us again from the address you left with us. We will do so only where it is genuinely needed, and we will never ask you for documents that have nothing to do with it.
If you wish to turn to the supervisory authority
If you believe your data has been handled improperly, you may lodge a complaint with the Garante per la protezione dei dati personali, the Italian data protection authority, Piazza Venezia 11, 00187 Rome, Italy — garante@gpdp.it, certified email protocollo@pec.gpdp.it, switchboard +39 06 696771, garanteprivacy.it. You may equally take the matter to the ordinary courts. If you live or work in another country of the Union, or if you believe the infringement took place there, you may turn to the supervisory authority of that country: art. 77 of the GDPR leaves the choice to you.
We would be glad, though, if you gave us the chance to put things right first: write to us, and we will try to set matters straight.
Cookies
Cookies and similar technologies have a document all of their own, because the subject is a different one and so are the rules. You will find every detail in the cookie policy, and you can review your choices at any time from the Cookie preferences link at the foot of every page.
Updates
When the way we process data changes, we update this page and the date at the top. Before restarting newsletter or tracking services, we will update the relevant information and consent arrangements.