Privacy policy

Data controller

Poggio dei Mandorli Società Agricola (DEMO), [DA SOSTITUIRE] Località Poggio 1, 53100 Siena (SI), Italy, VAT no. [DA SOSTITUIRE] 00000000000, email [DA SOSTITUIRE] info@biseven.it. No Data Protection Officer (DPO) has been appointed [DA VERIFICARE].

Data we process

Browsing data. The systems running this website automatically collect some data whose transmission is implicit in the use of Internet protocols (for example IP addresses, date and time of the request, resource requested). It is used only to keep the site working and secure, and is kept by the hosting provider for the period required by law.

Data sent through the contact form. If you fill in the form or email us, we process the data you give us (name, email, phone number if provided, your message) only to answer your enquiry or booking request. Together with your request we record the page you sent it from, the language of the site, and the date and time you acknowledged this notice. Messages are not stored on the site: they are only delivered by email. To prevent abuse, the server records a fingerprint (hash) of your IP address with the times of your submissions: it is only used to block more than 5 submissions in 10 minutes, and times older than 10 minutes are discarded. Name, email and message are needed to reply; without them we cannot handle your request.

Purposes and legal basis

Purpose	Legal basis
Answering enquiries and booking requests	Pre-contractual steps at your request (Art. 6(1)(b) GDPR)
Security and operation of the site	Our legitimate interest (Art. 6(1)(f) GDPR)
Demo analytics (only with consent)	Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time

Users of the admin area

For people authorised to manage the site content (employees or collaborators of the controller) we process name, email address and role, the password (stored only as a one-way hash) and the date of last login, in order to grant and secure access (Art. 6(1)(b) and (f) GDPR). Data is kept while access is enabled; when it is no longer needed the account is deactivated and the data deleted within [DA SOSTITUIRE: 12] months. Password reset links are single-use, valid for 30 minutes and stored only in hashed form.

Access by the technical provider. The admin area includes an account for SE.VEN INFORMATICA S.r.l., the provider that manages the site, used for maintenance and support. It is visible in the user list and its operations are logged like those of any other user. SE.VEN INFORMATICA S.r.l. acts as data processor (Art. 28 GDPR) [DA SOSTITUIRE: details of the agreement or appointment].

Security alerts. Some admin area events (admin area installation, logins blocked after too many attempts, two-step verification turned off, new administrators) trigger an automatic email to the technical provider, with the email address or name of the user involved, the date and a pseudonym of the IP address. They are only used to respond to attacks or misuse.

Support requests. From the admin area, users can contact SE.VEN INFORMATICA S.r.l. support through the TiAssisto software, by phone or by email. The request data (name, contact details, description of the issue and any attachments) are processed by SE.VEN INFORMATICA S.r.l., as data processor, only to provide support. Use of the TiAssisto app is also subject to the terms of the store it is downloaded from.

Activity log

For security we log operations performed in the admin area (logins, failed attempts, content and user changes, publishing, backups) with date and time, the user and a pseudonymised identifier of the IP address. Legal basis: legitimate interest in the security of the site (Art. 6(1)(f) GDPR). Retention: 180 days, then automatic deletion.

Blog authors

Blog posts show the author’s name (the user who created the post). Their email address is never published. Authors who prefer not to be named can ask at [DA SOSTITUIRE] info@biseven.it.

How long we keep data

Contact requests are kept for as long as needed to handle them and no longer than [DA SOSTITUIRE: 24] months, unless a contract follows (for example a stay), in which case tax-law retention periods apply.

Recipients and storage location

Data is stored in the database of the hosting provider [DA SOSTITUIRE] on servers in the European Union; backups are managed by the same provider, acting as data processor together with the provider that sends the contact form emails [DA SOSTITUIRE: the hosting email provider, on servers in the EU, or Twilio SendGrid, Inc. (USA), which participates in the EU-US Data Privacy Framework; data stays in the EU only if its European region is used]. Public pages are built with GitHub Actions (GitHub, Inc.): published content only passes through GitHub to build the site, with no personal data other than the author’s name.

If you load the map on the Contact page, Google receives your IP address: see the cookie policy. Data is not disclosed to the public.

Your rights

You can exercise the rights under Articles 15-22 GDPR at any time: access, rectification, erasure, restriction, portability, objection and withdrawal of consent (without affecting processing carried out before withdrawal). Write to [DA SOSTITUIRE] info@biseven.it. You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Cookies

For information on cookies see the cookie policy.