Privacy Policy

Last updated: April 24, 2026

Data Controller

NO TUSCANY SRL
San Gimignano (SI), Italy
Email: [email protected]

Data We Collect

We collect the following personal data when you use our services:

• Email address — provided voluntarily through the guide access form or at the time of booking
• IP address — recorded automatically at the time of consent, as proof of consent
• Language preference — detected automatically from your browser
• Browsing data — via GoatCounter (cookie-free analytics, no personal data collected)

Purpose of Processing

• Access to the Mi Manda Duccio guide
• Sending marketing communications about events, tips and offers related to Tuscany and La Ripa di San Gimignano (only with explicit consent)
• Managing bookings at La Ripa di San Gimignano

Legal Basis

• Explicit consent (Art. 6.1.a GDPR) for sending marketing communications via email
• Contractual performance (Art. 6.1.b GDPR) for managing bookings
• Legitimate interest (Art. 6.1.f GDPR) for a single re-engagement contact to former guests

Data Retention

Personal data is retained for a maximum of 36 months from the last contact or until consent is withdrawn, whichever comes first.

Data Sharing

We do not sell your data to third parties. We use the following services for data processing:

• Supabase (database) — EU servers
• Stripe (payments) — GDPR compliant
• Brevo (email delivery) — EU servers
• Netlify (hosting) — GDPR compliant

Your Rights

Under the GDPR you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request the deletion of your data
• Objection — object to processing for marketing purposes
• Portability — receive your data in a structured format
• Withdraw consent — at any time, via the unsubscribe link in every email or by writing to [email protected]

Cookies

This website does not use profiling or tracking cookies. The only browsing data collected is via GoatCounter, an analytics service that does not use cookies and does not collect personal data.

Contact

For any request regarding your personal data, write to [email protected]. We will respond within 30 days.

← Back to home