IT · EN · DE
Book →
Legal

Privacy Policy

This notice describes how we process the personal data of guests and visitors to the website, pursuant to Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 (Privacy Code). The optional, explicit and voluntary submission of data through the website's forms entails the subsequent acquisition of the data required to act upon the request.

Data controller

The data controller is Na Bela Grana di Ricca Manuel (hereinafter also "Ca' Mea"), VAT no. 03655240046, Borgata Saretto 34, 12020 Monterosso Grana (CN), Piedmont — Italy. For any request relating to your personal data you may write to info@camea.it.

Types of data collected

We process the data you provide to us directly: first and last name, email address, telephone number, dates and details of your stay, any particular requests (allergies, preferences) and, for gift vouchers, the details of the designated recipient. We also collect the data necessary for invoicing and legal obligations. Browsing data (e.g. IP address, technical logs) are processed within the limits strictly necessary for the operation and security of the website.

Purposes and legal bases

  • Management of bookings and payments — registration and confirmation of the stay, collection of payment, management of changes, cancellations and refunds. Legal basis: performance of a contract and of pre-contractual measures (art. 6.1.b GDPR).
  • Service communications — confirmation emails, pre-arrival reminders, practical information about the stay and assistance. Legal basis: performance of a contract (art. 6.1.b GDPR).
  • Legal obligations — invoicing, tax, accounting and administrative obligations. Legal basis: legal obligation (art. 6.1.c GDPR).
  • Newsletter and promotional communications — sending news and offers, only if you have given free and specific consent. Legal basis: consent (art. 6.1.a GDPR), revocable at any time.

Processing methods and payments

Data are processed using electronic tools, with security measures suitable to prevent loss, unlawful use or unauthorised access. Online payments are managed by SumUp, a provider certified to the PCI-DSS standard: your payment card details are never stored nor visible to Ca' Mea, but processed directly and securely by the payment network.

Recipients and data processors

Your data are not disseminated. They may be communicated to third parties acting as data processors (art. 28 GDPR), strictly for the purposes indicated above:

  • SumUp — management of electronic payments (PCI-DSS standard).
  • Supabase — database and storage of bookings.
  • Beds24 — channel manager and management of availability and booking channels.
  • Aruba (SMTP) / Resend — sending of transactional and service emails.
  • Vercel — hosting and distribution of the website.

Data may also be communicated to consultants, professionals and public authorities where required by law. Some providers may process data outside the European Economic Area: in such cases the transfer takes place in compliance with the safeguards provided for by articles 44 et seq. of the GDPR (e.g. standard contractual clauses).

Retention period

Data relating to bookings and payments are retained for the time necessary to perform the contract and, thereafter, for the periods imposed by tax and accounting legislation (generally 10 years). Data processed on the basis of consent (e.g. newsletter) are retained until consent is withdrawn or a request for erasure is made. At the end of the periods indicated the data are deleted or made anonymous.

Rights of the data subject

At any time you have the right to:

  • access your data and obtain a copy of it (art. 15);
  • rectify inaccurate or incomplete data (art. 16);
  • request the erasure of the data (art. 17);
  • request the restriction of processing (art. 18);
  • object to processing on legitimate grounds (art. 21);
  • obtain the portability of the data (art. 20);
  • withdraw at any time the consents given, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights write to info@camea.it. You also have the right to lodge a complaint with the Supervisory Authority — the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it) — should you consider that the processing of your data infringes the applicable legislation.

Cookies

For information on the cookies and analytics tools used by the website please consult the Cookie Policy.

Last updated: 21 June 2026