Privacy
policy
Last updated: 14 November 2026
This notice explains how we process the personal data of people who visit www.miiohotel.com and of those who contact us through the website, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Privacy Code”) as amended by Legislative Decree 101/2018. It covers this website only: data collected during your stay (guest registration, invoicing) is described in the notice provided at the hotel.
1. Data controller
MIIO Hotel, Via IV Novembre 6, 57027 San Vincenzo (LI), Italy, VAT IT01994480497. Email: info@miiohotel.com · Phone: +39 0565 1960460.
We have not appointed a Data Protection Officer (DPO), as this is not required for our activity (Art. 37 GDPR): for any question please write to the email address above.
2. What data we process
Browsing data
When you visit the website, the server hosting it automatically records some technical data: IP address, date and time of the request, page visited, browser and device type. This is needed to run the website and protect it from abuse and cyber attacks.
Visit statistics
We measure visits and page speed with Vercel Web Analytics and Speed Insights. They use no cookies, do not store IP addresses and only produce aggregated data: they do not allow us to identify you.
Data you send us
If you fill in the contact form you give us your full name, email address, subject and message. The same applies if you email or call us. Please do not include health data or other special categories of data (Art. 9 GDPR) in your message, unless they are needed for your request, for example an accessibility requirement for your room.
Statistics with Google Analytics (consent only)
If you accept it in the cookie panel, we use Google Analytics 4 to understand in aggregate how the website is used (pages viewed, where visits come from, device type). Google Analytics 4 does not log or store IP addresses. We do not use Google advertising features or profiling.
External content
Only if you accept it in the cookie panel, or if you open the interactive map yourself, the website loads the OpenStreetMap map: your browser connects to its servers, which receive your IP address. By default the map is a static image served by our own website. The Mountain Bike page includes the BookYourRent booking form, which receives your IP address when you open that page.
3. Why we process data and on what legal basis
- Replying to your requests for information, availability or quotes: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
- Running and protecting the website, including aggregated statistics: our legitimate interest (Art. 6(1)(f) GDPR) in offering a secure and efficient website.
- Visit statistics with Google Analytics: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
- Showing the interactive map: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. The bike hire form is used to book the service you chose: steps taken at your request prior to a contract (Art. 6(1)(b) GDPR).
- Complying with legal obligations or requests from the authorities, and defending our rights in case of disputes: legal obligation (Art. 6(1)(c) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).
We do not use your data to send newsletters or marketing messages, we do not carry out profiling and we do not take decisions based solely on automated processing (Art. 22 GDPR).
4. Do you have to provide your data?
No. However, without your name, email and message we cannot reply to you. Browsing data is needed for the website to work.
5. Who receives the data
Data is processed by our authorised staff. Some providers also process it on our behalf, appointed as data processors (Art. 28 GDPR):
- Vercel Inc., which hosts the website and provides the aggregated statistics;
- Google Ireland Limited, which provides Google Analytics (only if you consent to statistics);
- the email provider through which we receive contact form messages and emails;
- HotelInCloud, the online booking system linked from the “Book now” button. The data you enter there is processed according to the notice shown on the booking page.
OpenStreetMap Foundation (map) and BookYourRent (bike hire form) process data as independent controllers under their own notices. The same applies to Facebook and Instagram (Meta) if you follow the links to our profiles. Data is never published or sold.
6. Transfers outside the European Union
Vercel Inc. is based in the United States and participates in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission in its decision of 10 July 2023 (Art. 45 GDPR). It has also signed the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR). The same applies to Google LLC (United States), which may receive Google Analytics data. OpenStreetMap Foundation is based in the United Kingdom, which benefits from an adequacy decision.
7. How long we keep data
- Messages received through the form or by email: for as long as needed to handle the request and in any case no longer than 24 months after the last contact. If the request becomes a booking, the data follows the retention periods set by law for that service (for example 10 years for tax documents).
- Browsing data: for the technical log retention period of the hosting provider, unless needed to investigate crimes.
- Choices made in the cookie panel: 6 months, after which we ask again.
- Google Analytics data: 14 months, after which it is deleted automatically.
8. How we protect data
The website only uses encrypted connections (HTTPS). Access to data is limited to the people who need it to answer requests, and providers are chosen among those offering adequate security guarantees.
9. Your rights
You can ask at any time to access, rectify or erase your data, to restrict its processing, to receive it in a readable format (portability) and to object to processing based on legitimate interest (Arts. 15–21 GDPR). You can withdraw your consent to statistics and the interactive map at any time with the button (also at the bottom of every page). Withdrawal does not affect the lawfulness of processing carried out before.
To exercise your rights write to info@miiohotel.com: we will reply within one month of your request, extendable by two months for more complex cases (Art. 12 GDPR).
10. Complaints
If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the country where you live or work (Art. 77 GDPR).
11. Children
The website is not aimed at children under 14 and we do not knowingly collect their data. If we find we have received any, we will delete it.
12. Changes
We may update this notice, for example if the website services or the law change. The date of the last update is shown at the top. For cookies please also read our Cookie policy. In case of discrepancy, the Italian version prevails.
