PRIVACY POLICY
Privacy Notice on the Processing of Personal Data pursuant to Regulation (EU) 2016/679 (GDPR)
1. Data Controller
The data controller responsible for the processing of personal data is:
Oasi Blu Società Semplice Agricola
Strada delle Piane 41/A
09011 Calasetta (SU), Italy
Tax Code and VAT Number: 04062790920
E-mail: info@oasiblucalasetta.it
The data controller processes users’ personal data in compliance with the applicable legislation on personal data protection.
2. Types of Personal Data Processed
The website may collect and process the following categories of personal data:
- Identification data: first name and last name.
- Contact details: email address and telephone number.
- Accommodation request data: arrival and departure dates, number of adults and minors, children’s age groups, and any information entered in the message field.
- Information and booking request data: the content of communications sent through the website, by email, telephone, or other contact channels.
- Browsing data: technical information collected automatically during visits to the website, such as IP address, device and browser details, pages visited, and access times, within the limits established by applicable law.
- Other data voluntarily provided by users: information submitted through the forms available on the website.
Users are advised not to enter unnecessary personal information in free-text fields, particularly information belonging to special categories of personal data.
3. Purposes of Processing
Personal data is processed for the following purposes:
- Handling information requests, to respond to questions submitted by users.
- Handling room availability and booking requests, to check availability, contact prospective guests, and organise their stay.
- Handling restaurant booking requests, where these are submitted through the contact channels made available.
- Taking pre-contractual measures and performing contractual obligations, when a user requests or confirms a service.
- Compliance with legal obligations, including tax, administrative, and accommodation-related requirements, where applicable.
- Website security and proper operation, including the prevention of unauthorised access, spam, and unlawful activities.
- Statistical analysis and website improvement, only to the extent permitted by law and in relation to the tools actually used.
- Sending promotional communications, only where applicable and on the basis of an appropriate legal ground, obtaining consent whenever required.
Personal data will not be used for purposes incompatible with those for which it was collected.
4. Legal Basis for Processing
Depending on the purpose, the processing of personal data is based on one or more of the following legal grounds:
- Pre-contractual measures: to respond to requests for availability, information, and bookings submitted by the data subject.
- Performance of a contract: to manage the services requested or booked.
- Legal obligation: to comply with obligations imposed by applicable law.
- Legitimate interests of the data controller: to ensure website security, prevent abuse, and protect the controller’s rights, while respecting the rights and freedoms of data subjects.
- Consent of the data subject: where required, for example for specific promotional activities or the use of non-essential cookies and tracking technologies.
Any consent given may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.
5. Whether the Provision of Data Is Mandatory
Providing the data requested in contact and availability request forms is necessary to handle the request and provide an appropriate response.
Failure to provide essential data may make it impossible to respond to the request or proceed with the booking.
Providing any additional, non-essential information is optional.
6. Methods of Processing
Personal data is processed using electronic, digital, and, where necessary, paper-based tools. Appropriate technical and organisational measures are adopted to ensure its security and confidentiality and to protect it against unauthorised access, loss, disclosure, or unlawful use.
Processing is carried out by persons authorised by the data controller and only within the scope of their respective duties.
7. Recipients of Personal Data
Personal data may be disclosed, to the extent necessary for the purposes indicated above, to the following categories of recipients:
- authorised personnel and collaborators of the data controller;
- IT service providers, hosting providers, and website maintenance and technical support providers;
- email and communication service providers;
- Beddy, a platform integrated into the website and used to manage bookings and related services;
- tax, administrative, and legal advisers, where relevant;
- payment service providers, where applicable;
- authorities and public administrations, where disclosure is required by law.
Where required by law, parties processing data on behalf of the data controller are appointed as data processors. Other parties may act as independent data controllers, depending on the roles they actually perform.
Personal data is not indiscriminately disclosed to the public.
8. Guest Data and Legal Obligations
In the event of a booking and stay, additional personal data relating to guests may be processed to the extent necessary to provide the service and comply with applicable legal obligations.
Where required by law, guests’ identification details may be communicated to the competent authorities through the designated systems.
Such processing is carried out to comply with applicable legal obligations and does not require the data subject’s consent where consent is not required by law.
9. Beddy Booking Platform and Embedded Content
The website integrates the Beddy platform, which is used to manage bookings, through content embedded in the website pages in a format similar to an iframe.
When users view or use the booking section, their browser may establish a connection with Beddy’s systems and transmit certain technical information to the provider, such as the IP address, browser and device details, and information necessary to display and use the service.
When users enter personal data into the booking form, that data may be processed through the Beddy platform to manage the request, check availability, and organise their stay.
Processing carried out through Beddy is also governed by the provider’s privacy policy, which is made available by the provider. Users are encouraged to consult it to understand how the platform itself processes personal data.
Oasi Blu Società Semplice Agricola processes the personal data necessary to manage enquiries and bookings for the purposes set out in this notice. The roles and responsibilities of Oasi Blu and Beddy are determined according to the processing activities actually carried out by each party.
The website may also contain links to other websites or third-party services, which are subject to their respective privacy policies.
10. Cookies and Tracking Technologies
The website may use technical cookies and other tools necessary for its operation. The presence of the Beddy booking platform embedded in the website pages may involve the use of cookies or other technologies for storing information on, or accessing information from, the user’s device, as well as the transmission of technical data to the provider’s systems.
Any use of cookies or tracking technologies that are not strictly necessary is managed in accordance with applicable law and is subject to the user’s prior consent where required.
For information about the types of cookies actually used by the website, including any that may be associated with Beddy, their purposes, and how to manage preferences, users are invited to consult the Cookie Policy and the consent management tools available on the website.
For processing carried out directly by Beddy through the embedded platform, users are also invited to consult Beddy’s privacy policy.
11. Transfers of Data to Third Countries
As a rule, personal data is processed within the European Economic Area.
If, as a result of using third-party providers or services, personal data is transferred to countries outside the European Economic Area, the transfer will take place in accordance with the conditions laid down by the GDPR, on the basis of an adequacy decision or other appropriate safeguards provided for by law.
For specific information about any transfers that may take place, data subjects may contact the data controller.
12. Data Retention Period
Personal data is retained for no longer than is necessary to fulfil the purposes for which it was collected, taking into account legal obligations and the need to protect the data controller’s rights.
In particular:
- Information requests: for the time necessary to handle the request and any subsequent communications.
- Availability and booking requests: for the time necessary to manage the request, the stay, and related obligations.
- Administrative and tax data: for the retention periods required by applicable law.
- Technical and security data: for the time necessary to ensure the security and proper functioning of the systems.
- Data processed on the basis of consent: until consent is withdrawn or the relevant purpose ceases to apply, without prejudice to any further retention obligations.
Once the applicable retention period has expired, the data will be deleted or anonymised, wherever possible.
13. Data Subject Rights
Pursuant to Articles 15–22 of Regulation (EU) 2016/679, data subjects may exercise the following rights, subject to the conditions and limitations established by law:
- obtain confirmation as to whether or not personal data concerning them is being processed;
- access their personal data and obtain a copy;
- request the rectification of inaccurate data or the completion of incomplete data;
- request the erasure of their data where the relevant conditions are met;
- request the restriction of processing;
- receive their data in a structured format and, where applicable, request its transfer to another data controller;
- object to processing based on legitimate interests on grounds relating to their particular situation;
- withdraw consent where processing is based on consent;
- not be subject to decisions based solely on automated processing, including profiling, in the cases provided for by law.
The exercise of these rights may be subject to the limitations and exceptions provided for by the GDPR.
14. Right to Lodge a Complaint
If data subjects believe that the processing of their personal data infringes applicable law, they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), in accordance with the procedures indicated on its official website:
https://www.garanteprivacy.it/
Data subjects also retain the right to bring proceedings before the competent judicial authority.
15. How to Exercise Your Rights
To exercise the rights listed above or to obtain information about the processing of personal data, you may contact the data controller using the following details:
Oasi Blu Società Semplice Agricola
Strada delle Piane 41/A
09011 Calasetta (SU), Italy
Tax Code and VAT Number: 04062790920
E-mail: info@oasiblucalasetta.it
The data controller will respond to requests within the time limits established by applicable law.
16. Protection of Minors
The website is not intended to independently collect personal data from minors for purposes unrelated to the management of the services offered.
Any data relating to minors that may be necessary for an accommodation request or booking is processed only to the extent necessary for the purposes indicated and in compliance with applicable law.
17. Changes to This Privacy Notice
The data controller reserves the right to update this Privacy Policy to reflect changes in legislation, technical or organisational developments, or the introduction of new services on the website.
The updated version will be published on this page. Users are therefore encouraged to review it periodically.
Last updated: 16 October 2026.
