Privacy Policy

Last updated: October 2026

This notice describes how users’ personal data is processed when visiting the website www.albaumbra.com, in compliance with Regulation (EU) 2016/679 (“GDPR”) and applicable national law.

1) Data Controller

Non-business activity “AlbaUmbra”
Address: Località Polgeto 518 – 06019 Umbertide (PG) – Italy
CIR: 054056C201031699 – CIN: IT054056C201031699
Data Controller: Paolo Fronduti
E-mail: contacts@albaumbra.com

2) Data processed

• Data provided voluntarily: name, surname, e-mail, and message content sent through contact forms or direct communications.
• Browsing data: IP address, user agent, visited URLs, date/time, technical logs generated by IT systems; such data is processed in aggregate/anonymous form for security and basic statistics.
• Cookies and similar technologies: technical cookies (always active) and, only with consent, third-party cookies/tools (Google Analytics 4, Meta Pixel, Google Maps). Details in the Cookie Policy.

3) Purposes and legal bases

• Managing requests (responses to contacts, information, bookings): art. 6.1.b GDPR (execution of pre-contractual measures at the request of the data subject) and/or art. 6.1.a (consent) where necessary.
• Legal obligations (e.g. tourism and public security regulations): art. 6.1.c GDPR.
• Site operation and security (technical logs, abuse prevention): art. 6.1.f GDPR (legitimate interest of the controller).
• Statistics and marketing via third-party cookies/tools (Google Analytics 4, Meta Pixel): art. 6.1.a GDPR (consent via banner).
• Map display (Google Maps iframe): art. 6.1.a GDPR (consent via banner).

4) Processing methods and retention times

Data is processed using IT and/or paper tools by the Controller and, where necessary, by technical providers appointed as “Processors”. Data is stored for the time strictly necessary for the purposes: for requests via form, the time needed to respond; for legal obligations, the time required by law; for non-technical cookies, until withdrawal/update of consent and in any case according to the durations indicated by providers.

5) Disclosure to third parties and categories of recipients

Personal data may be disclosed to entities providing services to the Controller and processing the data as Processors (art. 28 GDPR), as well as to entities authorized by law. In particular:

Providers who may access data (processors/technical providers)

• Register S.p.A. (hosting and mail): stores site data/infrastructure.
• Technical maintenance providers (IT development/support), if appointed and strictly necessary for site operation.
• Mail services used to manage communications (e.g. provider webmail/SMTP).

Third parties collecting data directly (independent controllers)

Some widgets/scripts integrated into the site may collect data directly from the user as independent controllers. Installation occurs only after explicit consent via the cookie banner.

Note: if the site uses only an iCal/ICS link managed server-side (e.g. server import without embedded widget in the browser), Booking.com cookies are not set on the user’s device. If widgets/iFrames are present, loading occurs from Booking.com’s domain and may involve processing by them.

• Google LLC – Google Analytics 4 (statistics) and Google Maps (maps).
  Privacy: policies.google.com/privacy – Technologies/Cookies: policies.google.com/technologies/cookies
• Meta Platforms Ireland Ltd. – Meta Pixel (campaign measurement/optimization).
  Privacy: facebook.com/privacy/policy – Cookies: facebook.com/policies/cookies/
• Booking.com B.V. (only if booking widgets/badges are present).
  Privacy: booking.com/content/privacy.it.html
• Tabnav (widget.tabnav.com) – Accessibility button, loaded only with consent to external content.
• Google reCAPTCHA (Google Ireland Ltd) – Protection of the contact form against automated submissions, loaded only with consent.
  Privacy: policies.google.com/privacy
• WhatsApp Ireland Ltd. (Meta Platforms) – Direct contact button/link via WhatsApp.
  Privacy: whatsapp.com/legal/privacy-policy-eea
• External social networks (links) – buttons/links to external pages (e.g. Facebook, Instagram).
  They do not install profiling cookies while browsing this site. However, by clicking the link, the social network may process your data as an independent controller.
  Privacy: facebook.com/policy.php, instagram.com/policy

Note: if social widgets (e.g. “Like” or “Follow” buttons embedded directly on the site) are integrated in the future, they may set third-party cookies even without a click. In such case, this notice will be updated and cookies will be loaded only after consent.

6) Data transfers outside the EU

Some providers (e.g. Google, Meta) may process data outside the European Economic Area. In such cases, the transfer is based on adequate safeguards under Articles 44-49 GDPR (e.g. Standard Contractual Clauses adopted by the European Commission and supplementary measures). More details are available in the providers’ policies.

7) Data subjects’ rights

Pursuant to Articles 15–22 GDPR, users may exercise the following rights:

• right of access, rectification, erasure;
• restriction and objection to processing;
• data portability (where applicable);
• withdrawal of consent at any time, without affecting the lawfulness of processing based on consent before withdrawal;
• lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).

To exercise your rights: contacts@albaumbra.com

8) Cookies and consent management

The site uses a banner allowing acceptance or rejection of non-technical cookies. Your choice can always be changed via: Manage cookie preferences. For details on the cookies used (types, duration, providers, links to their policies) see the Cookie Policy.

9) Security

Appropriate technical and organizational measures are adopted to protect processed data from unauthorized access, loss, or misuse.

10) Minors

The site is not intended for children under the age of 14. Any communications sent by minors must be managed by a parent/legal guardian.

11) Changes to this notice

This notice may be updated for regulatory or functional reasons. Updates will be published on this page with the date indicated.

For any information regarding the processing of personal data, you can contact: contacts@albaumbra.com.