How we handle your data

The data controller is PALAZZO SCOTTO - S.R.L. For anything concerning your data you can write to info@palazzoscotto.com or call +39 080 4324431: the same reception that welcomes you on arrival answers.

PALAZZO SCOTTO - S.R.L. is a single company with two brands: Palazzo Scotto, the rooms on this site, and NOS Ristorante (www.nosristorantealberobello.com). The controller is the same for both, with the same VAT number: between the two brands the data does not pass to another company. “F.lli Scotto S.r.l.”, which you may find in older documents, is the former name of the same company.

The controller uses the data from the two sites together for two purposes only. The first is measuring the group, that is, how many people know the rooms, the restaurant or both: for visits we do this only with your consent to statistics, also with a Google Analytics property shared by the two sites once it is active, which is not linked to any advertising account. The second is a monthly internal report, read only by the management, which compares the guests of the rooms and the customers of the restaurant in numbers only, for example how many guests dined at NOS. To count, we compare the bookings of the two businesses within our own systems; the report keeps only the numbers, with no names, contact details or profiles, and the working files are deleted once the calculation is done. Legal basis for the report: our legitimate interest in organising the service and the hospitality of the two businesses (art. 6(1)(f)); you can object by writing to info@palazzoscotto.com. We do not use one brand’s advertising identifiers on the other brand’s site: on this site there is no advertising tool of NOS, and on the NOS site none of Palazzo Scotto.

• Company name: PALAZZO SCOTTO - S.R.L.
• Address: Corso Trieste e Trento 30, 70011 Alberobello (BA), Italy
• Tax code and VAT number: 07751560728 — REA BA-579682
• Email: info@palazzoscotto.com — Phone and WhatsApp: +39 080 4324431

On every page of the site, above the footer, there is the form for asking us for a quote. Filling it in leaves us your first name, surname, email address, telephone number, arrival and departure dates, the treatment and the room you are interested in, the number of people and whatever requests you want to add.

If you consented to statistics, a few details about how you got here travel alongside the enquiry: the landing page, where you came from — a search engine or another site, for instance —, any campaign parameters present in the address and Google Analytics’ two pseudonymous identifiers, cid (which tells one browser from another) and sid (which identifies the visit), so the enquiry is joined back to the visit that produced it. With any consent (statistics or marketing) our visit identifier ps_vid travels too; if you consented to marketing, so do the advertising click identifier (gclid or equivalents) and the identifiers in Meta’s format (fbp, fbc). If you have not chosen or you refused, the enquiry goes out with only the data you typed in the form. These details do not identify you on their own, but they are attached to your enquiry and must therefore be read together with it. They exist so we can tell which channels actually work.

The form is the Mr PRENO service by TITANKA! S.p.A., which we use as the house CRM: the enquiry arrives there and reception answers you from there. TITANKA! S.p.A. handles this data on our behalf, as data processor. The form also has an optional box to subscribe to the newsletter: the subscription is based on your consent (art. 6(1)(a)), is recorded in Mr PRENO and you can withdraw it whenever you like, including by writing to info@palazzoscotto.com.

Legal basis: steps taken at your request before entering into a contract (art. 6(1)(b)). Without this data we cannot prepare a quote for you.

The Mr PRENO privacy notice

On the page for travel agencies it is possible to request our sales kit. That form collects the agency name, the IATA number, the country, the email address and the message.

Submission goes through the forms service of Netlify, Inc., the provider that hosts the site, and generates a notification to info@palazzoscotto.com, where reception checks the request and answers by hand. There is no private area and no automatic unlocking.

Legal basis: pre-contractual steps and, for the commercial relationship that follows, our legitimate interest in working with trade intermediaries (art. 6(1)(b) and (f)).

When you arrive on the site, before anything else the site sets every consent to “denied” within the page, and it loads neither Google’s tools nor Meta’s. A bar at the bottom asks you to choose; closing it with the X or with Esc counts as a refusal. Until you choose, and if you decline, no request leaves this site for Google Analytics, Google Ads or Meta: no cookie and no signal, not even a cookieless one. Until 7 October 2026, by contrast, Google received even without consent a short cookieless signal with IP address, browser and page (“advanced Consent Mode”); from 8 October 2026 it no longer does.

Before you choose, the site keeps only in the memory of the open page — not in cookies or in any other browser storage — a random visit code (ps_vid), an identifier in the format Meta uses (fbp) and, if you arrived with the fbclid parameter, a second one (fbc), plus the arrival data: landing page, source, campaign parameters and click identifiers. It sends them to no one, not even to our server: the “Book” link stays clean and the stay enquiry goes out with only the details you write. If you reload or close the page, they disappear. If you consent — even after a refusal, as long as the page is open — they are linked to the visit that already took place and from there the consent rules apply: ps_vid becomes a 90-day cookie and travels on the “Book” link and in the enquiry; with marketing, fbp and fbc become the _fbp and _fbc cookies (90 days) with the same values; the arrival data is kept for 90 days.

If you consent to statistics, the site also records the visit in our visit register, held by Supabase, Inc. on servers in the European Union (Ireland): the ps_vid identifier, the start and end time of the visit, the language, your consent choices, the landing page without parameters, the name of the referring site and the campaign parameters; if you also consent to marketing, also the advertising click identifier (gclid or equivalents) and the identifiers in Meta’s format (fbp, fbc). We do not record your IP address or browser type. It serves to tie enquiries and bookings to the visit they came from, to understand which channels really work. Without consent to statistics no visit reaches the register, not even with consent to marketing alone. If you withdraw consent from the “Cookie preferences” link, we stop recording your visits; to delete those already recorded, write to us at info@palazzoscotto.com.

If you consent to statistics, we load Google Analytics 4 to know how many people visit the site, which pages they read and which channel they come from. It receives the pages viewed, the clicks on phone, email, WhatsApp and on the “Book” button, the sending of an enquiry, your IP address (which Google uses for an approximate location and states that it does not store), the browser and device type, and it writes the _ga cookies. In Google Analytics the data stays for 14 months; a daily copy goes to our Google Cloud project (BigQuery, servers in the European Union): the export started on 14 September 2026 and has no automatic expiry yet; we will set it to 14 months by 30 November 2026, before any data reaches that age. If you also consent to marketing, we load Google Ads, which measures our campaigns and makes it possible to show you relevant ads, and Google Analytics may use Google Signals: if you have a Google account with ad personalisation turned on, Google can link the visits made from different devices, and in our reports we see only aggregated data. Our Google Analytics property is linked to our Google Ads account. Without consent to marketing, Google Ads receives nothing, even if you have accepted statistics.

With marketing consent, and only on www.palazzoscotto.com, we also load the Meta pixel, the tool Meta uses to measure campaigns on Facebook and Instagram. The pixel sends Meta every page you visit and, if you send us a stay enquiry, the fact that an enquiry was sent: each event carries a random code, the page address including any campaign parameters, the referring page, your IP address, the browser type and the _fbp and _fbc identifiers. The details you type in the form are neither read nor sent to Meta. Meta may link these events to your Facebook or Instagram account, if you have one. For the collection of this data on our site and its transmission to Meta we are joint controllers with Meta Platforms Ireland Limited (art. 26 of the Regulation), under the agreement Meta applies to those who use its tools; what Meta does with the data afterwards is decided by Meta, as an independent controller, under its own privacy policy. Without marketing consent the pixel is not loaded and no request leaves our site for Meta.

If you consented to marketing and you send us a stay enquiry, the email address and telephone number you typed in the form are turned inside your browser into an irreversible fingerprint (SHA-256 hash) and transmitted in that form to Google Ads, which compares it with its own to recognise that the enquiry came from a click on one of our ads (“enhanced conversions”). Google never receives a plain email or telephone number from this site; without marketing consent the form is not even read for this purpose.

For every choice on the bar we keep a receipt in our consent register, held by Netlify, Inc. (Netlify Blobs service): what you chose for each category, date and time, version and fingerprint of the notice you read, language, page without parameters and a random code called ps_consent_id, which stays in your browser’s local storage until you clear the site data. The receipt does not contain your name, your email or your IP address, but it is not anonymous: the ps_consent_id code is the same one that, if you consented to statistics, accompanies your visit in the visit register. The choice itself lives in the ps_consent cookie for six months. The receipt exists to show that consent was asked for and how you answered (art. 7(1)): we keep it for five years from the choice, then an automatic procedure deletes it.

Legal basis for statistics and marketing: your consent (art. 6(1)(a), and art. 122 of the Italian Privacy Code for what is read from or written to your device). You can withdraw it whenever you like from the “Cookie preferences” link at the foot of every page, as easily as you gave it, and withdrawing does not affect what happened before.

Which cookies we use, one by one

The “Book” button does not open a form of ours: it takes you to Bedzzle’s booking engine, on the booking.bedzzle.com domain. The booking data you enter there comes to us, as data controller: Bedzzle handles it on our behalf, as the provider of the engine and of the property management system. Payment details go through the payment networks connected to the engine. The engine has its own cookie banner, which does not know the choice made here. Bedzzle runs two Google Analytics on it at the same time: ours, to which it sends the engine’s events (pages viewed, searches with dates and number of people, rooms chosen, booking with amount and number), and one of its own, which receives the same events and the address of the engine page, including our identifiers if the link carried them. If you refuse Bedzzle’s banner, the two Google Analytics still receive cookieless signals: that is Bedzzle’s choice. In Bedzzle’s Google Analytics, on 1 October 2026, the setting that automatically collects the email, phone number and address written on the pages was switched on: we have not been able to verify whether anything is sent, or what. For its own Google Analytics and its other tools of its own, Bedzzle decides, as an independent controller, under its own privacy notice: we cannot switch them off from here. On the engine there is also a Google Tag Manager container of ours: a Google Ads conversion linker and a booking event for our Google Analytics, which follow the choice made on Bedzzle’s banner, and the signal described below.

On the way from the site to the engine, only if you gave a consent, the link carries our visit identifier ps_vid; only with statistics also the campaign parameters you arrived with and Google Analytics’ technical identifier _gl, which is there to recognise the same visit on both sites and not count it twice, plus the visit’s two pseudonymous Google Analytics identifiers (ga_cid and ga_sid), with which we tie the booking to the visit; only if you also consented to marketing does it carry the advertising click identifier (gclid or equivalents). Without consent the link is exactly what you read in the address, with nothing added. In no case does the link pass on to Bedzzle the data you typed in our forms.

If you reached the engine with our ps_vid identifier — that is, if you gave a consent on our site — when the booking is confirmed a tool we have installed on the engine sends a short signal to our server: the booking number, ps_vid, the Google Analytics transaction number, the arrival date, the number of nights, the amount, the currency and the country. This way the booking number is linked to the visit on our site it started from. The signal carries no name, email, telephone, address or payment data; of the other data that come with it, such as the IP address or advertising click identifiers, we keep nothing. Without ps_vid the signal is not sent. The signal is sent even if you refuse Bedzzle’s cookies on the engine: what counts is the consent you gave on our site, which you can withdraw from the “Cookie preferences” link.

The signal alone does not count as a booking: it becomes one when we find the same number in our property management system. From that system, to measure our channels, we read the bookings of every channel — site, portals, telephone — and only this data: booking number, internal code, creation and last-modified dates, arrival and departure dates, number of rooms, amount and currency, status, source channel and country. Never names, contact details, notes, documents or payment data. Legal basis for this reading: our legitimate interest in knowing how much each channel brings in (art. 6(1)(f)); you can object by writing to info@palazzoscotto.com. Legal basis for linking the booking to your visit on the site: the consent you gave on our site (art. 6(1)(a)), which you can withdraw at any time from the “Cookie preferences” link.

Like every site, ours receives the data your browser is bound to send when it asks for a page: IP address, browser and operating system type, address of the page requested, date and time, outcome of the request. Netlify, Inc., the provider that hosts the site, keeps it for a limited period in the technical logs.

It exists to make the site work, to defend it against abuse and to diagnose faults. We do not use it to identify you and we do not cross-reference it with your enquiries. Legal basis: our legitimate interest in the security and correct working of the service (art. 6(1)(f)).

Anonymous count of arrivals. When you arrive on the site from another site or from a link, our server — not your browser — adds 1 to a daily counter with: the day, the language, the landing page without parameters, the name of the referring site, the campaign parameters of the address (utm) and a yes or no on whether an advertising click identifier from Google, Meta or Microsoft is present, never the code itself. It reads and writes nothing on your device, uses no cookies or identifiers, and does not store your IP address, the browser type or the time; it looks at the browser type for an instant only so as not to count robots. The counter does not know who you are and cannot tell two people apart. We do this even if you refuse cookies, to know how many arrivals our campaigns really bring. Legal basis: our legitimate interest in measuring the channels anonymously (art. 6(1)(f)). The counts are kept in our register at Supabase, Inc., on servers in the European Union (Ireland), for 14 months.

We do not sell and we do not pass on your data to anyone. It is known to the authorised staff of the company — for the rooms and, within the limits described in “Who handles the data”, for the NOS restaurant, which is a brand of the same company and not an external recipient — and to the suppliers who help us deliver the service, appointed data processors where the law requires it and bound to handle it only on our instructions.

• TITANKA! S.p.A. — the Mr PRENO service, where stay enquiries arrive, and its reporting service Mr REPORT, which reads the site and campaign statistics on our behalf
• Netlify, Inc. — hosts the site, handles submission of the travel trade form and holds the register of consent receipts
• Supabase, Inc. — holds, on servers in the European Union (Ireland), the register of visits and bookings with which we measure our channels, and the anonymous counts of arrivals
• Bedzzle — the booking engine and the property management system, which handle the booking data on our behalf; for its own Google Analytics and its other tools of its own on the engine, Bedzzle is an independent controller
• Cloudflare, Inc. — protects the encrypted connection between our property management system and the site, through which the booking measurement data passes (never names or contact details)
• Google — only with your consent: Google Analytics (statistics, with the daily copy in BigQuery on Google Cloud, in the European Union), Google Ads (marketing) and enhanced conversions; the Google Maps map only if you open it with a click
• Meta Platforms Ireland Limited — only with your marketing consent, the pixel that measures campaigns on Facebook and Instagram; joint controller for collecting and transmitting the data, then independent controller
• Advisers, professionals and IT service providers, each within the limits of their engagement
• Public authorities, where a rule of law obliges us

Some of the suppliers listed above are based, or rely on infrastructure, outside the European Economic Area — the United States in particular. In those cases the transfer takes place on the safeguards set out in Chapter V of the Regulation: an adequacy decision of the European Commission, or standard contractual clauses. For Google, Meta and Cloudflare the transfer to the United States relies on the European Commission’s adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework), for certified companies; for Netlify and Supabase, which keep the site’s data on servers in Europe but are US companies, on the standard contractual clauses in their data processing agreements.

You can ask us for the current list of suppliers and a copy of the safeguards applied by writing to info@palazzoscotto.com.

We keep data for as long as the purpose we collected it for requires, and no longer. Then we delete it or make it anonymous.

• Stay enquiries and travel trade requests: for the duration of the negotiation and, if the stay goes ahead, for the length of the relationship and the periods the law imposes for tax and evidential purposes
• Cookie choice: six months, after which the question comes back
• Consent receipts: five years from the choice, then automatic deletion; the ps_consent_id code stays in your browser until you clear the site data
• Visit identifier and arrival data: without consent only in the memory of the open page, until you reload or close it; with consent 90 days
• Register of visits and bookings for channel measurement: 14 months, then deletion; automatic deletion will be active by 5 November 2026, before any data reaches 14 months
• Anonymous counts of arrivals: 14 months, then automatic deletion
• Google Analytics: 14 months; daily copy in BigQuery: 14 months, with the automatic expiry to be set by 30 November 2026; _ga cookies up to 2 years, Google Ads cookies 3 months, _fbp and _fbc cookies 90 days
• Monthly internal group report: numbers only; the working files used for counting are deleted once the calculation is done
• Server technical logs: for the limited period set by Netlify, Inc.

At any time you can ask us for access to your data, its rectification or erasure, restriction of processing and portability; you can object to processing based on legitimate interest (articles 15 to 22 of the Regulation). Where processing is based on consent, you can withdraw it whenever you like.

To exercise these rights, write to info@palazzoscotto.com. We answer within one month, as the Regulation provides; if the request is complex we may take two months more, telling you so.

If you think something is wrong, you can lodge a complaint with the Italian Data Protection Authority or with the supervisory authority of the country where you live or work.

Italian Data Protection Authority

If the tools we use or the purposes we handle data for change, we update this page and change the date you read at the top. It is worth re-reading now and then.