How we handle your data

The data controller is PALAZZO SCOTTO - S.R.L. For anything concerning your data you can write to info@palazzoscotto.com or call +39 080 4324431: the same reception that welcomes you on arrival answers.

PALAZZO SCOTTO - S.R.L. is a single company with two brands: Palazzo Scotto, the rooms on this site, and NOS Ristorante (www.nosristorantealberobello.com). The controller is the same for both, with the same VAT number: between the two brands the data does not pass to another company. “F.lli Scotto S.r.l.”, which you may find in older documents, is the former name of the same company.

The controller uses the data from the two sites together for two purposes only. The first is measuring the group, that is, how many people know the rooms, the restaurant or both: for visits we do this only with your consent to statistics, also with a Google Analytics property shared by the two sites once it is active, which is not linked to any advertising account. The second is a monthly internal report, read only by the management, which compares the guests of the rooms and the customers of the restaurant in numbers only, for example how many guests dined at NOS. To count, we compare the bookings of the two businesses within our own systems; the report keeps only the numbers, with no names, contact details or profiles, and the working files are deleted once the calculation is done. Legal basis for the report: our legitimate interest in organising the service and the hospitality of the two businesses (art. 6(1)(f)); you can object by writing to info@palazzoscotto.com. We do not use one brand’s advertising identifiers on the other brand’s site: on this site there is no advertising tool of NOS, and on the NOS site none of Palazzo Scotto.

• Company name: PALAZZO SCOTTO - S.R.L.
• Address: Corso Trieste e Trento 30, 70011 Alberobello (BA), Italy
• Tax code and VAT number: 07751560728 — REA BA-579682
• Email: info@palazzoscotto.com — Phone and WhatsApp: +39 080 4324431

On every page of the site, above the footer, there is the form for asking us for a quote. Filling it in leaves us your first name, surname, email address, telephone number, arrival and departure dates, the treatment and the room you are interested in, the number of people and whatever requests you want to add.

Along with the enquiry there always travel a few details about how you got here, even if you have not chosen or you have declined: the landing page, the time you arrived on the site, the site you came from and the campaign parameters in the address (utm). Without consent to statistics they are those of the current visit, read from the memory of the open page without writing anything to your device, and of the site you came from only the name is sent. They leave only when you send the enquiry. They exist so we can tell which channels bring enquiries. Legal basis: our legitimate interest (art. 6(1)(f)). You can object at any time by writing to info@palazzoscotto.com. If you have not given consent, the “Do not record my visits” link stops the visit register and the visit code on the “Book” link; in any case it does not stop the details that travel with the enquiry. They stay with the enquiry, for the time given in “How long we keep the data”. If you consented to statistics, the data of your last visit that came from another site apply instead, even from a few days earlier (up to 90 days), with the full address of the referring site; there also travel, if there is one, your first visit of the last 42 days and Google Analytics’ two pseudonymous identifiers, cid (which tells one browser from another) and sid (which identifies the visit). With any consent (statistics or marketing) our visit identifier ps_vid travels too. Only if you consented to marketing do the advertising click identifier (gclid or equivalents) and the identifiers in Meta’s format (fbp, fbc) travel as well; without that consent the enquiry carries no click code and nothing goes from our site to Google Ads. These details do not identify you on their own, but they are attached to your enquiry and must therefore be read together with it.

The form is the Mr PRENO service by TITANKA! S.p.A., which we use as the house CRM: the enquiry arrives there and reception answers you from there. TITANKA! S.p.A. handles this data on our behalf, as data processor. The form also has an optional box to subscribe to the newsletter: the subscription is based on your consent (art. 6(1)(a)), is recorded in Mr PRENO and you can withdraw it whenever you like, including by writing to info@palazzoscotto.com.

Legal basis: steps taken at your request before entering into a contract (art. 6(1)(b)). Without this data we cannot prepare a quote for you.

The Mr PRENO privacy notice

On the page for travel agencies it is possible to request our sales kit. That form collects the agency name, the IATA number, the country, the email address and the message.

Submission goes through the forms service of Netlify, Inc., the provider that hosts the site, and generates a notification to info@palazzoscotto.com, where reception checks the request and answers by hand. There is no private area and no automatic unlocking.

Legal basis: pre-contractual steps and, for the commercial relationship that follows, our legitimate interest in working with trade intermediaries (art. 6(1)(b) and (f)).

When you arrive on the site, before anything else the site sets every consent to “denied” within the page, and it loads neither Google’s tools nor Meta’s. A bar at the bottom asks you to choose; closing it with the X or with Esc counts as a refusal. Until you choose, and if you decline, no request leaves this site for Google Analytics, Google Ads or Meta: no cookie and no signal, not even a cookieless one. One page is the exception, the one on Christmas in Locorotondo, which shows three public Instagram posts: Meta also receives the address of the page (see “Embedded third-party content” on the Cookies page). Until 7 October 2026, by contrast, Google received even without consent a short cookieless signal with IP address, browser and page (“advanced Consent Mode”); from 8 October 2026 it no longer does.

Before you choose, the site keeps in the memory of the open page (not in cookies or in any other browser storage) a random visit code (ps_vid), an identifier in the format Meta uses (fbp) and, if you arrived with the fbclid parameter, a second one (fbc), plus the arrival data: landing page, source, campaign parameters and click identifiers. Even if you have not chosen, or if you decline, and unless you have objected with the “Do not record my visits” link, we send to our server only these: ps_vid, the start time and the sending time, the language, the consent choices, the landing page without parameters, the campaign parameters (utm) and the Google advertising click identifier (gclid, gbraid, wbraid). They go into the visit register described below. fbp, fbc and fbclid never leave the page. No request leaves this site for Google, Google Analytics or Meta. One page is the exception, the one on Christmas in Locorotondo, which shows three public Instagram posts: Meta also receives the address of the page (see “Embedded third-party content” on the Cookies page). The “Book” link carries to the booking engine only ps_vid, without campaign parameters or click identifier (see “Booking direct”). Without any consent, the stay enquiry is the exception: if you send it, it carries to Mr PRENO the landing page, the time you arrived on the site, the source (of the site you came from, only the name) and the campaign parameters of this visit, but not the random visit code, the identifiers in Meta’s format or the click codes (see “The enquiry form”). If you reload or close the page, the copies in your browser disappear; the row in our register stays for the time given further down. If you consent (even after a refusal, as long as the page is open) the data is linked to the visit that already took place and from there the consent rules apply: ps_vid becomes a 90-day cookie and also travels in the stay enquiry, besides the “Book” link; with marketing, fbp and fbc become the _fbp and _fbc cookies (90 days) with the same values; the arrival data is kept for 90 days.

For the visits of people who have not objected with the “Do not record my visits” link, even if you have not chosen or if you decline, our visit register — held by Supabase, Inc. on servers in the European Union (Ireland) — records, as a rule once per visit and on arrival: the ps_vid code, the start time and the recording time, the language, the consent choices, the landing page without parameters, the campaign parameters (utm) and, if the address carried it, the Google advertising click identifier (gclid, gbraid, wbraid). Only with consent to statistics does it also record the name of the referring site; only with consent to marketing the identifiers in Meta’s format (fbp, fbc). It contains no first name, surname, email, telephone number or IP address, and we do not record the browser type. The click identifier identifies the click on the advertisement; ps_vid is a random code that tells one visit from another. We treat both as personal data, because they are online identifiers. They serve to understand which advertisements and which channels bring enquiries and bookings. Legal basis: our legitimate interest in measuring our campaigns (Article 6(1)(f)). We have weighed this interest against your rights. For us it matters to spend the advertising budget where it brings bookings. For you the weight is small: the register has no contact details and no IP address, the click identifier is deleted after 90 days and the visit row after 14 months, the data stays on servers in the European Union, and neither the click identifier nor the campaign parameters go to Google or Meta without your consent. We therefore consider that our interest does not unduly restrict your rights. You can object at any time in any case: see “Your rights”. Linking the visit to the stay enquiry, and any sending to Google or Meta, remain based on your consent. Linking to the booking on the engine happens with ps_vid alone even without consent, on the same legitimate interest and only in our register (see “Booking direct”). If you withdraw consent to marketing from the “Cookie preferences” link, the visit continues with a new code, without consent to marketing: we send nothing to Google. Withdrawal does not delete the rows already recorded, to which you can object. One page is the exception, the one on Christmas in Locorotondo, which shows three public Instagram posts: Meta also receives the address of the page (see “Embedded third-party content” on the Cookies page).

If you consent to statistics, we load Google Analytics 4 to know how many people visit the site, which pages they read and which channel they come from. It receives the pages viewed, the clicks on phone, email, WhatsApp and on the “Book” button, the sending of an enquiry, your IP address (which Google uses for an approximate location and states that it does not store), the browser and device type, and it writes the _ga cookies. In Google Analytics the data stays for 14 months; a daily copy goes to our Google Cloud project (BigQuery, servers in the European Union): the export started on 14 September 2026 and has no automatic expiry yet; we will set it to 14 months by 30 November 2026, before any data reaches that age. If you also consent to marketing, we load Google Ads, which measures our campaigns and makes it possible to show you relevant ads, and Google Analytics may use Google Signals: if you have a Google account with ad personalisation turned on, Google can link the visits made from different devices, and in our reports we see only aggregated data. Our Google Analytics property is linked to our Google Ads account. Without consent to marketing, Google Ads receives nothing, even if you have accepted statistics.

With marketing consent, and only on www.palazzoscotto.com, we also load the Meta pixel, the tool Meta uses to measure campaigns on Facebook and Instagram. The pixel sends Meta every page you visit and, if you send us a stay enquiry, the fact that an enquiry was sent: each event carries a random code, the page address including any campaign parameters, the referring page, your IP address, the browser type and the _fbp and _fbc identifiers. The details you type in the form are neither read nor sent to Meta. Meta may link these events to your Facebook or Instagram account, if you have one. For the collection of this data on our site and its transmission to Meta we are joint controllers with Meta Platforms Ireland Limited (art. 26 of the Regulation), under the agreement Meta applies to those who use its tools; what Meta does with the data afterwards is decided by Meta, as an independent controller, under its own privacy policy. Without marketing consent the pixel is not loaded and no request leaves our site for Meta. One page is the exception, the one on Christmas in Locorotondo, which shows three public Instagram posts: Meta also receives the address of the page (see “Embedded third-party content” on the Cookies page).

Only on the page “Christmas in Locorotondo: where to stay” we show three public Instagram posts, using Instagram’s official embed tool. They load while you scroll the page, when you reach the section on Locorotondo, without asking you to choose first: Meta Platforms Ireland Limited, which runs Instagram, receives your IP address, your browser data and the address of the page, and may read and write its own cookies on its own domains, under its own privacy notice. To avoid this, simply do not open that page. Legal basis: our legitimate interest in showing these public posts about Christmas in Locorotondo (art. 6(1)(f)).

If you consented to marketing and you send us a stay enquiry, the email address and telephone number you typed in the form are turned inside your browser into an irreversible fingerprint (SHA-256 hash) and transmitted in that form to Google Ads, which compares it with its own to recognise that the enquiry came from a click on one of our ads (“enhanced conversions”). Google never receives a plain email or telephone number from this site; without marketing consent the form is not even read for this purpose.

If you have consented to marketing and arrived from a click on one of our Google advertisements, after the booking an automatic procedure on our server may tell Google Ads that the booking took place. It sends: the advertising click identifier (gclid, gbraid or wbraid), the date and time of the booking, the booking number, the amount, the currency and the indication that consent was given. It does not send name, email, telephone, address or payment data. We do this to measure which advertisements bring bookings; Google uses this data under its own privacy notice. Legal basis: your consent to marketing (Article 6(1)(a)). Our register keeps the click identifier even if you have not consented, but without your consent to marketing we do not send it to Google. If you withdraw consent to marketing before pressing “Book”, the link carries a new visit code, without consent to marketing, and we send nothing.

For every choice on the bar we keep a receipt in our consent register, held by Netlify, Inc. (Netlify Blobs service): what you chose for each category, date and time, version and fingerprint of the notice you read, language, page without parameters and a random code called ps_consent_id, which stays in your browser’s local storage until you clear the site data. The receipt does not contain your name, your email or your IP address, but it is not anonymous: the ps_consent_id code is the same one that, if you consented to statistics, accompanies your visit in the visit register. The choice itself lives in the ps_consent cookie for six months. The receipt exists to show that consent was asked for and how you answered (art. 7(1)): we keep it for five years from the choice, then an automatic procedure deletes it.

Legal basis for statistics and marketing: your consent (art. 6(1)(a), and art. 122 of the Italian Privacy Code for what is read from or written to your device). You can withdraw it whenever you like from the “Cookie preferences” link at the foot of every page, as easily as you gave it, and withdrawing does not affect what happened before.

Which cookies we use, one by one

The “Book” button does not open a form of ours: it takes you to Bedzzle’s booking engine, on the booking.bedzzle.com domain. The booking data you enter there comes to us, as data controller: Bedzzle handles it on our behalf, as the provider of the engine and of the property management system. Payment details go through the payment networks connected to the engine. The engine has its own cookie banner, which does not know the choice made here. Bedzzle runs two Google Analytics on it at the same time: ours, to which it sends the engine’s events (pages viewed, searches with dates and number of people, rooms chosen, booking with amount and number), and one of its own, which receives the same events and the address of the engine page, including our identifiers if the link carried them. If you refuse Bedzzle’s banner, the two Google Analytics still receive cookieless signals: that is Bedzzle’s choice. In Bedzzle’s Google Analytics, on 1 October 2026, the setting that automatically collects the email, phone number and address written on the pages was switched on: we have not been able to verify whether anything is sent, or what. For its own Google Analytics and its other tools of its own, Bedzzle decides, as an independent controller, under its own privacy notice: we cannot switch them off from here. On the engine there is also a Google Tag Manager container of ours: a Google Ads conversion linker and a booking event for our Google Analytics, which follow the choice made on Bedzzle’s banner, and the signal described below.

On the way from the site to the engine the link carries our visit identifier ps_vid, a random code, even if you have not given a consent (it does not carry it if you have objected with the “Do not record my visits” link); only with statistics also the campaign parameters you arrived with and Google Analytics’ technical identifier _gl, which is there to recognise the same visit on both sites and not count it twice, plus the visit’s two pseudonymous Google Analytics identifiers (ga_cid and ga_sid), with which we tie the booking to the visit; only if you also consented to marketing does it carry the advertising click identifier (gclid or equivalents). Without consent the link therefore carries only ps_vid, without campaign parameters or click identifier. The engine and the tools that run on it, including our Google Tag Manager container and Bedzzle’s Google Analytics (of which Bedzzle is an independent controller), can read this code; on its own it does not say who you are. In no case does the link pass on to Bedzzle the data you typed in our forms.

If you reached the engine with our ps_vid identifier — that is, almost always, unless you have objected with the “Do not record my visits” link — when the booking is confirmed a tool we have installed on the engine sends a short signal to our server: the booking number, ps_vid, the Google Analytics transaction number, the arrival date, the number of nights, the amount, the currency and the country. This way the booking number is linked to the visit on our site it started from. The signal carries no name, email, telephone, address or payment data; of the other data that come with it, such as the IP address or advertising click identifiers, we keep nothing. Without ps_vid the signal is not sent. The signal is sent even if you refuse Bedzzle’s cookies on the engine: the signal is ours and does not depend on Bedzzle’s banner. If you have not given a consent on our site it rests on our legitimate interest (Article 6(1)(f)) and you can object; if you have, on your consent, which you can withdraw from the “Cookie preferences” link.

The signal alone does not count as a booking: it becomes one when we find the same number in our property management system. From that system, to measure our channels, we read the bookings of every channel — site, portals, telephone — and only this data: booking number, internal code, creation and last-modified dates, arrival and departure dates, number of rooms, amount and currency, status, source channel and country. Never names, contact details, notes, documents or payment data. Legal basis for this reading: our legitimate interest in knowing how much each channel brings in (art. 6(1)(f)); you can object by writing to info@palazzoscotto.com. Legal basis for linking the booking to your visit on the site: if you gave a consent, that consent (art. 6(1)(a)), which you can withdraw at any time from the “Cookie preferences” link; if you did not, our legitimate interest in knowing which channels bring bookings (art. 6(1)(f)), to which you can object. We count all direct bookings, including those of people who declined cookies. For anyone who has not given consent on our site we read only what the property management system already shows (number, amount, dates, country and source channel) and we link the booking to the visit with ps_vid alone, and so to the channel and campaign you arrived from, but only in our register: we do not send it to Google without your consent to marketing.

Like every site, ours receives the data your browser is bound to send when it asks for a page: IP address, browser and operating system type, address of the page requested, date and time, outcome of the request. Netlify, Inc., the provider that hosts the site, keeps it for a limited period in the technical logs.

It exists to make the site work, to defend it against abuse and to diagnose faults. We do not use it to identify you and we do not cross-reference it with your enquiries. Legal basis: our legitimate interest in the security and correct working of the service (art. 6(1)(f)).

Anonymous count of arrivals. When you arrive on the site from another site or from a link, our server — not your browser — adds 1 to a daily counter with: the day, the language, the landing page without parameters, the name of the referring site, the campaign parameters of the address (utm) and a yes or no on whether an advertising click identifier from Google, Meta or Microsoft is present, never the code itself. It reads and writes nothing on your device, uses no cookies or identifiers, and does not store your IP address, the browser type or the time; it looks at the browser type for an instant only so as not to count robots. The counter does not know who you are and cannot tell two people apart. We do this even if you refuse cookies, to know how many arrivals our campaigns really bring. Legal basis: our legitimate interest in measuring the channels anonymously (art. 6(1)(f)). The counts are kept in our register at Supabase, Inc., on servers in the European Union (Ireland), for 14 months. The counter does not keep the value of the click identifier and does not link it to any visit. That code, if the address carried it, is only in the visit register described in “Statistics and marketing”.

When you write to us on WhatsApp at the Palazzo Scotto number (+39 080 4324431), our register notes only: the date and time of the message, whether it came in or went out, its type (text, photo, voice note), the length of the text, and whether it was delivered and read. We do not save the content of the messages in this register, nor your name.

We never save your number in full: an automatic procedure turns it, with a secret key of ours, into a code that cannot be read back (HMAC-SHA256) and keeps only the last four digits. If you use a WhatsApp username instead of the number, the same treatment applies to the user code that WhatsApp sends us.

We do this to know how many messages arrive, how quickly we reply, and so as not to lose requests. Legal basis: our legitimate interest (art. 6(1)(f)). We do not use this data to send you messages.

The register is kept at Supabase, Inc., on servers in the United Kingdom (London), a country for which the European Commission has recognised an adequate level of data protection; it is separate from the register of the NOS restaurant and from the register of phone calls, and every row is deleted after 13 months. You can object at any time by writing to info@palazzoscotto.com. The messages themselves pass through WhatsApp (Meta Platforms Ireland Limited), which handles them under its own terms.

The Palazzo Scotto number is also used with the WhatsApp Business app on our staff’s phone: when we connect it to our systems, WhatsApp sends us the conversation history of the last six months and a copy of the messages our staff write from the app. For these too we record only the data listed above (never the text, never the full number), in the register in London (United Kingdom, Supabase), for 13 months. The text of the conversations stays in the Palazzo Scotto WhatsApp Business app, on the staff’s linked devices and with WhatsApp. Besides objecting, you can ask us for access, erasure and restriction of processing: to find your row we need the number you wrote from. We reply within one month and you can contact the Italian data protection authority (Garante per la protezione dei dati personali).

We do not sell and we do not pass on your data to anyone. It is known to the authorised staff of the company — for the rooms and, within the limits described in “Who handles the data”, for the NOS restaurant, which is a brand of the same company and not an external recipient — and to the suppliers who help us deliver the service, appointed data processors where the law requires it and bound to handle it only on our instructions.

• TITANKA! S.p.A. — the Mr PRENO service, where stay enquiries arrive, and its reporting service Mr REPORT, which reads the site and campaign statistics on our behalf
• Netlify, Inc. — hosts the site, handles submission of the travel trade form and holds the register of consent receipts
• Supabase, Inc. — holds, on servers in the European Union (Ireland), the register of visits and bookings with which we measure our channels, and the anonymous counts of arrivals
• Bedzzle — the booking engine and the property management system, which handle the booking data on our behalf; for its own Google Analytics and its other tools of its own on the engine, Bedzzle is an independent controller
• Cloudflare, Inc. — protects the encrypted connection between our property management system and the site, through which the booking measurement data passes (never names or contact details)
• Google — only with your consent: Google Analytics (statistics, with the daily copy in BigQuery on Google Cloud, in the European Union), Google Ads (marketing) and enhanced conversions; the Google Maps map only if you open it with a click; only with consent to marketing, also the server-to-server notification of bookings that came from a Google advertisement, described in “Statistics and marketing”
• Meta Platforms Ireland Limited — only with your marketing consent, the pixel that measures campaigns on Facebook and Instagram; joint controller for collecting and transmitting the data, then independent controller
• Meta Platforms Ireland Limited, for the three embedded public Instagram posts on the Christmas in Locorotondo page, which load without a choice from you
• Meta Platforms Ireland Limited, for WhatsApp: the messages you write to the Palazzo Scotto number pass through it, and Meta handles them under its own terms
• Advisers, professionals and IT service providers, each within the limits of their engagement
• Public authorities, where a rule of law obliges us

Some of the suppliers listed above are based, or rely on infrastructure, outside the European Economic Area — the United States in particular. In those cases the transfer takes place on the safeguards set out in Chapter V of the Regulation: an adequacy decision of the European Commission, or standard contractual clauses. For Google, Meta and Cloudflare the transfer to the United States relies on the European Commission’s adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework), for certified companies; for Netlify and Supabase, which keep the site’s data on servers in Europe but are US companies, on the standard contractual clauses in their data processing agreements.

You can ask us for the current list of suppliers and a copy of the safeguards applied by writing to info@palazzoscotto.com.

We keep data for as long as the purpose we collected it for requires, and no longer. Then we delete it or make it anonymous.

• Stay enquiries and travel trade requests: for the duration of the negotiation and, if the stay goes ahead, for the length of the relationship and the periods the law imposes for tax and evidential purposes
• Cookie choice: six months, after which the question comes back
• Consent receipts: five years from the choice, then automatic deletion; the ps_consent_id code stays in your browser until you clear the site data
• Visit identifier and arrival data in your browser: without consent only in the memory of the open page, until you reload or close it; with consent 90 days; the exception is what travels with a stay enquiry you send, which stays with the enquiry (see “The enquiry form”)
• Register of visits and bookings for channel measurement: 14 months, then deletion; the advertising click identifier (gclid, gbraid, wbraid) is deleted 90 days after the visit and the row stays without that code; automatic deletion will be active by 5 November 2026, before any data reaches 90 days or 14 months
• Anonymous counts of arrivals: 14 months, then automatic deletion
• Google Analytics: 14 months; daily copy in BigQuery: 14 months, with the automatic expiry to be set by 30 November 2026; _ga cookies up to 2 years, Google Ads cookies 3 months, _fbp and _fbc cookies 90 days
• Monthly internal group report: numbers only; the working files used for counting are deleted once the calculation is done
• Server technical logs: for the limited period set by Netlify, Inc.

At any time you can ask us for access to your data, its rectification or erasure, restriction of processing and portability; you can object to processing based on legitimate interest (articles 15 to 22 of the Regulation). Where processing is based on consent, you can withdraw it whenever you like.

To exercise these rights, write to info@palazzoscotto.com. We answer within one month, as the Regulation provides; if the request is complex we may take two months more, telling you so.

Objecting to the visit register. You can object at any time to the register of visits and click identifiers, which is based on our legitimate interest (Article 21 of the Regulation). For future visits use the “Do not record my visits” link at the foot of every page: it saves in your browser’s local storage an entry, ps_no_traccia, with only the date of the click, and from then on the site no longer sends your visits without consent to our register and does not add ps_vid to the “Book” link. With “Record my visits again” you remove it. The sign applies only to this browser and only to visits without consent: if you then give a consent, the consent applies, and to stop that too use “Cookie preferences”. If the browser does not let us read local storage, we treat the visit as if you had objected. For visits already recorded, write to info@palazzoscotto.com. The register contains no name, email or telephone number, so to find your row we need the ps_vid code of your visit: if you consented to cookies you can find it in the ps_vid cookie of your browser; if you did not, the code disappeared from your device when the page was closed and we cannot recognise your visit. When we receive the code we delete the row and answer within one month.

If you think something is wrong, you can lodge a complaint with the Italian Data Protection Authority or with the supervisory authority of the country where you live or work.

Italian Data Protection Authority

If the tools we use or the purposes we handle data for change, we update this page and change the date you read at the top. It is worth re-reading now and then.