How we handle your data

The data controller is PALAZZO SCOTTO - S.R.L. For anything concerning your data you can write to info@palazzoscotto.com or call +39 080 4324431: the same reception that welcomes you on arrival answers.

• Company name: PALAZZO SCOTTO - S.R.L.
• Address: Corso Trieste e Trento 30, 70011 Alberobello (BA), Italy
• Tax code and VAT number: 07751560728 — REA BA-579682
• Email: info@palazzoscotto.com — Phone and WhatsApp: +39 080 4324431

On every page of the site, above the footer, there is the form for asking us for a quote. Filling it in leaves us your first name, surname, email address, telephone number, arrival and departure dates, the treatment and the room you are interested in, the number of people and whatever requests you want to add.

If you consented to statistics, a few details about how you got here travel alongside the enquiry: the landing page, where you came from — a search engine or another site, for instance —, any campaign parameters present in the address and Google Analytics’ two pseudonymous identifiers, cid (which tells one browser from another) and sid (which identifies the visit), so the enquiry is joined back to the visit that produced it. With any consent (statistics or marketing) our visit identifier ps_vid travels too; if you consented to marketing, so do the advertising click identifier (gclid or equivalents) and the identifiers in Meta’s format (fbp, fbc). If you have not chosen or you refused, the enquiry goes out with only the data you typed in the form. These details do not identify you on their own, but they are attached to your enquiry and must therefore be read together with it. They exist so we can tell which channels actually work.

The form is the Mr PRENO service by TITANKA! S.p.A., which we use as the house CRM: the enquiry arrives there and reception answers you from there. TITANKA! S.p.A. handles this data on our behalf, as data processor.

Legal basis: steps taken at your request before entering into a contract (art. 6(1)(b)). Without this data we cannot prepare a quote for you.

The Mr PRENO privacy notice

On the page for travel agencies it is possible to request our sales kit. That form collects the agency name, the IATA number, the country, the email address and the message.

Submission goes through the forms service of Netlify, Inc., the provider that hosts the site, and generates a notification to info@palazzoscotto.com, where reception checks the request and answers by hand. There is no private area and no automatic unlocking.

Legal basis: pre-contractual steps and, for the commercial relationship that follows, our legitimate interest in working with trade intermediaries (art. 6(1)(b) and (f)).

When you arrive on the site, consent is declared denied to Google before anything else and Google’s measurement script loads in cookieless mode (“advanced Consent Mode”). A bar at the bottom asks you to choose; closing it with the X or with Esc counts as a refusal. Until you choose, and if you decline, Google writes no cookies or anything else on your device, but on every page it receives a short cookieless signal that is not anonymous: your IP address (which Google uses for an approximate location), browser and device type, language, date and time, consent status, the page address with any campaign parameters — the ad click identifier included —, the referring page and a temporary identifier that is not stored and changes at every full page load. Google uses them in aggregate form to estimate visits and conversions. Legal basis for these cookieless signals: our legitimate interest in measuring, in aggregate form, how the site and the campaigns perform (art. 6(1)(f)); you can object at any time by writing to info@palazzoscotto.com, and block the signals straight away in your browser with an extension that blocks Google’s scripts.

A few things, however, are created at once, without consent, and stay only in your browser: a random visit identifier (ps_vid), an identifier in the format Meta uses (fbp) and — if you arrived with the fbclid parameter — a second one (fbc), plus the session’s arrival data (landing page, source, campaign parameters, click identifiers). Without consent they live in the browser’s session storage and nowhere else: no cookie, no local storage, none of these identifiers sent to Google, to Meta, to Google Analytics or to our server (the page address reaches Google only in the cookieless signal described above), no decoration of the “Book” link, no conversion and no audience; once the tab is closed, they disappear. If you consent — even after a refusal, in the same session — they are linked to the visit that already took place and from there the consent rules apply: ps_vid becomes a 90-day cookie and travels on the “Book” link and in the enquiry; with marketing, fbp and fbc become the _fbp and _fbc cookies (90 days) with the same values; the arrival data is kept for 90 days. This is our cautious reading of “it stays only with us”: it stays in your browser.

If you consent to statistics we use Google Analytics 4 to know how many people visit the site, which pages they read and which channel they come from. If you also consent to marketing, the same tools measure our advertising campaigns on Google and make it possible to show you relevant ads; in that case Google may link the visit to your Google account, if you have one and have turned on ad personalisation.

With marketing consent, and only on www.palazzoscotto.com, we also load the Meta pixel, the tool Meta uses to measure campaigns on Facebook and Instagram. The pixel sends Meta every page you visit and, if you send us a stay enquiry, the fact that an enquiry was sent: each event carries a random code, the page address including any campaign parameters, the referring page, your IP address, the browser type and the _fbp and _fbc identifiers. The details you type in the form are neither read nor sent to Meta. Meta may link these events to your Facebook or Instagram account, if you have one. For the collection of this data on our site and its transmission to Meta we are joint controllers with Meta Platforms Ireland Limited (art. 26 of the Regulation), under the agreement Meta applies to those who use its tools; what Meta does with the data afterwards is decided by Meta, as an independent controller, under its own privacy policy. Without marketing consent the pixel is not loaded and no request leaves our site for Meta.

If you consented to marketing and you send us a stay enquiry, the email address and telephone number you typed in the form are turned inside your browser into an irreversible fingerprint (SHA-256 hash) and transmitted in that form to Google Ads, which compares it with its own to recognise that the enquiry came from a click on one of our ads (“enhanced conversions”). Google never receives a plain email or telephone number from this site; without marketing consent the form is not even read for this purpose.

For every choice on the bar we keep an anonymous receipt in our consent register, held by Netlify, Inc. (Netlify Blobs service): what you chose for each category, date and time, version and fingerprint of the notice you read, language, page without parameters and a random code called ps_consent_id, which stays in your browser’s local storage until you clear the site data and is not linked to your name, your email or your IP address. The choice itself lives in the ps_consent cookie for six months. The receipt exists to show that consent was asked for and how you answered (art. 7(1)): we keep it for five years from the choice, then an automatic procedure deletes it.

Legal basis for statistics and marketing with cookies: your consent (art. 6(1)(a)). You can withdraw it whenever you like from the “Cookie preferences” link at the foot of every page, as easily as you gave it, and withdrawing does not affect what happened before.

Which cookies we use, one by one

The “Book” button does not open a form of ours: it takes you to the Bedzzle booking engine, on the booking.bedzzle.com domain. From that moment you are on a different site, with its own privacy notice. The data you enter there — payment details included — is handled under the terms of that service, which acts as an independent controller for its own purposes.

On the way from the site to the engine, only if you gave a consent, the link carries our visit identifier ps_vid; only with statistics also the campaign parameters you arrived with and Google Analytics’ technical identifier _gl, which is there to recognise the same visit on both sites and not count it twice, plus the visit’s two pseudonymous Google Analytics identifiers (ga_cid and ga_sid), with which we tie the booking to the visit; only if you also consented to marketing does it carry the advertising click identifier (gclid or equivalents). Without consent the link is exactly what you read in the address, with nothing added. In no case does the link pass on to Bedzzle the data you typed in our forms.

Like every site, ours receives the data your browser is bound to send when it asks for a page: IP address, browser and operating system type, address of the page requested, date and time, outcome of the request. Netlify, Inc., the provider that hosts the site, keeps it for a limited period in the technical logs.

It exists to make the site work, to defend it against abuse and to diagnose faults. We do not use it to identify you and we do not cross-reference it with your enquiries. Legal basis: our legitimate interest in the security and correct working of the service (art. 6(1)(f)).

We do not sell and we do not pass on your data to anyone. It is known to the authorised staff of the house and to the suppliers who help us deliver the service, appointed data processors where the law requires it and bound to handle it only on our instructions.

• TITANKA! S.p.A. — the Mr PRENO service, where stay enquiries arrive
• Netlify, Inc. — hosts the site, handles submission of the travel trade form and holds the register of consent receipts
• Google — with your consent, the site statistics, campaign measurement and enhanced conversions; without consent, the cookieless signals described above
• Meta Platforms Ireland Limited — only with your marketing consent, the pixel that measures campaigns on Facebook and Instagram; joint controller for collecting and transmitting the data, then independent controller
• Advisers, professionals and IT service providers, each within the limits of their engagement
• Public authorities, where a rule of law obliges us

Some of the suppliers listed above are based, or rely on infrastructure, outside the European Economic Area — the United States in particular. In those cases the transfer takes place on the safeguards set out in Chapter V of the Regulation: an adequacy decision of the European Commission, or standard contractual clauses.

You can ask us for the current list of suppliers and a copy of the safeguards applied by writing to info@palazzoscotto.com.

We keep data for as long as the purpose we collected it for requires, and no longer. Then we delete it or make it anonymous.

• Stay enquiries and travel trade requests: for the duration of the negotiation and, if the stay goes ahead, for the length of the relationship and the periods the law imposes for tax and evidential purposes
• Cookie choice: six months, after which the question comes back
• Consent receipts: five years from the choice, then automatic deletion; the ps_consent_id code stays in your browser until you clear the site data
• Visit identifier and arrival data: without consent only in the browser’s session storage, until the tab is closed; with consent 90 days
• Statistical data: according to the retention periods set on the measurement tools
• Server technical logs: for the limited period set by Netlify, Inc.

At any time you can ask us for access to your data, its rectification or erasure, restriction of processing and portability; you can object to processing based on legitimate interest (articles 15 to 22 of the Regulation). Where processing is based on consent, you can withdraw it whenever you like.

To exercise these rights, write to info@palazzoscotto.com. We answer within one month, as the Regulation provides; if the request is complex we may take two months more, telling you so.

If you think something is wrong, you can lodge a complaint with the Italian Data Protection Authority or with the supervisory authority of the country where you live or work.

Italian Data Protection Authority

If the tools we use or the purposes we handle data for change, we update this page and change the date you read at the top. It is worth re-reading now and then.