Privacy and cookies

Data controller

Tuscany Highfield SRLS, which runs Casal Sant’Elena, Via dei Carmignani 19, Località Spianate, 55011 Altopascio (LU), Italy. For any privacy question write to [email protected].

When you contact us

If you write to us by email or WhatsApp, or call us, we use your name, contact details and what you tell us only to answer you and organise your stay. We keep them as long as needed to handle the request and the stay and to meet legal obligations (for example tax and guest registration rules). WhatsApp is a Meta service: if you choose it, its terms apply as well.

When you request a quote

Which data. Name, email, phone number if you give it, dates, number of guests, preferred room, type of request and your message. With the request we also save where you came from, if your browser tells us: the page of the site from which you opened the form, any campaign parameters in the link (utm) and only the name of the external site you came from (for example a search engine or an AI assistant). We do not save your IP address.

Why. To answer you with an offer and, if you then book, to organise your stay. The legal basis is your request for information before a possible contract. We do not use these details for newsletters or advertising.

Where it goes. The request is saved in an archive on Cloudflare servers (Cloudflare D1 database), so it is not lost even if the email does not arrive. An email notifies us, delivered by Cloudflare Email Routing to our Gmail mailbox. To handle it we copy it into a private Google Sheets spreadsheet, accessible only to us, where we note the status of our reply (for example replied, quote sent, booked).

How long. At most 24 months from when you send it: after that the request is deleted automatically from the archive and from the spreadsheet. If you book, the stay data follows the timing of the booking and of legal obligations.

Spam protection. The form uses Cloudflare Turnstile, which checks that a person is filling it in by looking at technical data from the browser and the IP address, without advertising cookies. We also count the requests sent from the same IP address over a few minutes; the count deletes itself after about 20 minutes. The legal basis is our interest in protecting the site from abuse.

When you book

Online booking takes place on the page casalsantelena.bookpage.io, run by Smartness (CiaoBooking), the system we use for reservations. The data you enter there (name, contact details, any payment) is used to confirm and manage your booking; that page has its own cookie banner and privacy notice. This site shows availability and prices by reading them from CiaoBooking: it sends only dates and number of guests, no personal data. If you have accepted statistics, the “Book” link carries the random code Google Analytics uses to recognise your browser (not your name or your email), so we can connect the visit to the site with the booking.

AI assistants and automated tools

The site offers automated programs and AI assistants an availability API and an MCP server, which answer with prices, availability and information about the property. They receive only dates and number of guests, never personal data, and we do not keep the questions. To limit abuse we count calls per IP address for a couple of minutes. We also keep an aggregated log of visits by crawlers and AI agents recognised by the program name (Cloudflare Workers Analytics Engine): only the bot name and the page, without IP addresses, cookies or data about people.

Cookies and statistics

The site uses a single technical cookie, cc_cookie, which remembers your cookie choice for 6 months: it is necessary and is not used to track you.

Only if you accept statistics in the banner do we load Google Tag Manager and Google Analytics 4. We measure the pages visited, where visits come from (including AI assistants), clicks on “Book” and on the contact links, and the successful sending of a quote request. For the latter Google receives only dates, number of guests, room and type of request, never name, email, phone number or message. Google Analytics uses the cookies _ga and _ga_* (up to 2 years); the data in Google Analytics is kept for 14 months. Only if you also accept marketing may Google use the data to measure advertising campaigns (cookies _gcl_*). The legal basis is your consent.

Without consent the site loads no Google tools and sends no data to Google. You can change your mind at any time with the “Cookie preferences” link at the bottom of every page: if you withdraw consent, the Google Analytics cookies are deleted.

Providers and transfers outside the EU

These providers process data on our behalf:

• Cloudflare, Inc. hosts the site and its functions, keeps the archive of quote requests, delivers the notification emails to us, runs the Turnstile check and the anti-abuse count. For security it processes the IP address of visitors.
• Google (Google Ireland Limited and Google LLC): our Gmail mailbox, the Google Sheets spreadsheet in which we handle requests and, only with your consent, Google Tag Manager and Google Analytics.
• Smartness (CiaoBooking) for reservations (see above).

Cloudflare and Google are based or have servers in the United States too: transfers take place under the EU-US Data Privacy Framework, which both have joined, and the standard contractual clauses of the European Commission.

Other external services: MET Norway provides the weather forecast on the Contact page, requested by our server without any data about visitors. Links to Google Maps and WhatsApp take you to external services only when you open them; the site does not embed maps.

Your rights

You can ask us to access, correct or delete your data, to restrict or object to its use, to receive it in a readable format, and you can withdraw your cookie consent at any time. Write to [email protected]. You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

Last updated: 3 November 2026.