View from Castello Carlazzo over the valley towards Lugano
Legal

Privacy Policy

How Workation Castle collects, uses and protects your personal data under the EU General Data Protection Regulation (GDPR).

This policy explains what personal data Workation Castle processes when you visit this website, book a stay or complete your guest check-in, why we process it, and the rights you have. It reflects the data processing actually carried out by this website.

Contents

1. Who is responsible (data controller)

The controller responsible for the processing of your personal data is Workation Castle s.r.l., Via Giuseppe Parini 2, 20121 Milano, Italy. For any privacy request, contact us at info@workationcastle.com. Full company details are in our Imprint.

2. What we collect and why

Server log files

When you visit this website, our hosting provider automatically records technical data in server log files: your IP address, browser type and version, the referring page, and the date and time of the request. This data is necessary to deliver the site securely and reliably, and to detect and prevent abuse. It is not used to identify you personally.

Cookies and consent

We use a small number of cookies. A strictly necessary cookie remembers your consent choices (it is set the first time you make a choice in our consent banner and is kept for up to one year). Non-essential technologies — analytics and embedded third-party content — are only loaded after you opt in through the consent banner. You can change or withdraw your choices at any time via the “Cookie settings” link in the site footer.

Analytics

Subject to your consent, we use PostHog to understand how the site is used so we can improve it. PostHog is configured to process data on EU-based infrastructure (eu.i.posthog.com). Analytics are only loaded if you accept the analytics category in the consent banner; if you do not, no analytics data is collected.

Embedded maps

Some pages (for example the arrival guide and activities) embed maps from Komoot and Google Maps. These embeds are blocked until you allow them through the consent banner. Once loaded, the provider receives your IP address and may set its own cookies; please see the respective provider’s privacy policy.

Booking and availability

The availability and booking function on this site forwards you to our booking partner, Holidu (holiduhost.com). Any data you enter to make a booking is processed by that provider under its own privacy policy; we receive booking and contact details from them in order to host your stay.

Guest check-in and registration with the authorities

To complete your stay, our online check-in form collects, for each guest: first and last name, date and city of birth, city of residence, nationality, gender, and the type and number of an identity document (identity card, driver’s licence or passport). We are legally required to record this information and to forward it to the Italian State Police (Questura) via the “Alloggiati Web” system, in accordance with Article 109 of the Italian Consolidated Public Security Act (TULPS). Providing this data is a legal requirement for staying with us; without it we cannot lawfully accommodate you. The data is stored securely and is accessible only to authorised staff.

Contacting us

If you contact us by email, we process the information you provide (such as your name, email address and the content of your message) solely to handle your enquiry.

We process personal data under the following legal bases of Article 6(1) GDPR: consent (Art. 6(1)(a)) for analytics and embedded third-party content; performance of a contract (Art. 6(1)(b)) for handling bookings and your stay; legal obligation (Art. 6(1)(c)) for the guest registration transmitted to the Italian authorities; and our legitimate interests (Art. 6(1)(f)) in operating a secure, reliable website and answering enquiries.

4. Who receives your data

We share personal data only where necessary: with our website hosting provider; with PostHog for analytics (only with your consent); with Komoot and Google for embedded maps (only with your consent); with our booking partner Holidu; and with the Italian State Police, as required by law for guest registration. These providers act as our processors or as independent controllers under their own policies. We do not sell your personal data.

5. How long we keep it

We keep personal data only as long as necessary for the purpose it was collected for, or as required by law. Server log files are kept for a short period for security and then deleted. Guest registration data is retained for the period required by Italian public-security law. Booking and accounting records are kept for the period required by Italian tax law (generally ten years). Analytics data is retained only in aggregated form.

6. Your rights

Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, and to data portability. Where processing is based on consent, you may withdraw that consent at any time without affecting prior processing. To exercise any of these rights, contact us at info@workationcastle.com.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

7. Children

This website is not directed at children. We do not knowingly collect personal data from children other than the guest registration details lawfully provided by a parent or guardian on their behalf as part of a booking.

8. Changes to this policy

We may update this policy to reflect changes to our practices or legal requirements. The current version is always available on this page.