Privacy Policy

Blick auf ein malerisches Tal mit grünen Wiesen, einem Dorf mit Kirche und dramatischen Bergen im Hintergrund unter klarem Himmel.

Privacy Policy

Last updated: 23 April 2026

Effective from: 23 April 2026

 

1. Data Controller

The controller responsible for the processing of personal data through this website under Regulation (EU) 2016/679 (the "GDPR"), Italian Legislative Decree No. 196/2003 (the Italian Data Protection Code) as amended by Legislative Decree No. 101/2018, and other applicable data protection laws, is:

Taibon Karin KG & Co / S.a.s.

Strada Al Plan Dessora 41

39030 San Vigilio di Marebbe / St. Vigil in Enneberg (BZ)

Italy

VAT number (Partita IVA): IT01473830212

Tax code (Codice Fiscale): IT01473830212

CIN (Italian National Identification Code):

– Hotel Monte Paraccia: IT021047A15MJPMV4X

– Pension Pè de Munt (Garni): IT021047A119HIB3JB

Content Manager (Responsabile del contenuto): Karin Taibon

Phone: +39 0474 501018

Email: info@paraccia.com (or privacy@paraccia.com, once available)

We have not appointed a formal Data Protection Officer (DPO / Responsabile della Protezione dei Dati) because the conditions of Article 37 GDPR and the relevant guidance of the Italian Garante do not apply to our organisation. Please direct all privacy-related enquiries to the contacts above.

 

2. Scope

This Privacy Policy applies to the processing of personal data in connection with:

  • your visit to and use of our website paraccia.com (including all language versions and subdomains)
  • enquiries, reservations and bookings made via the website, email, telephone or in person
  • stays at Hotel Monte Paraccia, at Pension Pè de Munt, and visits to Restaurant Taibon 1885
  • correspondence and interaction with guests and customers

 

3. Principles of Processing

We process personal data lawfully, fairly and in a transparent manner (Article 5(1)(a) GDPR). Data is collected for specified, explicit and legitimate purposes. We process only the data required for each purpose (data minimisation) and retain it only as long as required by law or for the relevant purpose. We employ appropriate technical and organisational measures to secure your data.

 

4. Categories of Data, Purposes, and Legal Bases
4.1 Server Log Data

What we process: Each time our website is accessed, technical information is automatically stored in server log files: IP address, date and time of access, pages visited, data volume transferred, success indicator, browser type and version, operating system, referrer URL.

Purpose: Ensuring a reliable connection, comfortable use of the website, evaluating system security and stability, defending against cyber attacks.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in the secure and functional operation of our website.

Retention: Server log files are deleted or anonymised after 30 days at the latest. In the event of security incidents, until the matter is fully resolved.

4.2 Identification and Contact Data (Enquiries, Bookings, Stays)

What we process: First and last name, date of birth, nationality, identity document data (type, number, place and date of issue — for guest registration only), address, phone number, email address, travel dates, number and details of accompanying guests.

Purpose: Conclusion and performance of the accommodation/restaurant contract (reservation, check-in, invoicing), compliance with statutory reporting obligations (in particular guest registration / schedine alloggiati, tourist tax / imposta di soggiorno, ISTAT statistical reporting), communication with guests before, during and after the stay.

Legal basis:

  • Article 6(1)(b) GDPR (performance of a contract and pre-contractual measures)
  • Article 6(1)(c) GDPR (legal obligation): Article 109 TULPS (Royal Decree 773/1931) — reporting to the local Questura; Presidential Decree 600/1973 and Article 2220 of the Italian Civil Code — tax and accounting retention obligations; local ordinances on tourist tax.

Retention: 10 years from invoice date or end of the business relationship (tax retention under Article 2220 Civil Code). Data from enquiries not resulting in a booking is deleted within 24 months.

4.3 Payment and Financial Data

What we process: Invoicing data, bank details (IBAN, where applicable), payment tokens and transaction references from our payment service providers, transaction history. We do not store full credit card numbers; processing is carried out exclusively by PCI-DSS-certified payment service providers.

Purpose: Processing of deposits, payments and refunds; invoicing; fraud prevention; accounting.

Legal basis: Article 6(1)(b) GDPR (contract performance), Article 6(1)(c) GDPR (tax obligations).

Retention: 10 years from invoice date (Article 2220 Civil Code, Presidential Decree 600/1973).

4.4 Communication Data

What we process: Content of emails, contact form messages, enquiries via OTAs, guest feedback, follow-up correspondence.

Purpose: Handling of enquiries, documentation of correspondence, complaint handling, quality assurance.

Legal basis: Article 6(1)(b) GDPR (pre-contractual measures and contract performance), Article 6(1)(f) GDPR (legitimate interest in documenting business correspondence).

Retention: 24 months from last contact; where a booking is concluded, the retention period under section 4.2 applies.

4.5 Guest Preferences and CRM Data

What we process: Room preferences, dietary requirements and allergies (where voluntarily disclosed), special requests, returning-guest status, stay history.

Purpose: Personalisation of the stay, recognition of returning guests, improvement of our services.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in customer retention and service quality). Health or allergy information is processed only on the basis of your voluntary disclosure (Article 9(2)(a) GDPR), exclusively to deliver the service you requested.

Retention: 3 years from last stay; subsequently deleted or anonymised.

4.6 Business / B2B Data

What we process: Company name, invoicing address, VAT number (Partita IVA), tax code (Codice Fiscale), SDI code or PEC address, contact person, business email.

Purpose: Issuance of electronic invoices (Fattura Elettronica) under Italian law, billing of business travel and corporate dining.

Legal basis: Article 6(1)(b) GDPR, Article 6(1)(c) GDPR.

Retention: 10 years (Article 2220 Civil Code).

4.7 Online Identifiers and Device Information

What we process: IP address, cookie IDs, session IDs, browser type and version, operating system, screen resolution, referrer URL, click behaviour.

Purpose: Delivery of the website, audience measurement, statistical analysis, user experience optimisation.

Legal basis: For strictly necessary cookies, Article 6(1)(f) GDPR (legitimate interest); for non-essential cookies (analytics, marketing), your consent under Article 6(1)(a) GDPR together with Article 122 of the Italian Privacy Code. See our Cookie Policy for details.

Retention: See Cookie Policy (varies by cookie).

4.8 Consent and Legal Records

What we process: Cookie consent logs, acceptance of Terms & Conditions and Privacy Policy, newsletter opt-ins (where applicable), signed booking confirmations.

Purpose: Evidence of consent given, as required by Article 7(1) GDPR.

Legal basis: Article 6(1)(c) GDPR (legal obligation to document consent).

Retention: 10 years (archived alongside the related booking records).

 

5. Sources of Personal Data

We obtain your personal data directly from you when you

  • visit our website and complete forms (contact, booking, newsletter, etc.)
  • make a booking via the embedded HGV booking widget
  • contact us by email, telephone, WhatsApp or fax
  • correspond with us in person or in writing
  • check in or make a reservation at the hotel or restaurant

In addition, we may receive your data from the following legitimate sources:

  • Online Travel Agencies (OTAs): Booking.com, Expedia, HRS and similar platforms transmit the data necessary to fulfil your booking.
  • HGV Booking Südtirol: via the booking widget embedded on our website.
  • Tour operators and tourism associations: for group bookings or package travel.
  • Publicly available sources: in limited cases (e.g. company data from public registers for invoicing).

 

6. Obligation to Provide Data

The provision of certain data is required by law (in particular to comply with guest registration under Article 109 TULPS, tax obligations under Presidential Decree 600/1973, tourist tax reporting and ISTAT statistics) or contractually required (for entering into and performing the accommodation or restaurant contract). Without this data we are unable to fulfil the contract and may be obliged to decline the service.

The provision of other data (e.g. preferences, newsletter subscription) is voluntary and has no adverse consequences.

 

7. Recipients and Disclosure of Your Data

Your data is disclosed only to the following categories of recipients, where necessary to fulfil the stated purposes or where required by law:

7.1 Authorities
  • Police authorities (Questura) — transmission of guest reports (schedine alloggiati) under Article 109 TULPS within 24 hours of arrival
  • Municipality of St. Vigil / San Vigilio di Marebbe — tourist tax (imposta di soggiorno) reporting
  • ISTAT — statistical reporting
  • Italian Revenue Agency (Agenzia delle Entrate) — tax reporting, electronic invoicing (Sistema di Interscambio, SDI)
  • Other authorities within the scope of legal disclosure obligations
7.2 Processors and Service Providers

We rely on carefully selected processors with whom we have concluded data processing agreements under Article 28 GDPR:

  • Hosting and CMS: Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA — provides our website and stores log files. Transfers to the USA are made under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework (where the recipient is certified).
  • Cookie consent management: CookieScript (CookieScript UAB, Vilnius, Lithuania) — manages cookie consents.
  • Web analytics: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics 4, Google Tag Manager). Onward processing by Google LLC (USA) is based on EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
  • Fonts and maps: Google Ireland Limited (Google Fonts, Google Maps).
  • Videos: Google Ireland Limited (YouTube — embedded videos).
  • Booking widget: HGV — Hoteliers and Restaurateurs Association of South Tyrol, Schlachthofstraße 59, 39100 Bozen (IT), and its subprocessors (Booking Südtirol).
  • Payment service providers: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
  • Server infrastructure and automation: Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany — server hosting for internal automation processes (being deployed).
  • Workflow automation: n8n GmbH, Steinheilstraße 10, 85737 Ismaning, Germany — workflow management for booking confirmations and guest communication (being deployed).
  • AI-assisted communication support: Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA — support in drafting replies to guest enquiries (being deployed). Transfers to the USA are based on the EU Standard Contractual Clauses. Only data necessary for the specific enquiry is transmitted, and your data is not used to train AI models.
  • Hotel Property Management System (PMS): [to be specified] — central management of bookings, guest data and invoices.
  • Email and telecommunications providers for our standard business accounts.
  • Tax advisors, lawyers, auditors, where mandated by us and subject to statutory professional secrecy.
  • Online Travel Agencies (OTAs): Booking.com B.V. (Netherlands), Expedia Group (Ireland/USA), HRS GmbH (Germany) and comparable platforms, where you book via their channels.
7.3 Other Recipients

We may disclose data where necessary to protect our legitimate interests (e.g. enforcement of legal claims, defence against claims). We do not sell or rent your data to third parties for marketing purposes.

7.4 Specific Third-Party Services in Detail

The following sections provide additional information on the key third-party services we use.

a) Webflow (Hosting and CMS)

Our website is hosted by Webflow. Provider: Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA.

When you visit our website, Webflow collects various log files including your IP address. Webflow is a tool for building and hosting websites and stores cookies or other recognition technologies necessary to display the page, provide certain features and ensure security.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in reliable delivery of our website). Where consent has been requested, processing is based exclusively on Article 6(1)(a) GDPR; consent may be withdrawn at any time.

Transfer to the USA: European Commission Standard Contractual Clauses and, where certified, EU-US Data Privacy Framework.

Data Processing Agreement: Concluded with Webflow under Article 28 GDPR.

Privacy policy: https://webflow.com/legal/eu-privacy-policy

b) Google Analytics 4 (Web Analytics)

We use the analytics service Google Analytics 4 (GA4). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with onward processing by Google LLC (USA).

GA4 uses cookies and similar technologies to analyse how visitors use our website. The information generated (including truncated IP address, device information, page views, interactions, time on page) is transmitted to Google and evaluated there. We have activated IP anonymisation; the data retention period is limited to 14 months.

Legal basis: Article 6(1)(a) GDPR (consent via the cookie banner) in conjunction with Article 122 of the Italian Privacy Code.

Transfer to the USA: European Commission Standard Contractual Clauses and EU-US Data Privacy Framework (Google LLC is DPF-certified).

Data Processing Agreement: Concluded under Article 28 GDPR.

Opt-out: Browser add-on at https://tools.google.com/dlpage/gaoptout or withdrawal of consent via our cookie banner.

Privacy policy: https://policies.google.com/privacy

c) Google Tag Manager

We use Google Tag Manager to manage our website tags. Provider: Google Ireland Limited. Google Tag Manager itself does not collect personal data but enables the execution of other tags which may in turn collect data. Where the deployed tags trigger non-essential processing, this occurs only after your consent via our cookie banner.

Legal basis: Article 6(1)(f) GDPR for tag management itself; for individual tags, their respective legal basis as disclosed there.

Privacy policy: https://policies.google.com/privacy

d) Google Fonts

We incorporate fonts from the provider Google Ireland Limited ("Google Fonts") on our website. When a page is loaded, the font is retrieved from Google's servers; your browser transmits your IP address to Google in the process.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in a uniform and appealing presentation of our online services).

Transfer to the USA: Standard Contractual Clauses and EU-US Data Privacy Framework.

Privacy policy: https://policies.google.com/privacy

e) Google Maps

We embed maps from "Google Maps" on our website. Provider: Google Ireland Limited. When you access a page containing a map, your IP address is transmitted to Google.

Legal basis: Your consent pursuant to Article 6(1)(a) GDPR via our cookie banner and Article 122 of the Italian Privacy Code.

Transfer to the USA: Standard Contractual Clauses and EU-US Data Privacy Framework.

Privacy policy: https://policies.google.com/privacy

f) YouTube (Embedded Videos)

Our website embeds videos from "YouTube". Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Where possible, we use YouTube's privacy-enhanced mode. In this mode, YouTube only sets cookies once you actively start a video. Nonetheless, when an embedded video is loaded, YouTube may establish a connection to its servers and capture your IP address.

Legal basis: Your consent pursuant to Article 6(1)(a) GDPR (cookie banner).

Transfer to the USA: Standard Contractual Clauses and EU-US Data Privacy Framework.

Privacy policy: https://policies.google.com/privacy

g) HGV Booking Südtirol (Booking Widget)

For direct bookings via our website we use the booking widget of HGV — Hoteliers and Restaurateurs Association of South Tyrol, Schlachthofstraße 59, 39100 Bozen, Italy, and its subprocessors (Booking Südtirol). When you use the widget, the data required for the booking (name, address, contact details, travel dates, payment data where applicable) is transmitted directly to HGV.

Legal basis: Article 6(1)(b) GDPR (pre-contractual measures and contract performance).

Storage location: Italy (EU).

Data Processing Agreement: Concluded under Article 28 GDPR.

Privacy policy: https://www.hgv.it/en/privacy

h) PayPal (Payment Service)

We offer PayPal as a payment method. Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

When you select PayPal as your payment method, the data required for payment processing (including first and last name, address, email, IP address, phone number, payment data) is transmitted to PayPal. PayPal may forward this data to credit agencies for identity and credit verification.

Legal basis: Article 6(1)(b) GDPR (contract performance); Article 6(1)(a) GDPR (consent) insofar as PayPal processes data for credit scoring purposes.

Storage location: Luxembourg (EU); PayPal may transfer data to third countries on the basis of the EU Standard Contractual Clauses.

Privacy policy: https://www.paypal.com/us/webapps/mpp/ua/privacy-full

i) CookieScript (Consent Management)

To lawfully obtain and document your cookie consents, we use the consent management tool CookieScript. Provider: CookieScript UAB, Gedimino av. 20, 01103 Vilnius, Lithuania.

At the moment of consent, CookieScript records your anonymised IP address, a cookie consent identifier, and the date and scope of your consent, in order to provide evidence under Article 7(1) GDPR.

Legal basis: Article 6(1)(c) GDPR (compliance with the obligation of proof under Article 7(1) GDPR).

Storage location: European Union.

Privacy policy: https://cookie-script.com/privacy-policy

j) Contabo (Server Infrastructure) — being deployed

For internal automation processes we use servers provided by Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in efficient operation of our internal systems).

Storage location: Germany (EU).

Data Processing Agreement: Will be concluded under Article 28 GDPR upon commissioning.

Privacy policy: https://contabo.com/en/legal/data-privacy-policy/

k) n8n (Workflow Automation) — being deployed

We use n8n to automate processes such as booking confirmations and guest communication. Provider: n8n GmbH, Steinheilstraße 10, 85737 Ismaning, Germany (or, where self-hosted, on our own infrastructure).

Legal basis: Article 6(1)(b) GDPR (contract performance) and Article 6(1)(f) GDPR (legitimate interest in efficient workflows).

Storage location: Germany or the EU (self-hosted).

Privacy policy: https://n8n.io/legal/

l) Anthropic / Claude (AI-assisted Communication) — being deployed

We use the AI assistant Anthropic ("Claude") to help draft responses to guest enquiries. Provider: Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA.

Only data necessary to respond to the specific enquiry is transmitted to Anthropic. Use of your data to train Anthropic's AI models is contractually excluded under Anthropic's Commercial Terms of Service.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in prompt and high-quality handling of guest enquiries).

Transfer to the USA: Standard Contractual Clauses and, where applicable, EU-US Data Privacy Framework.

Data Processing Agreement: Data Processing Addendum (DPA) under Article 28 GDPR will be concluded upon commissioning.

Privacy policy: https://www.anthropic.com/legal/privacy

 

8. International Data Transfers

Some of our service providers are located in the United States of America (in particular Webflow, Google, PayPal, Anthropic). Transfers of personal data to the USA are made on the basis of one of the following safeguards:

  • Adequacy Decision of the European Commission under the EU-US Data Privacy Framework (Decision of 10 July 2023) for certified recipients
  • Standard Contractual Clauses (SCCs) of the European Commission pursuant to Article 46(2)(c) GDPR

A copy of the applicable safeguards is available on request at info@paraccia.com.

 

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Detailed information on the type, purpose, retention and provider of individual cookies is provided in our Cookie Policy, which is accessible via the cookie banner or the footer link "Cookie settings".

Strictly necessary cookies (e.g. session, cart, consent cookies) are set on the basis of our legitimate interest (Article 6(1)(f) GDPR). For all other cookies (analytics, marketing, external media) we obtain your express consent via our consent banner (Article 6(1)(a) GDPR in conjunction with Article 122 of the Italian Privacy Code). You can withdraw your consent at any time via the cookie settings.

 

10. Your Rights as a Data Subject

Under the GDPR you have in particular the following rights:

  • Right of access (Article 15 GDPR): to request information about whether and which personal data we process about you.
  • Right to rectification (Article 16 GDPR): to request the correction of inaccurate or the completion of incomplete data.
  • Right to erasure (Article 17 GDPR, "right to be forgotten"): to request the deletion of your data, provided no statutory retention obligation or other legal ground prevents deletion.
  • Right to restriction of processing (Article 18 GDPR): to request the restriction of processing under certain conditions.
  • Right to data portability (Article 20 GDPR): to request that we transmit your data in a structured, commonly used, machine-readable format, or transfer it to another controller.
  • Right to object (Article 21 GDPR): to object at any time, on grounds relating to your particular situation, to processing based on a legitimate interest. You can object to processing for direct marketing purposes at any time without giving reasons.
  • Right to withdraw consent (Article 7(3) GDPR): where processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing prior to withdrawal remains unaffected.
  • Right to lodge a complaint (Article 77 GDPR): without prejudice to other remedies, you may lodge a complaint with a supervisory authority.

To exercise your rights, an informal notification to info@paraccia.com is sufficient. We will respond within one month of receipt of your request; this period may be extended by two further months in case of complex or numerous requests (Article 12(3) GDPR).

To protect against misuse, we are entitled to verify your identity by appropriate means.

 

11. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. The authority competent for us is:

Garante per la protezione dei dati personali

Piazza Venezia 11, 00187 Rome, Italy

Web: https://www.garanteprivacy.it

You may also lodge a complaint with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement (e.g. in Germany: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit; in Austria: Datenschutzbehörde; in the UK: Information Commissioner's Office).

 

12. Automated Decision-Making and Profiling

We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

 

13. Minors

Our website and services are not specifically directed at children. For minors under 14 years (pursuant to Article 2-quinquies of the Italian Privacy Code) personal data may only be processed with the express consent of a person with parental responsibility. Where bookings or stays involve minors, we assume that parental consent has been obtained. If we become aware that we have processed a child's personal data without the required consent, we will delete such data without delay.

 

14. Security of Processing

We have implemented appropriate technical and organisational measures (Article 32 GDPR) to protect your data against unauthorised access, loss, misuse, alteration or destruction, in particular:

  • SSL/TLS encryption of all website and email communications
  • Access controls based on the need-to-know principle
  • Regular updates of our systems and software components
  • Confidentiality and data protection obligations for our staff
  • Processor agreements in accordance with Article 28 GDPR
  • Physical security measures on our premises

Despite diligent security precautions, no system can provide complete security against interception during data transmission over the internet.

 

15. Links to External Websites

Our website may contain links to external websites over which we have no control. The content and privacy practices of linked sites are the sole responsibility of their operators. We review external links at the time of inclusion but assume no responsibility for their subsequent development.

 

16. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy where our services change, the legal framework changes, or we adjust our processes. The most recent version is always available at paraccia.com/privacy-policy. We will actively communicate significant changes.

 

17. Contact

For any privacy-related matter, we are at your disposal:

Taibon Karin KG & Co

Strada Al Plan Dessora 41

39030 San Vigilio di Marebbe / St. Vigil in Enneberg (BZ)

Italy

Phone: +39 0474 501018

Email: info@paraccia.com

Web: https://www.paraccia.com

This Privacy Policy has been prepared in accordance with the GDPR (Regulation (EU) 2016/679), the Italian Data Protection Code (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018), the Italian Consolidated Law on Public Security (TULPS), and other applicable legal provisions.