© 2026 Villa Malvasio - All rights reserved.
Site optimized for Business & Relax in Sardinia.
Villa Malvasio
LEGAL NOTES & ODR
• Privacy & Cookie Policy
• Terms and Conditions
• Online Dispute Resolution (ODR):
https://ec.europa.eu/consumers/odr/
LEGAL DATA
Antonella Pia Malvasio
Via Giuseppe de Martini 46c
07100 - Sassari (SS) - IT
VAT: IT02739150908
Tax Code: MLVNNL76B60E379W
IUN: E8330
CIN: IT090064B4000E8330
CONTACTS
Phone: +39 320 4154474
Email: info@villamalvasio.com
WhatsApp: +39 320 4154474
Availability: 24/7 for guest emergencies
QUICK NAVIGATION
• Location & Contacts
• Suites & Rooms with Jacuzzi
• Private Event Venue
• Blog & Sardinia Travel Tips
• Transparency
In force from 27/04/2026
This information notice takes into account the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Italian Privacy Code (Legislative Decree no. 196 of 30 June 2003). The document has also been drafted based on the Guidelines of the Italian Data Protection Authority (Garante Privacy).
Data Controller: Antonella Pia Malvasio - Via Giuseppe de Martini 46c 07100 - Sassari (SS) IT - VAT ID: IT02739150908 - Fiscal Code: MLVNNL76B60E379W - CCIAA REA: SS - 207363 - IUN Code: E8330 - CIN Code: IT090064B4000E8813 - Email: info@villamalvasio.com
Website to which this privacy policy refers: villamalvasio.com (Site).
The Data Controller has not appointed a DPO (Data Protection Officer). Therefore, you can send any request for information directly to the Data Controller.
This document describes how the Data Controller processes your personal data provided on the Site.
The main processing operations of your personal data are described below. In particular, the legal basis of the processing is explained, whether the provision of data is mandatory, and the consequences of failure to provide personal data.
Registration on the Site The information and data requested in case of registration will be used to allow you both to access the reserved area of the Site and to use the online services offered by the Data Controller to registered users. The legal basis for the processing is the need for the Data Controller to execute pre-contractual measures adopted at the request of the data subject. Providing data is optional. However, any refusal to provide data will make it impossible to register on the Site.
Bookings and Purchase of Services Through the Site, it is possible to initiate the booking procedure for stays and accommodation services. The actual finalization of the booking and the related entry of personal and payment data take place through an external secure Booking Engine managed by the provider Kross Booking (Octorate Srl), accessible via a dedicated link or sub-domain. The Data Controller will acquire your data from this external platform and will process them exclusively for the purpose of managing bookings and executing the related accommodation contract. The Data Controller does not process the user's data to send "reminder" emails for the purchase of products and/or services. The Data Controller does not offer products or services prohibited for minors under 18.
Responding to Your Requests Your data will be processed to respond to your requests for information. Providing data is optional, but your refusal will make it impossible for the Data Controller to answer your questions. The legal basis for the processing is the legitimate interest of the Data Controller to follow up on user requests. This legitimate interest is equivalent to the user's interest in receiving a response to communications sent to the Data Controller. If you fill in the specific form on the Site, the Data Controller may use your personal data to manage the request for a quote.
Generic Marketing Subject to your consent, the Data Controller may process the personal data provided by you in order to send you advertising material and/or newsletters relating to own products or those of third parties. The legal basis for this processing is your consent. The provision of personal data for this purpose is purely optional. We use Google services, such as Google Ads and Google Analytics, to personalize advertisements and improve the user experience. This includes the collection of personal data and cookies, used to show you ads in line with your preferences. More details are available in the cookie policy of this website.
Profiling The Data Controller does not carry out "profiling" with your personal data.
Data Assignment The Data Controller does not assign your personal data to third parties.
Geolocation The Site does not implement tools for geolocating the user's IP address.
Curriculum Vitae It is not possible to send curricula vitae through the Site.
Booking Stays and Events For the planning of stays and requests for quotes for private events, the user is redirected to an external booking system (Booking Engine) provided by Kross Booking (Octorate Srl). The data collected within this platform are limited to what is strictly necessary to block the requested dates and complete the transaction.
Photographs and Videos The Data Controller does not request the publication of photographs and/or videos portraying you.
Web Scraping The use of any automated process or system to access, acquire, copy, or monitor any part of our website, including, but not limited to, web scraping, crawling, or spidering techniques, is expressly prohibited. The Data Controller reserves the right to adopt all necessary measures, including legal action, to prevent and prosecute any unauthorized scraping activity.
Communication of Personal Data As part of its ordinary activity, the Data Controller may communicate your personal data to specific categories of subjects, as specified in Article 2. In communication to third parties, the third party to whom the data is transmitted can use it only for the specific purposes described in the relationship with the Data Controller.
1.1 The processing of your personal data will be mainly carried out with the aid of electronic or automated means, according to the methods and with the tools suitable to guarantee the security and confidentiality of personal data. 1.2 The information acquired and the methods of processing will be relevant and not excessive with respect to the type of services rendered. 1.3 "Special categories of data" (sensitive data) are not processed through the Site. 1.4 Judicial data are not processed through the Site.
The Data Controller may communicate your personal data to certain categories of subjects. The Data Controller informs users that when using the YouTube service (managed and owned by Google LLC) integrated into the Site via the YouTube API, certain personal data (IP address, behavioral data, location information) may be collected and automatically processed by YouTube in accordance with Google's privacy policy.
Below are the subjects to whom the Data Controller reserves the right to communicate your data:
All those subjects (including Public Authorities) who have access to personal data by virtue of regulatory or administrative provisions (including the Public Security Authority for the electronic submission of guest police forms via the "Alloggiati Web" portal).
Public and/or private subjects (legal, administrative, and tax consultancy firms, etc.), if the communication is necessary or functional for the correct fulfillment of obligations deriving from the law.
Employees and/or collaborators of the Data Controller in any capacity.
Companies, consultants, or professionals in charge of the installation, maintenance, updating, and management of the hardware and software used by the Data Controller (including the provider of the external booking infrastructure Kross Booking / Octorate Srl, which autonomously processes booking data on its platform in the name and on behalf of the property).
External companies in charge of sending communications (CRM platforms).
Banking institutions and external companies that manage national and international payment circuits (such as Stripe Payments Europe Ltd and SumUp) integrated into the Booking Engine for the secure processing of online payments. Financial data relating to credit cards are exchanged in encrypted form according to PCI-DSS standards and are not collected or stored on the servers of the villamalvasio.com website.
Personal data are not communicated to land couriers or freight forwarders of physical goods.
Personal data are not communicated to providers of generative artificial intelligence technology for profiling or commercial assignment purposes.
3.1 Personal data will be kept only for the time necessary to ensure the correct provision of services and the management of bookings offered through the Site.
For marketing purposes, data will be kept until consent is revoked (and deleted after one year of inactivity).
For the purpose of executing the accommodation contract or organizing private events, registration and contractual data will be kept for 10 years from the check-out date or the conclusion of the event, for the exercise of the Data Controller's right of defense and tax compliances.
As provided by Article 2220 of the Italian Civil Code, invoices and accounting records are kept for a minimum period of ten years.
For customer care purposes, data will be deleted once the assistance service is completed, and in any case within a maximum period of 3 months from the last email exchange.
If your personal data is transferred to a non-EU country for which the European Commission has expressed an adequacy decision, the transfer is considered secure. Upon user request, the Data Controller will apply the potentially more favorable legislation provided by the national legislation of the user.
The Data Controller informs you that you have the right to: request access to your personal data, rectification, erasure, restriction of processing, objection to processing, data portability, as well as the right to withdraw consent at any time and lodge a complaint with a supervisory authority (Garante per la Protezione dei Dati Personali - www.garanteprivacy.it). These rights may be exercised by writing to info@villamalvasio.com.
The Data Controller reserves the right to make changes to this information notice at any time, giving appropriate publicity to users on the Site.