Privacy

Pursuant to Art. 13 of EU Regulation 2016/679 and Legislative Decree No. 101 of 10 August
2018, we provide the following information regarding the processing of personal data that
may be provided by users who interact with the web services of Villa Guinigi Borgo di Matraia
starting from the address: www.villaguinigi.it.

This privacy notice concerns exclusively the processing of your personal data
communicated by you or otherwise obtained through the website www.villaguinigi.it as a
result of your use of the Site.

The processing of your personal data will be carried out in accordance with the principles
of fairness, lawfulness, transparency, purpose and storage limitation, data minimization
and accuracy, integrity and confidentiality, as well as the principle of accountability referred
to in Art. 5 of the Regulation.

Your personal data will therefore be processed in accordance with the legislative provisions
of the Regulation and the confidentiality obligations set out therein.

Data Controller

The Data Controller is Villa Guinigi Borgo di Matraia (Bianchi Luxury Group Srl – Culliness),
with registered and operational office at Via di San Donato, 1319/H – 55100 Lucca (LU), VAT
No. 02552710465, e-mail: info@culliness.com.

The Data Processor is Mr. Walter Bianchi.

Subject of the processing

As a result of browsing the Site, we inform the user that Villa Guinigi Borgo di Matraia
(Bianchi Luxury Group Srl – Culliness) will process personal data which may consist of an
online identifier such as the visitor’s IP address, data useful and relevant to reservations
made (through third-party providers such as TeamSystem Hospitality portal – please refer
to their privacy policy: https://www.teamsystem.com/privacy-policy/) and contact details
(name, surname, e-mail address, telephone number) if voluntarily entered in the “contacts”
section form.

The website uses cookies, small text files that the websites visited by the user send and
record on his/her computer or mobile device, to then be retransmitted to the same websites
during subsequent visits. The cookies used on the website are described in detail in the
Cookie Policy.

Purposes and methods of data processing

Data are collected and used to allow navigation on the Site, keep the user updated on the
services offered, and allow the user to make reservations.
Where necessary, the user’s consent will be requested for the processing of the provided
data.

The personal data provided will be processed with electronic/IT tools equipped with
suitable measures to ensure the security of such data, as required by EU Regulation
2016/679.

Data retention

The personal data processed (IP address, contact details such as name, surname, e-mail
address, telephone number, and reservation-related data) for the purposes described will
be stored for the time strictly necessary to achieve those purposes and until the end of the
service.

Types of data processed

By processing of personal data we mean any operation or set of operations performed, with
or without the aid of automated processes, on personal data or sets of personal data, such
as collection, recording, organization, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, erasure or destruction.

The personal data of the User processed include online identification data such as the IP
address, e-mail contact, and other information described in the section above (“Subject of
the processing”).

The Site also processes the following types of personal data:

• Browsing data: the IT systems and software procedures used to operate this
website acquire, during their normal operation, certain personal data whose
transmission is implicit in the use of Internet communication protocols. This
information is not collected to be associated with identified individuals, but by its
very nature could, through processing and association with data held by third
parties, allow users to be identified. This category of data includes IP addresses or
domain names of the computers used by users connecting to the Site, URI (Uniform
Resource Identifier) addresses of requested resources, the time of the request, the
method used to submit the request to the server, the size of the file obtained in
response, the numerical code indicating the status of the server’s response (e.g.,
success, error, etc.), and other parameters relating to the user’s operating system
and IT environment. These data are used solely to obtain anonymous statistical
information on the use of the site and to check its correct functioning, and are
deleted immediately after processing. The data could be used to ascertain
responsibility in the event of hypothetical cybercrimes against the site.
• Data provided voluntarily by the user: the optional, explicit, and voluntary sending
of data through web forms or e-mail to the addresses indicated on this site entails
the subsequent acquisition of the sender’s address, necessary to respond to
requests, as well as any other personal data included in the message.
• Third-party data provided by the user: when using certain Site services, personal
data of third parties may be processed, sent by the user to Villa Guinigi Borgo di
Matraia (Bianchi Luxury Group Srl – Culliness). In such cases, the user acts as an
independent Data Controller, assuming all legal obligations and responsibilities. In
this respect, the user grants full indemnity with regard to any dispute, claim, or
demand for compensation for damages arising from the processing of such
personal data brought against Villa Guinigi Borgo di Matraia (Bianchi Luxury Group
Srl – Culliness) by third parties whose data have been processed through the user’s
use of the Site in violation of applicable personal data protection laws. In any case,
should you provide or otherwise process personal data of third parties while using
the Site, you hereby guarantee – assuming all related liability – that such processing
is based on an appropriate legal basis pursuant to Art. 6 of the Regulation, which
legitimizes the processing of the data in question.
• Cookies: the cookies used within the website are described in detail in the Cookie
Policy.

Legal basis and mandatory nature of providing data

The Site collects personal data of the visiting user such as browsing data (e.g., IP address,
etc.), contact data, or personal data necessary to complete a reservation.
Apart from what is specified for browsing data, the user is free to provide personal data in
order to request the services offered by Villa Guinigi Borgo di Matraia (Bianchi Luxury Group
Srl – Culliness).

Disclosure of data to third parties and data transfer

The processed data may be disclosed to parties responsible for the
management/maintenance of the Site and/or provision of web services, to external parties
for reservation management, and to other entities or parties for compliance with legal,
administrative, and tax obligations. The data may also be disclosed to entities, bodies, or
authorities in accordance with legal provisions or orders for control purposes.

Your personal data will be processed within the territory of the European Union.

Should it be necessary, for technical and/or operational reasons, to rely on entities located
outside the European Union, we inform you that such entities will be appointed as Data
Processors pursuant to and for the purposes of Art. 28 of the GDPR, and the transfer of your
personal data to such entities, limited to the performance of specific processing activities,
will be carried out in compliance with the provisions of the GDPR. All necessary measures
will be adopted to ensure full protection of your personal data, basing such transfer on the
evaluation of appropriate safeguards, including, for example, adequacy decisions of thirdcountry recipients by the European Commission or adequate safeguards provided by the
third-party recipient pursuant to Art. 46 of the GDPR.

In any case, you may request more details from the Data Controller should your personal
data be processed outside the European Union, requesting evidence of the specific
safeguards adopted.

Nature of data provision

Providing data is mandatory as it is necessary to fulfil contractual, accounting, tax, and
administrative obligations in general. Any failure to provide, or incorrect communication of,
any of the mandatory information will result in the Data Controller’s inability to ensure that
the processing complies with the contractual agreements or may result in the impossibility
of fulfilling legal, administrative, or labor obligations to which the processing is addressed.

Rights of data subjects

Pursuant to Articles 15 et seq. of the Regulation, the user has the right to request from Villa
Guinigi Borgo di Matraia (Bianchi Luxury Group Srl – Culliness), at any time, access to
his/her personal data, rectification, or erasure of the same, or to object to their processing.
Pursuant to Art. 21 of the Regulation, the user also has the right to request restriction of
processing in the cases provided for by Art. 18 of the Regulation, as well as the right to obtain
in a structured, commonly used, and machine-readable format the data concerning
him/her in the cases provided for by Art. 20 of the Regulation.

Requests must be made in writing to the following address: info@culliness.com.

In any case, the user always has the right to lodge a complaint with the competent
Supervisory Authority (Garante per la Protezione dei Dati Personali), pursuant to Art. 77 of
the Regulation, if he/she believes that the processing of his/her personal data is contrary to
applicable law.

Updates and changes to this Privacy Notice

Villa Guinigi Borgo di Matraia (Bianchi Luxury Group Srl – Culliness) may make changes to
this Privacy Notice, ensuring in any case that this web page is promptly updated. We invite
users to visit this section frequently to be aware of any changes.

Last update: September 2025