Last updated: 4 September 2026
This Privacy Policy describes how Sette Stelle S.r.l. processes the personal data of users who access and use the website settestellesuites.it, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable data protection legislation.
The Data Controller is:
Sette Stelle S.r.l.
Via Miguel Cervantes de Saavedra 55/14
80133 Naples (NA), Italy
VAT and Tax Identification Number: 10822741210
E-mail: settestellesuites@gmail.com
Certified e-mail (PEC): settestelle.srl
The Data Controller has not appointed a Data Protection Officer (DPO), as the relevant legal requirements for such appointment do not apply.
The website may process the following categories of personal data:
• Browsing data: technical information relating to the user’s browsing activity and device, such as IP address, technical identifiers, browser type and version, operating system, time of the request and information relating to interactions with the website, to the extent necessary for the operation and security of the service.
• Data voluntarily provided by the user: if the user chooses to contact Sette Stelle through the contact details provided on the website, the personal data contained in the communication may be processed, such as name, contact details and any other information that the user voluntarily chooses to provide.
• Booking-related data: if the user uses the online booking system, certain initial information, such as stay dates and number of guests, is used to initiate the availability search. The booking process is then continued through the Kross Booking system, in accordance with its applicable procedures and privacy policy.
Users are invited not to transmit, through ordinary contact channels, information that is excessive or unnecessary for their request, nor special categories of personal data pursuant to Article 9 of the GDPR, unless strictly necessary and transmitted through appropriate means.
Personal data may be collected:
• automatically during browsing of the website;
• when the user voluntarily chooses to contact Sette Stelle through the contact details provided;
• when the user initiates a search or booking procedure through the booking engine integrated into the website.
The website does not contain a contact form through which users directly enter and submit personal data to Sette Stelle.
4.1 Website operation and security
Technical browsing data may be processed to ensure the proper operation of the website, maintain its security, prevent abuse and unlawful activities, and manage any technical issues.
Legal basis: Article 6(1)(f) GDPR, concerning the Data Controller’s legitimate interest in ensuring the security and proper functioning of its systems.
4.2 Management of user requests
If the user contacts Sette Stelle by e-mail, telephone, WhatsApp or through other contact details provided on the website, the data provided will be processed to receive, manage and respond to the request, including requests for information regarding stays and room availability.
Legal basis: Article 6(1)(b) GDPR, where processing is necessary to take steps at the request of the data subject prior to entering into a contract, or Article 6(1)(f) GDPR where processing is necessary to manage a general enquiry.
4.3 Booking management
The website provides an online booking system operated by Kross Booking. Users can select their stay dates and number of guests through the booking engine displayed on the website and are subsequently redirected to the booking environment operated by Kross Booking to continue and complete the procedure.
Any data entered by the user during the subsequent stage of the booking process on the Kross Booking system is processed in accordance with the terms and privacy policy applicable to that service.
Legal basis: Article 6(1)(b) GDPR, where processing is necessary for the performance of pre-contractual measures or the accommodation contract requested by the data subject.
4.4 Cookies and similar technologies
The website uses cookies and similar technologies as described in the relevant Cookie Policy.
Cookie preferences are managed through Complianz, which allows users to manage their preferences regarding the categories of cookies and tracking technologies used by the website.
The website contains links that allow users to initiate a conversation via WhatsApp.
The link is a standard external link which, when clicked, opens the WhatsApp application or the relevant service on the user’s device. The website does not integrate a WhatsApp chat system, does not use a messaging plugin and does not directly collect the contents of WhatsApp conversations through the website.
Once the user accesses WhatsApp and chooses to send a message, the processing of personal data is governed by WhatsApp’s terms and privacy policy and those of the relevant service provider.
Sette Stelle will process only the information that the user voluntarily chooses to provide through the conversation, for purposes related to managing the request, including requests for availability and booking.
The website uses the Kross Booking reservation service to allow users to check availability and proceed with room bookings.
The initial interaction with the system allows users to select their stay dates and number of guests. To complete the booking, the user is redirected to a page operated within the Kross Booking service.
The processing of personal data carried out as part of the booking procedure is therefore also subject to the terms and privacy policy of the service provider.
Sette Stelle may subsequently receive and process the data necessary to manage the booking and the relationship with the guest, in accordance with the applicable procedures and purposes relating to accommodation services.
The website uses cookies and similar technologies. The relevant information, including the categories of cookies used, their purposes, duration and the methods available to users to manage or modify their preferences, is provided in the Cookie Policy.
The website uses Complianz to manage consent and preferences relating to cookies.
Sette Stelle does not use analytics tools on the website for statistical or profiling purposes and does not carry out marketing activities or behavioural advertising through the website.
The website is built using WordPress and Elementor Pro and is hosted by SiteGround.
The website also uses a Content Delivery Network (CDN) provided by Cloudflare, within the configuration available through the service used.
As part of the technical management of the website, technical and browsing data may be processed as necessary to ensure availability, performance, security and protection against malicious activity.
The Data Controller adopts reasonable and appropriate technical and organisational measures in relation to the risks associated with the processing of personal data, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of the processing.
Personal data may be accessed or disclosed, to the extent strictly necessary for the relevant activities, to the following categories of recipients:
• personnel and collaborators authorised by the Data Controller;
• providers of technical and IT services necessary for the operation of the website;
• providers of hosting, infrastructure and IT security services;
• providers of online booking systems and services;
• professionals or consultants appointed by the Data Controller, within the scope of their respective activities;
• public authorities and entities to whom disclosure is required by law.
Where applicable, entities processing personal data on behalf of the Data Controller are appointed as Data Processors pursuant to Article 28 GDPR.
Some technology service providers used by the website may process personal data or technical data outside the European Economic Area.
Where such transfers take place, the Data Controller will ensure that they are carried out in compliance with Articles 44 et seq. of the GDPR, through an adequacy decision adopted by the European Commission or appropriate safeguards provided for by applicable legislation, where required.
Personal data is retained for the period necessary to fulfil the purposes for which it was collected and, subsequently, for the period necessary to comply with legal obligations or protect the rights of the Data Controller.
In particular:
• technical browsing data is retained for the period strictly necessary for the technical and security purposes for which it is collected, in accordance with the policies of the relevant service providers;
• data relating to user requests is retained for the time necessary to manage the request and, subsequently, for any period necessary to protect the Data Controller’s rights or comply with legal obligations;
• booking-related data is retained for the period necessary to manage the relationship with the customer and subsequently for the periods required by applicable civil, tax and accounting legislation.
Once the applicable retention period has expired, the data will be deleted or anonymised, where technically possible.
Browsing the website does not generally require users to voluntarily provide personal data.
The provision of data that may be required for a booking or for the management of a specific request is necessary to the extent that such data is essential to provide the requested service, take pre-contractual measures or comply with legal obligations.
Failure to provide the necessary data may prevent Sette Stelle from managing the request or proceeding with the booking.
The website does not carry out automated decision-making processes that produce legal effects or similarly significantly affect users within the meaning of Article 22 GDPR.
The website does not carry out user profiling for marketing or advertising purposes.
With regard to the processing of their personal data, data subjects may exercise, where applicable, the rights provided for under Articles 15-22 GDPR, including:
• obtaining confirmation as to whether or not personal data concerning them are being processed;
• obtaining access to their personal data;
• obtaining the rectification of inaccurate data or completion of incomplete data;
• obtaining the erasure of personal data where provided for by law;
• obtaining restriction of processing where provided for by law;
• objecting to processing where provided for under Article 21 GDPR;
• requesting data portability where provided for under Article 20 GDPR;
• withdrawing consent where consent has been given, without affecting the lawfulness of processing carried out prior to its withdrawal.
To exercise their rights, users may contact the Data Controller at settestellesuites@gmail.com.
Requests will be handled within the time limits provided for by applicable legislation. Where necessary, the Data Controller may request additional information to verify the identity of the person making the request.
If a data subject believes that the processing of their personal data violates applicable data protection legislation, they have the right to lodge a complaint with the competent supervisory authority, in particular the Italian Data Protection Authority (Garante per la protezione dei dati personali), pursuant to Article 77 GDPR, without prejudice to any other administrative or judicial remedy.
The website may contain links to websites, applications or services operated by third parties, including WhatsApp and the Kross Booking reservation system.
The Data Controller is not responsible for the manner in which such third parties process personal data outside the settestellesuites.it website. Users are therefore encouraged to consult the relevant privacy policies of such third parties.
The Data Controller reserves the right to amend or update this Privacy Policy at any time, including as a result of changes in legislation or in the technical or organisational arrangements relating to the processing activities.
The updated version will be published on this page, together with the relevant date of update.