Last updated: 18 October 2026

Data Controller

Agriturismo Cascina Legra
Fraz. Marnago 1, 27050 Val di Nizza (PV)
VAT No. 01632590186
Email: fabrizio@bimasrl.com
(the “Data Controller”)

Scope

This privacy notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) to users visiting the website www.cascinalegra.it (the “Website”). It explains which data we process, for what purposes, on what legal basis and for how long, as well as the rights of data subjects.

Types of Data Processed

• Browsing data: IP addresses, date/time, URIs of requested resources, user-agent, response codes and device parameters. This data is collected automatically by IT systems for Website security and operation purposes.
• Data voluntarily provided: any emails sent to the Data Controller's email addresses and the data contained in them (e.g. information or booking requests).
• Third-party tools: Google Analytics 4 (GA4) and external fonts/resources may be used; this may involve disclosure of the IP address to the relevant providers. Details are provided in the Cookie Policy.

Purposes, Legal Bases and Retention Periods

• Website operation and security (technical logs, abuse prevention): legal basis: the Data Controller's legitimate interest (Article 6(1)(f) GDPR). Retention: technical logs are retained for up to 12 months, unless required for security purposes or in response to requests from authorities.
• Responding to pre-contractual or contractual requests (emails/contact enquiries): legal basis: Article 6(1)(b) GDPR. Retention: for as long as necessary to handle the request and, if a relationship is established, for the applicable civil and tax retention periods.
• Anonymous or aggregated statistics using Google Analytics 4 (GA4): legal basis: the user's consent given through the banner (Article 6(1)(a) GDPR). Retention: as specified in the Cookie Policy (for example, 14 months, configurable). The scripts are not activated without consent.

Necessity and Provision of Data

Browsing data is necessary to use the Website. Data voluntarily submitted (e.g. by email) is necessary to process the request; failure to provide it means that we will be unable to respond.

Recipients and Categories of Providers

• IT and hosting providers (data processors pursuant to Article 28 GDPR)
• Analytics service providers (e.g. Google LLC or Google Ireland Ltd. for GA4, if enabled)

An up-to-date list of data processors is available upon request.

Transfers of Data Outside the EEA

If providers process data in the United States, the transfer may take place:

• under the adequacy decision (EU-US Data Privacy Framework), if the provider is certified
• through Standard Contractual Clauses (SCCs) and any additional safeguards, where necessary

In all cases, the Data Controller verifies the legal basis for the transfer and informs the user accordingly.

Data Subject Rights

Data subjects may exercise the rights provided for in Articles 15–22 of the GDPR (access, rectification, erasure, restriction of processing, data portability and objection) by writing to fabrizio@bimasrl.com.

A complaint may also be lodged with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

Security Measures

The Data Controller adopts appropriate technical and organisational measures pursuant to Article 32 GDPR to ensure the integrity, confidentiality and availability of data.

Useful Links

For further information about cookies and the tracking systems used by the Website, please consult the Cookie Policy.