Timeless Puglia
ENIT

Direct booking legal documents

Effective 27 August 2026Version 2026-08-27-v1

Italian is the governing legal text. The English version is provided for clarity; mandatory consumer protections always apply.

1. Controller

The data controller is Timeless Puglia S.r.l., Viale Grotta della Regina 42/10, 70126 Bari, Italy, VAT IT08978390725. Privacy requests: info@timelesspuglia.com; telephone +39 380 860 8206.

2. Data we process

We process identity and contact details; property, dates, guests, price, rate, extras and booking correspondence; payment status and provider identifiers (not the full card number); online-check-in and legally required guest-registration information; support messages; and technical, security and consent records. With optional consent, we also process analytics, session-recording and advertising-attribution data.

3. Purposes and legal bases

  • Contract and pre-contract steps: search, quote, booking, payment, support, online check-in and stay management (GDPR Article 6(1)(b)).
  • Legal obligations: accounting, tax, tourist-tax, public-security and guest-registration duties, and lawful authority requests (Article 6(1)(c)).
  • Legitimate interests: service security, fraud prevention, troubleshooting, limited first-party reliability measurement, defence of claims and service improvement, balanced against guest rights (Article 6(1)(f)).
  • Consent: optional analytics/session recordings, advertising technologies, and incomplete-checkout recovery where expressly requested (Article 6(1)(a)). Consent can be withdrawn at any time without affecting earlier processing.

4. Required and optional data

Fields marked as required are necessary to quote, contract, pay, comply with law, or provide access. Without them we may be unable to complete the booking or stay. Optional contact-recovery, analytics and marketing choices are not required to book. We do not preselect those consents.

5. Recipients and processors

Data is shared only as needed with property-management and booking systems, payment providers such as Stripe, hosting and security providers, transactional email and support providers, online-check-in services, professional advisers, property owners or operators where required to perform the stay, and competent authorities. Google, Microsoft Clarity and Meta receive data only for the optional categories enabled by the guest. Providers act under their own terms where they are independent controllers.

6. International transfers

Some providers may process data outside the European Economic Area. Where no adequacy decision applies, we use an available lawful safeguard such as European Commission Standard Contractual Clauses and supplementary measures, subject to the provider's role and service.

7. Retention

  • Incomplete-checkout contact records are deleted automatically after 90 days unless converted into a booking or earlier consent is withdrawn.
  • Local contact prefill in the guest's browser expires after 180 days and can be removed by clearing site data.
  • Confirmed booking, payment, invoice and relevant contractual records are retained for the periods required by Italian civil, accounting and tax law, generally up to 10 years, and longer only where a dispute or mandatory hold requires it.
  • Online-check-in identity and statutory guest-registration records follow the applicable legal and configured security-retention periods; temporary verification media is removed when its shorter operational period expires.
  • Pseudonymous first-party demand and conversion history is retained while needed for long-term seasonal analysis and service security; direct identifiers are not intentionally included in analytics events. Optional provider data follows the periods configured with each provider and the Cookie Policy.

8. Rights

Subject to the GDPR conditions, you may request access, rectification, erasure, restriction, portability, and object to legitimate-interest processing; you may withdraw consent at any time. Contact info@timelesspuglia.com. You may also complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali) or your local supervisory authority. Identity verification may be required before fulfilling a request.

9. Automated decisions and children

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on guests. Prices and availability can change through non-personal inventory and rate rules. The person booking must be at least 18; data about accompanying minors is processed only as needed for the stay and legal duties.

10. Security and updates

We use proportionate access controls, encryption in transit, tenant separation, logging and payment-provider controls. No system is risk-free. Material notice changes will be published with a new version and, where required, communicated directly.