Privacy and Cookie Policy

Pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR) and applicable national legislation

Last updated: September 2026

Elga Residence, managed by E.L.G.A. S.R.L. (hereinafter, “Residence” or “Data Controller”), considers the protection of privacy and personal data of its users, clients, and website visitors to be of primary importance. This Privacy Policy transparently describes how we collect, use, store, and protect your personal data.

1. Data Controller and Contact Details

The Data Controller is the company E.L.G.A. S.R.L., with registered office in Via Funivie 16, 23032 Bormio (SO) – Italy, VAT No. and Tax Code: 00602750143, managing the accommodation property Elga Residence located at Via Nazionale 31/A, 23030 Valdisotto (SO).
To exercise your rights or for any clarification regarding the processing of your personal data, you may contact the Data Controller at the following addresses:

Registered Office: Via Funivie 16, 23032 Bormio (SO) – Italy
Property Address: Via Nazionale 31/A, 23030 Valdisotto (SO) – Italy
Phone: +39 0342 970092
Privacy E-mail: elgaresidence@gmail.com

2. Categories of Processed Data, Purposes and Legal Bases

Personal data is collected directly from the user and processed for the following specific purposes:

Processing Purpose	Data Type	Legal Basis (GDPR)
Inquiry and Quote Management: Responding to requests submitted via contact forms, email, or telephone.	First name, last name, email address, phone number, dates of stay, notes/preferences.	Performance of pre-contractual measures (Art. 6.1.b GDPR).
Booking and Stay Management: Conclusion and execution of the accommodation rental agreement.	Personal details, identity document details, payment/credit card details.	Performance of a contract (Art. 6.1.b GDPR).
Legal Compliance and Public Security: Communication of guest details to the State Police (Alloggiati Web) and tax/accounting compliance.	Personal details, identity document details, billing/VAT details.	Legal obligation (Art. 6.1.c GDPR; T.U.L.P.S. Art. 109).
Direct Marketing and Newsletter: Sending promotional offers, event updates, and news regarding Valdisotto, Bormio, and Valtellina.	First name, email address.	Explicit and optional consent of the data subject (Art. 6.1.a GDPR).
Website Security and Fraud Prevention: Monitoring the proper functioning and security of the web infrastructure.	IP addresses, system logs, browsing data, browser type.	Legitimate interest of the Data Controller (Art. 6.1.f GDPR).

3. Data Retention Period

Collected data will be stored only for the time strictly necessary to fulfill the purposes for which it was gathered:

Contractual, administrative, and accounting data: Retained for 10 years to comply with statutory fiscal and civil obligations.
Public Security data (Alloggiati Web): Deleted immediately after digital transmission or stored in accordance with requirements from competent authorities.
Contact/Quote inquiries without booking: Retained for a maximum of 24 months from the request date.
Marketing/Newsletter data: Retained until consent is withdrawn (opt-out) by the user, or for a maximum of 24 months from the last active interaction.

4. Data Recipients and Overseas Transfers

Collected data will never be publicly disclosed and may only be communicated to authorized third parties or designated Data Processors (pursuant to Art. 28 GDPR):

Technical and web hosting providers, booking engine providers, and web developers;
Fiscal, administrative, and legal consulting firms;
Public Security Authorities and Tax Administration bodies for regulatory compliance.

As a rule, data is processed within the European Economic Area (EEA). Should the transfer of data to non-EEA countries become necessary for specific services (e.g., newsletters, cloud platforms), this will occur strictly under adequacy decisions of the European Commission or upon adoption of approved Standard Contractual Clauses (SCC).

5. Cookie Policy and Integrated Platforms

Cookies are small text files sent to the user’s device by visited websites. In compliance with the Italian Data Protection Authority Guidelines of June 10, 2021, this website uses the following categories of cookies:

A. Technical Cookies (Necessary)

These do not require the user’s prior consent as they are essential to enable website navigation and essential functionality (e.g., session management, saving cookie consent preferences, booking engine functionality).

B. Analytical and Statistical Cookies

The site uses tools such as Google Analytics 4 with IP address masking/anonymization. As they lack direct identification capabilities, they are assimilated to technical cookies.

C. Third-Party and Profiling Cookies (Subject to Consent)

Activation of these features occurs only if the user explicitly consents via the cookie notice banner:

Google Maps: Used to display interactive maps of the residence’s location in Valdisotto.
Social Widgets / YouTube: Used for embedding multimedia content.

Managing Preferences: Users can review or modify their consent choices at any time by clicking the “Manage Cookie Preferences” link located in the website footer, or by configuring their web browser settings (Chrome, Firefox, Safari, Edge).

6. Rights of the Data Subject (Arts. 15-22 GDPR)

As a data subject, you are guaranteed all rights provided by the European Regulation, which you can exercise at any time free of charge:

Right of Access (Art. 15): Obtain confirmation as to whether or not personal data concerning you is being processed and receive a copy thereof.
Right to Rectification (Art. 16): Obtain the correction of inaccurate data or the completion of incomplete data.
Right to Erasure / Right to be Forgotten (Art. 17): Request the erasure of your personal data under conditions specified by law.
Right to Restriction of Processing (Art. 18): Obtain a temporary restriction of processing under certain statutory conditions.
Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object (Art. 21): Object at any time to the processing of your personal data based on legitimate interest or for direct marketing purposes.
Withdrawal of Consent: Withdraw previously given consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, you may submit a formal request to: elgaresidence@gmail.com.

Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with the supervisory authority, the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it), if you consider that the processing violates applicable laws.