Last Updated On
This Privacy Policy describes the policies of Sicily Good di Salvatore Guarneri, Cortile Gonzales 7, Lercara Friddi 90025, Italy, email: portasiciliainfo@gmail.com, phone: 3274522382 on the collection, use and disclosure of your information that we collect when you use our website (https://www.portasicilia.com/) (the "Service"). By accessing or using the Service, you are consenting to the collection, use and disclosure of your information in accordance with this Privacy Policy. If you do not consent to the same, please do not access or use the Service.
The data controller is:
Porta Sicilia has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR do not apply. For any request relating to personal data processing, the data subject may write to info@portasicilia.com.
This Notice applies to the processing of personal data of data subjects who visit the Platform, register as users, book services or purchase products, apply to become Partners, receive commercial communications or interact with the official channels of Porta Sicilia.
The personal data processed concerns the following categories of data subjects:
The categories of personal data processed vary depending on the relationship with Porta Sicilia. They are as follows:
Porta Sicilia does not deliberately collect special categories of personal data within the meaning of Article 9 GDPR (health, ethnic origin, religious belief, biometric data, etc.). Should a data subject voluntarily provide such information in a review or communication, they will be asked to remove it.
Data is collected directly from the data subject (registration, Partner application form, newsletter form, bookings, purchases, communications).
A limited part of the data may be received from third parties: (i) Google and Apple, in case of OAuth registration (email, name, possibly avatar); (ii) Stripe, in case of payment (tokenised outcome and transaction identifier); (iii) iCal synchronisation of the Host’s calendar with external platforms (Airbnb, Booking) — limited to availabilities, without personal data of the customer.
Personal data is processed for the following purposes and with the corresponding legal bases:
(a) Creation and management of the user account, authentication, maintenance of account security.
Legal basis: performance of the Platform service contract — Art. 6(1)(b) GDPR.
(b) Execution of bookings for experiences, tours and accommodations, including transactional communications and transmission of data necessary to the Host for service provision.
Legal basis: performance of contract — Art. 6(1)(b) GDPR.
(c) Direct sale of food products in the Shop section: order management, invoicing, shipping.
Legal basis: performance of contract — Art. 6(1)(b) GDPR; tax and accounting obligations — Art. 6(1)(c) GDPR.
(d) Payment processing via Stripe, including anti-fraud checks and PSD2/SCA authentication.
Legal basis: performance of contract — Art. 6(1)(b) GDPR; PSD2 regulatory obligations — Art. 6(1)(c) GDPR.
(e) Service communications (confirmations, changes, reminders, booking updates, support).
Legal basis: performance of contract — Art. 6(1)(b) GDPR.
(f) Platform security, fraud prevention, abuse monitoring, dispute and chargeback management.
Legal basis: legitimate interest of Porta Sicilia in protecting its systems and customers — Art. 6(1)(f) GDPR.
(g) Anonymised/pseudonymised statistical analysis of Platform usage via Google Analytics 4 in Consent Mode v2 with ads_data_redaction enabled.
Legal basis: consent of the data subject expressed via the CMP — Art. 6(1)(a) GDPR.
(h) Sending of the newsletter and commercial communications on Porta Sicilia’s services and initiatives.
Legal basis: express consent of the data subject — Art. 6(1)(a) GDPR; alternatively, "soft-spam" under Article 130(4) of the Italian Privacy Code for offers of services similar to those already purchased, with the right to free objection in every email.
(i) Publication and moderation of reviews left by users.
Legal basis: performance of contract and legitimate interest in Platform transparency — Art. 6(1)(b) and (f) GDPR; compliance with Article 27-quater of the Italian Consumer Code.
(j) Compliance with transparency and notice-and-action obligations under Regulation (EU) 2022/2065 (DSA).
Legal basis: legal obligation — Art. 6(1)(c) GDPR.
(k) Compliance with legal obligations (tax, accounting, anti-money laundering where applicable), response to requests from public authorities, exercise or defence of rights in judicial proceedings.
Legal basis: legal obligation — Art. 6(1)(c) GDPR; legitimate interest — Art. 6(1)(f) GDPR for defence of rights.
Processing is carried out using electronic and organisational tools suitable to ensure the confidentiality, integrity and availability of the data. Data is processed by authorised personnel of Porta Sicilia and by suppliers appointed as processors, bound by agreements (DPAs) compliant with Article 28 GDPR.
Personal data is retained for the time strictly necessary to pursue the purposes for which it was collected, according to the following criteria:
In case of litigation or legitimate interest in defending rights, data may be retained for the time necessary, until the final decision becomes res judicata.
Personal data may be communicated to service providers acting as processors under Article 28 GDPR. The current list is as follows:
Some of the providers listed above are based or operate in the United States (Stripe Inc., Google LLC, Apple Inc.). Transfers of personal data to these destinations take place in compliance with Chapter V of the GDPR and in particular:
The data subject can obtain a copy of the safeguards adopted by writing to info@portasicilia.com.
The data subject has the right, under Articles 15-22 GDPR, to:
The data subject may exercise their rights by writing to info@portasicilia.com, attaching a copy of an identity document where necessary for verification. Porta Sicilia will respond within 30 days of receipt of the request, extendable by 60 days in case of complexity, with reasoned communication to the data subject. The exercise of rights is free of charge, except in case of manifestly unfounded or excessive requests (Article 12(5) GDPR).
The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — https://www.garanteprivacy.it) or with the supervisory authority of their Member State of habitual residence or of the place of the alleged infringement (Article 77 GDPR).
The use of cookies and similar technologies is governed by the Cookie Policy, which forms an integral part of this Notice. Consent is collected through the Consent Management Platform of Usercentrics GmbH and may be modified at any time from the "Cookie settings" panel available in the site footer.
Newsletter subscription is based on the data subject’s free, specific, informed and revocable consent, collected at the time of subscription. Every email includes a direct link to unsubscribe. In the case of prior purchases of services/products, Porta Sicilia may send communications relating to similar offers (soft-spam, Article 130(4) of the Italian Privacy Code), with the right to free objection at any time.
Porta Sicilia does not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect the data subject (Article 22 GDPR). Listing ranking algorithms are used in search results, described in the Partner Terms under Article 5 of the P2B Regulation (EU 2019/1150): such algorithms do not produce significant effects on end users and do not constitute profiling under Article 22 GDPR.
Porta Sicilia adopts technical and organisational measures appropriate to the risk, including: encryption of data in transit (HTTPS/TLS) and at rest for sensitive data, password hashing with strong algorithms, role-based access controls, principle of least privilege, access and security-event logging, environment segregation, periodic audits, encrypted backups, staff training and vulnerability management. Despite the adoption of such measures, no system can guarantee absolute security; in case of a breach, Porta Sicilia will notify the Garante within 72 hours (Article 33 GDPR) and the data subjects in the cases provided for by Article 34 GDPR.
The Platform is not addressed to minors under 18; registration and purchases are reserved to adults. For the processing of data of minors between 14 and 18 years of age in the context of bookings made by a parent, authorisation by the holder of parental responsibility is required. Processing of data of minors under 14 requires the consent of the holder of parental responsibility pursuant to Article 2-quinquies of the Italian Privacy Code. Where Porta Sicilia becomes aware of processing of minors’ data in the absence of such authorisation, it will proceed to delete it.
This Notice may be updated at any time to adapt it to regulatory changes, new processing methods or service developments. The updated version will be published on this page with indication of the last revision date. Material changes will be communicated to data subjects via email or a notice on the Platform.
For any question, request or clarification regarding the processing of personal data, the data subject may write to info@portasicilia.com or by ordinary mail to: Sicily Good di Salvatore Guarneri, Cortile Gonzales 7, 90025 Lercara Friddi (PA), Italy.