Privacy Policy
Privacy Policy
Controller: Miroslav Drmla
Effective date: April 14, 2026
Last updated: May 3, 2026
1. Who processes your personal data
The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) is:
Miroslav Drmla
R. Viesta 91, 036 01 Martin, Slovak Republic
E-mail: info@bellasirena.it
Telephone: +39 3520 476 390
Website: bellasirena.it
The controller has not appointed a Data Protection Officer (DPO). If you have any questions regarding the protection of personal data, you may contact us at info@bellasirena.it.
2. What personal data we process
We only process the personal data that we need to handle booking enquiries, communicate with website visitors, and operate the website.
2.1 Data from the booking form
If you complete the booking form on the website, we mainly process the following data:
Required data:
- first name and last name,
- e-mail address,
- telephone number,
- number of guests,
- arrival date,
- departure date,
- confirmation that you have read the privacy policy.
Optional data:
- message or additional notes relating to the booking.
This data is stored in a database on a hosting server located in the Slovak Republic and is also sent to the controller’s e-mail address.
The booking form serves as a non-binding booking enquiry. Submitting the form does not in itself mean that the booking has been confirmed or that an accommodation contract has been concluded.
2.2 Data from e-mail and telephone communication
If you contact us by e-mail or telephone, we may process the data you provide in that communication, in particular:
- your e-mail address,
- your telephone number,
- the content of the communication,
- data relating to the requested stay dates, number of guests, or other requirements.
2.3 Technical data collected when visiting the website
When you visit the website, technical data necessary for the secure and proper operation of the website may be processed to the extent necessary, for example:
- IP address,
- device and browser type,
- date and time of the visit,
- technical logs related to website operation.
If the visitor gives consent to advertising cookies, when the embedded Google Calendar or embedded Google Map is displayed, Google may process the IP address and other technical data necessary to load such content and may store or use cookies in accordance with its own terms.
If the visitor gives consent to analytical cookies, through Google Analytics we may process data about the visit to the website, such as the IP address in shortened or technically processed form, device and browser data, pages visited, time of visit, and basic interaction data relating to the website.
2.4 Cookies and related technologies
On the website, we use:
- strictly necessary cookies, which are required for the basic functionality of the website,
- analytical cookies, if the visitor consents to the use of Google Analytics and technologies related to traffic measurement and visit attribution through the PixelYourSite plugin,
- advertising cookies, if the visitor consents to the use of Meta Pixel and to the display of the embedded Google Calendar or embedded Google Map.
Google Analytics, Google Calendar, and Google Maps are not activated or loaded automatically on our website without the relevant consent. They are activated or displayed only after consent has been given to the relevant category of cookies.
2.5 Website multilingual functionality
The website is available in multiple language versions through the WPML plugin. In this context, the website may store technical data or cookies to the extent necessary to display the correct language version and preserve the visitor’s language preference.
2.6 WhatsApp link
The website contains a link to the WhatsApp communication platform in the form of a wa.me link. When the website is viewed normally, no personal data is transferred to WhatsApp servers through this link. Any connection with the WhatsApp service occurs only after the visitor knowingly clicks on the link.
3. Why we process personal data and on what legal basis
3.1 Booking enquiries and communication prior to entering into a contract
Legal basis: Article 6(1)(b) GDPR
Purpose: Processing a non-binding booking enquiry, communicating with a person interested in a stay, and taking steps prior to the possible conclusion of an accommodation contract.
Scope of data: Data from the booking form and related communication.
We process this data because without it we cannot respond to the enquiry, check availability, or prepare the information necessary for a booking.
3.2 Performance of a contract after booking confirmation
Legal basis: Article 6(1)(b) GDPR
Purpose: Confirmation and administration of the booking, communication before arrival, and provision of the agreed stay.
Scope of data: Data necessary for carrying out the confirmed booking and communication with the guest.
This legal basis applies only once the booking has been confirmed or a contractual relationship has arisen.
3.3 Compliance with legal obligations
Legal basis: Article 6(1)(c) GDPR
Purpose: Accounting, tax records, and compliance with obligations arising from applicable legal regulations.
Scope of data: Data stated on accounting and tax documents and in related records.
3.4 Website traffic analysis (Google Analytics)
Legal basis: Article 6(1)(a) GDPR
Purpose: Measuring website traffic, analysing visitor behaviour, evaluating the use of content, and improving the operation of the website.
Scope of data: Data about the visit to the website, technical data about the device and browser, pages visited, time of visit, basic interaction data relating to the website, and cookie identifiers.
On the basis of your consent, we may use Google Analytics and related analytical technologies to measure website traffic, evaluate the use of content, and enable basic attribution of visits and interactions.
3.5 Consent of the website visitor
Legal basis: Article 6(1)(a) GDPR
Purpose:
- remarketing and measuring the effectiveness of advertising campaigns through the Meta Pixel,
- displaying the embedded Google Calendar, which is loaded from Google servers only after consent to advertising cookies has been given,
- displaying the embedded Google Map, which is loaded from Google servers only after consent to advertising cookies has been given.
Scope of data: Data about the use of the website, technical data necessary to load external content, and cookie identifiers.
Consent is given through the cookie banner upon the first visit to the website. You may withdraw your consent at any time by changing your cookie settings.
3.6 Legitimate interest of the controller
Legal basis: Article 6(1)(f) GDPR
Purpose: Protection of the controller’s legal claims, record-keeping of communication, and handling potential disputes or complaints.
Scope of data: E-mail communication, booking enquiries, related records, and documentation.
The controller’s legitimate interest is to be able to demonstrate what communication took place, what information was provided, and what terms were agreed.
4. How long we retain personal data
We retain personal data only for the period necessary to fulfil the specific purpose of processing.
| Category of data | Retention period |
|---|---|
| Non-binding booking enquiries and communication without a completed booking | 3 years from the last communication |
| Data related to a confirmed booking and stay | for the duration of the contractual relationship and subsequently for the period necessary to protect legal claims |
| Accounting and tax documents, including related records | 10 years from the end of the accounting period to which they relate |
| Meta Pixel cookies | usually up to 90 days or in accordance with Meta’s current settings |
| Data in Meta systems | in accordance with Meta’s current settings and terms |
| Data related to the loading of Google Calendar, Google Maps, and Google cookies | in accordance with Google’s technical and operational terms |
| Google Analytics cookies and data in Google Analytics | according to the current Google Analytics settings, usually no longer than 14 months unless a shorter period is configured |
After the relevant retention period expires, we will securely and irreversibly delete the personal data, unless further retention is required by law or for the establishment, exercise, or defence of legal claims.
5. With whom we share personal data
We do not disclose personal data to third parties without a legitimate purpose or legal basis. We share it only where necessary for the operation of the website, handling bookings, or complying with legal obligations.
5.1 Hosting provider
- Where: Slovak Republic
- Scope of data: form database, technical website data, e-mail communication, website content
- Purpose: technical operation of the website and related services
- Legal relationship: data processing agreement where the partner acts as a processor
5.2 Meta Platforms (Meta Pixel)
- Recipient: Meta Platforms Ireland Limited and Meta Platforms, Inc.
- Where: Ireland and the USA
- Scope of data: cookie identifiers, page visit data, conversion events, remarketing audiences
- Purpose: remarketing and measuring the effectiveness of advertising campaigns
For certain processing operations, Meta acts as an independent controller or a joint controller, as it determines part of the purposes and means of processing independently from us.
Further information: https://www.facebook.com/privacy/policy
5.3 Google Analytics
- Recipient: Google Ireland Limited and Google LLC
- Where: Ireland and the USA
- Scope of data: data about visits to the website, technical data about the device and browser, website usage data, and cookie identifiers
- Purpose: website traffic analysis, evaluation of content usage, and improvement of the operation of the website
We use Google Analytics only on the basis of your consent to analytical cookies. When processing data, Google may act as an independent controller to the extent that it determines its own purposes and means of processing under its own terms.
Further information: https://policies.google.com/privacy
5.4 Google (embedded Google Calendar and Google Maps)
- Recipient: Google Ireland Limited and Google LLC
- Where: Ireland and the USA
- Scope of data: IP address and technical data necessary to load the embedded calendar or embedded map, as well as cookies and other data processed by Google after consent to advertising cookies has been given
- Purpose: displaying the booking availability calendar and available dates, and displaying various locations through Google Maps
The embedded Google Calendar and Google Maps are not loaded without prior consent to advertising cookies. Google may act as an independent controller when processing data related to embedded content.
Further information: https://policies.google.com/privacy
5.5 WhatsApp
We only use a WhatsApp link in the form of wa.me on the website. When the website itself is displayed, we do not provide visitors’ personal data to WhatsApp. If a visitor clicks the link and continues to WhatsApp, any further processing of personal data is governed by the terms of Meta and WhatsApp.
5.6 Who does not receive your data
We do not sell your personal data, provide it to data brokers, or share it with third parties for commercial purposes outside the tools and services listed above that we use for website operation and marketing.
6. Transfer of personal data outside the European Union
Some of the tools we use, including Google Analytics, Google Calendar, Google Maps, and Meta Pixel, may involve the transfer of personal data to the USA.
Such transfer is safeguarded on the basis of the relevant legal mechanism under the GDPR, in particular:
- an adequacy decision under the EU–US Data Privacy Framework, where the relevant provider participates in that framework,
- or Standard Contractual Clauses (SCCs),
- where applicable, supplemented by technical and organisational safeguards.
The specific transfer mechanism depends on the relevant provider and its current legal framework.
If you would like more information about transfers of personal data to third countries, you may contact us at info@bellasirena.it.
7. Your rights
In connection with the processing of your personal data, you have the following rights in particular:
- the right of access to personal data under Article 15 GDPR,
- the right to rectification of inaccurate or incomplete data under Article 16 GDPR,
- the right to erasure under Article 17 GDPR, where the legal conditions are met,
- the right to restriction of processing under Article 18 GDPR,
- the right to data portability under Article 20 GDPR,
- the right to object to processing based on legitimate interests under Article 21 GDPR,
- the right to withdraw consent at any time, where processing is based on consent.
You may exercise your rights by e-mail at info@bellasirena.it. We will respond to your request without undue delay and no later than 30 days after receiving it.
Right to lodge a complaint
If you believe that we process your personal data in breach of the GDPR, you have the right to lodge a complaint with a supervisory authority:
Personal Data Protection Office of the Slovak Republic
Námestie 1. mája 18
811 06 Bratislava
Slovak Republic
E-mail: statny.dozor@pdp.gov.sk
Telephone: +421 2 32 31 32 14
Website: https://dataprotection.gov.sk
8. Automated individual decision-making and profiling
The controller does not carry out automated individual decision-making, including profiling, within the meaning of Article 22 GDPR.
When the Meta Pixel is used, Meta may create remarketing audiences in accordance with its own terms and its role in the processing of personal data.
9. Cookies
9.1 What cookies are
Cookies are small text files that are stored on your device when you visit a website. They help ensure that the website functions properly, remember your settings, and, where consent has been given, enable the use of analytical and advertising tools or the loading of third-party external content.
9.2 What cookies we use
Strictly necessary cookies
These cookies are required for the basic functioning of the website, security, and the proper management of your cookie preferences. Without them, the website may not function correctly.
Analytical cookies
We use these cookies only on the basis of your consent. They are used to measure website traffic, analyse the use of content, and improve the operation of the website through Google Analytics.
Analytical cookies may include, for example, the _ga cookie and other technical cookies used to measure traffic, sessions, traffic sources, and the basic attribution of interactions on the website, including cookies set through the PixelYourSite plugin, such as pys_session_limit, pys_start_session, pys_first_visit, pysTrafficSource, pys_landing_page, last_pysTrafficSource, and last_pys_landing_page.
Advertising cookies
We use these cookies only on the basis of your consent. They are used for remarketing and measuring advertising effectiveness through the Meta Pixel tool. This category also includes the loading of the embedded Google Calendar and embedded Google Map if their display leads to the use of Google cookies or other technologies with an advertising or multi-purpose character.
An example may be the NID (Google) cookie, which Google uses to remember user preferences and, in some cases, also to support advertising in Google services for signed-out users.
9.3 Cookie banner and consent management
We use CookieYes to manage cookies. On your first visit to the website, you can choose which categories of cookies you allow.
You can change your decision at any time via the “Cookie Settings” link available on the website.
If you do not consent to analytical cookies, Google Analytics will not be activated. If you do not consent to advertising cookies, Meta Pixel will not be activated and the embedded Google Calendar and Google Maps will not be loaded.
9.4 Managing cookies in your browser
You can also manage cookies directly in your web browser:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data
10. How we protect your data
We have implemented appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure.
These measures include in particular:
- encrypted data transmission between your device and the website (HTTPS/TLS),
- hosting on a secure server in the Slovak Republic,
- restricting access to personal data to authorised persons only,
- secure deletion of data after the retention period expires,
- appropriate contractual and legal safeguards when using external tools.
11. Changes to this policy
We may update this privacy policy from time to time, in particular if legislation, the tools we use, or the way the website operates changes.
The current version is always available on bellasirena.it.
Effective date: April 14, 2026
Last updated: May 3, 2026