Privacy policy
About us. Sinis & Costa Verde is the name under which Claudio Concas lets three holiday homes in Sardinia, as a private individual and not as a business: Casa Katia and Casa Amelia in Oristano (CIN IT095038C2000Q8747: they are two flats in the same property unit and therefore share the same CIN) and Torre dei Corsari, in the municipality of Arbus (CIN IT111001C2000Q8835). The CIN is the Italian national identification code for holiday lets. Contact: email [email protected], phone and WhatsApp +39 366 606 5168.
Data controller. The controller of the personal data collected through this website (siniscostaverdesardegna.com) is Claudio Concas, a private individual. For any privacy question or to exercise your rights write to [email protected] or contact +39 366 606 5168 (phone or WhatsApp). No data protection officer (DPO) has been appointed.
What data we collect through the form. If you fill in the availability request form we collect: the house you are interested in, arrival and departure dates, number of adults and children, whether you travel with pets, your full name, email, phone number (optional) and your message (optional). The request also includes the page language and your confirmation that you have read this notice. The form sends the data directly from your browser to the Web3Forms service, which therefore also receives technical connection data such as your IP address. Please do not write special categories of data (for example health data) in your message. The website has no private areas, requires no registration and does not process online payments.
Availability check. When you choose a house in the form, the website shows the nights already booked by reading that house's booking calendars (in iCal format, for example from Booking.com) through a function running on Cloudflare's servers. Only the name of the house is sent to the server: the dates you choose stay in your browser until you send the form. From the calendars the website extracts only the booked nights, with no names or other guest data, and at this stage it collects no personal data about you beyond the technical browsing data described below.
Browsing data. The website is hosted and delivered by Cloudflare (Cloudflare, Inc., Pages service and content delivery network). Like any web server, Cloudflare processes the IP address and other technical request data (for example date and time, page requested, browser type) and may keep them in its logs to protect the website, prevent abuse and make it work quickly. The legal basis is our legitimate interest in the security and proper functioning of the website (Art. 6(1)(f) GDPR). We do not use these data to identify you or for statistics: the website uses no analytics tools, no profiling cookies and no embedded maps.
Purposes and legal basis. We use request data only to reply to you, send you information and any stay offer and, if you decide to book, to manage the booking. The legal basis is the performance of pre-contractual steps taken at your request and, if you book, of the contract (Art. 6(1)(b) GDPR). We also keep some data to comply with legal obligations, such as tax rules (point c) and, where needed, to establish or defend our rights (point f, legitimate interest). The box you tick in the form only confirms that you have read this notice: it is not consent to marketing. We send no newsletters or promotional messages, we do not carry out profiling and we take no decisions based solely on automated processing (Art. 22 GDPR).
Providing your data. Name, email, house, dates and number of guests are needed to reply: without them we cannot handle your request. Phone number and message are optional.
Who receives the data. The data are processed by us and, on our behalf and only to the extent necessary, by these providers: Cloudflare, Inc. (website hosting and delivery); Web3Forms, a service run by Web3Creative, which operates from India and receives and stores the form data and forwards it to our mailbox as data processor (Art. 28 GDPR, under the data processing agreement incorporated into its terms of service); Google, provider of our Gmail mailbox, where requests and emails arrive. Web3Creative in turn uses sub-processors, including Amazon Web Services (hosting, database and email delivery), Cloudflare (network, DNS and security), Hetzner Online GmbH (infrastructure in the EU, in Germany and Finland) and, for spam filtering, CleanTalk Inc. and Automattic (Akismet service), which receive the IP address and email address of the person sending the form; the full list is in the Web3Forms DPA (https://web3forms.com/dpa). If you write to us on WhatsApp, the service is provided by WhatsApp Ireland Limited (Meta group), which processes data as an independent controller under its own privacy policy. If you book, data may be disclosed where necessary to our tax adviser and, where required by law, to the competent authorities. We do not sell or pass on data to third parties for commercial purposes.
Transfers outside the European Economic Area. Some providers also process data outside the EEA. Cloudflare, Inc. and Google LLC (United States) state that they participate in the EU-U.S. Data Privacy Framework, found adequate by the European Commission in its decision of 10 July 2023, and that they use the Commission's standard contractual clauses for other transfers or if the certification lapses (sources: Cloudflare and Google GDPR pages, consulted on 16/10/2026). Web3Creative operates from India and, according to the Web3Forms DPA (version 1.0 of 13/07/2026, consulted on 16/10/2026), form data may be processed outside the EEA, including by the sub-processors listed above: for these transfers the DPA incorporates the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), with Web3Creative as data importer and us as data exporter. DPA text: https://web3forms.com/dpa; Web3Forms privacy policy: https://web3forms.com/privacy. WhatsApp states in its privacy policy that it transfers data outside the EEA, including to the United States, with the safeguards described there (https://www.whatsapp.com/legal/privacy-policy-eea).
WhatsApp and email. If you tap the WhatsApp button you leave the website and use the WhatsApp app, which processes data under its own privacy policy; we see your number, your profile name and the messages you send us. Using WhatsApp is optional: you can always choose the form or email instead. Emails pass through your email provider and ours (Gmail). Use these channels only for what you want to share with us.
How long we keep data. We keep requests with no follow-up (requests sent through the form, emails, WhatsApp messages and related data) for no more than 12 months from the last contact: within that period we delete them from our mailbox, from WhatsApp and also from the Web3Forms dashboard. If the request becomes a booking, we keep tax records for the period required by tax law and other data until the related rights lapse (usually 10 years). At Web3Forms: according to the provider's privacy policy (last updated 13/07/2026, consulted on 16/10/2026) form submissions are stored in a database on Amazon Web Services, encrypted at rest, for up to three years from the date of submission and then deleted automatically, unless a shorter period applies under the service plan or we delete them earlier, as we do as described above; server logs are deleted regularly. Web3Forms privacy policy: https://web3forms.com/privacy. Cloudflare's technical logs are kept for the periods stated in Cloudflare's privacy policy (https://www.cloudflare.com/privacypolicy/).
Guest data during the stay. If you book, the law requires us to collect guests' personal details and identity document details to report them to the police (Alloggiati Web portal), as well as data for statistical purposes and for the municipal tourist tax. We will give you a specific notice when you book or check in.
Your rights. You may ask us at any time for access, rectification, erasure, restriction of processing and portability of your data, and object to processing based on legitimate interest (Arts. 15-22 GDPR). To exercise them write to [email protected]: we reply without undue delay and in any case within one month. You may also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the country where you live or work.
Minors. The website is not aimed at children under 14: requests must be sent by an adult.
Cookies and updates. For cookies see the Cookies page. This notice may be updated; the current version is always published on this page. Last updated: 16/10/2026.