Privacy policy
Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree no. 196/2003, as amended).
This policy covers the website sandgold.it, enquiries and bookings, and our newsletter. It applies to Såndgøld Alpine Glamping and Badl by Såndgøld.
1. Controller
Wieser Nature & Hospitality GmbH Winkelweg 1, 39032 Sand in Taufers (BZ), Italy VAT no. IT03174840219 Phone: +39 0474 788 008 Email: welcome@sandgold.it · Certified email (PEC): wieserhospitality@lamiapec.it
We have not appointed a data protection officer, as there is no legal obligation to do so. Please send any data protection requests to welcome@sandgold.it.
2. Overview
Providing the website Data: IP address, date and time, page visited, browser, operating system Legal basis: Art. 6(1)(f) GDPR (secure operation of the website) Retention: max. 30 days
Cookie consent Data: Consent status, random ID, date and time Legal basis: Art. 6(1)(c) GDPR (obligation to document consent) Retention: 12 months
Enquiries by email, phone or form Data: Name, contact details, content of the enquiry Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) or (f) (general enquiries) Retention: 24 months after last contact; if a contract is concluded, see Booking
Booking and stay Data: Name, address, contact details, travel dates, fellow travellers, vehicle/registration, dogs, payment data, identity document data Legal basis: Art. 6(1)(b) and (c) GDPR Retention: 10 years (accounting and tax obligations); identity data see section 5
Newsletter Data: Email, first name, last name, language, opens and clicks Legal basis: Art. 6(1)(a) GDPR; Art. 130 Italian Data Protection Code Retention: until withdrawal
Statistics Data: see Cookie policy Legal basis: Art. 6(1)(a) GDPR Retention: see Cookie policy
Marketing and advertising measurement Data: Online identifiers (cookies), pages visited, completed booking and its value, for Google Ads your email address in encrypted (hashed) form Legal basis: Art. 6(1)(a) GDPR Retention: see Cookie policy
3. Website hosting and content
Hosting: This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit the site, Vercel processes the access data listed above in order to deliver the pages and prevent attacks. Vercel is certified under the EU-US Data Privacy Framework. Standard contractual clauses are also in place. We have a data processing agreement with Vercel under Art. 28 GDPR.
Content and images: Texts and images are managed via the Sanity content management system of Sanity AS, Oslo, Norway, and delivered through its content delivery network. Your IP address is processed for technical reasons. Norway is a member of the European Economic Area. Where Sanity uses sub-processors outside the EEA, this is based on standard contractual clauses.
Fonts: All fonts are hosted locally on our server. No connection is made to Google or other font providers when you visit the website.
4. Cookies and consent
We use strictly necessary cookies and, only with your consent, cookies and services for statistics and marketing. Consent is managed with Cookiebot by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Details, the current list of all cookies and the option to change your choice at any time can be found in our Cookie policy.
5. Booking and stay
Booking system: Online bookings are made via OnePageBooking by HNS – Hotel Net Solutions GmbH, Berlin, Germany, which processes your booking data on our behalf (Art. 28 GDPR). When you click “Book”, you leave our website. The privacy information on the booking page also applies.
Payment: Payments are handled by the payment service providers offered during the booking process: credit card (Mastercard, Visa) via hobex AG, Salzburg, Austria, and PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. We do not receive your full card details.
Statutory reporting obligations: As an accommodation provider, we are required by law to – report the personal details of all guests to the police headquarters (Questura) via the “Alloggiati Web” portal within 24 hours of arrival (Art. 109 of the Italian Consolidated Law on Public Security). For this we need a valid identity document. We do not keep copies of your identity document beyond what this report requires; – send statistical data on arrivals and overnight stays to the Provincial Statistics Institute ASTAT or ISTAT; – collect the municipal tourist tax and pay it to the Municipality of Sand in Taufers.
The legal basis in each case is Art. 6(1)(c) GDPR. A stay is not possible without this information.
Retention: Booking and invoice data are kept for 10 years (Art. 2220 Italian Civil Code, Art. 22 Presidential Decree 600/1973). Other data relating to your stay is deleted no later than 24 months after departure, unless a longer retention period is required by law.
Recipients: In addition to the service providers and authorities named above, our tax adviser and, where necessary, legal adviser have access to the data they need. They are bound by professional secrecy.
6. Contact
If you contact us by email, phone or via a form, we process your details in order to reply. For email and office organisation, we use Google Workspace by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, as a processor. Data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework).
7. Newsletter
You only receive our newsletter if you actively subscribe and confirm your email address via a confirmation link (double opt-in). We send it using Klaviyo, Inc., 125 Summer St, Boston, MA 02110, USA. Klaviyo is certified under the EU-US Data Privacy Framework. Standard contractual clauses are also in place.
We analyse whether and when a newsletter is opened and which links are clicked in order to improve our content. This analysis is part of your consent.
Guests: If you have already booked with us, we may send information about similar services of our own to the email address you provided when booking (Art. 130(4) Italian Data Protection Code). You can object to this at any time, free of charge.
You can unsubscribe at any time via the link in every newsletter. After you unsubscribe, we keep your email address on a suppression list so that you receive no further newsletters (Art. 6(1)(f) GDPR).
8. External services and media
The following services are only loaded once you consent via the cookie banner or actively click on them:
– Google Analytics 4 / Google Tag Manager (Google Ireland Ltd.): anonymised audience measurement with truncated IP addresses. – Google Ads (Google Ireland Ltd.): measuring whether a booking follows a click on one of our ads (conversion tracking). For this, a click identifier is passed on when you move to the booking page onepagebooking.com. When you book, your email address may be sent to Google in encrypted (hashed) form to attribute the booking to the ad (enhanced conversions). Data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework). – Meta Pixel (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland): measuring the effect of our advertising on Facebook and Instagram and building audiences for this advertising. We are joint controllers with Meta for collecting the data on our website and transmitting it to Meta (Art. 26 GDPR). Data may be transferred to Meta Platforms, Inc. in the USA (EU-US Data Privacy Framework). – OpenAI advertising measurement (OpenAI Ireland Ltd., Dublin, Ireland): measuring the effect of our advertising with OpenAI. Data may be transferred to OpenAI in the USA (see section 10). – Klaviyo Onsite (Klaviyo, Inc., USA): recognising newsletter subscribers on our website and analysing the pages they visit, to make the newsletter more relevant.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings” in the footer.
9. Social media
We are present on Instagram and Facebook (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland). Our website contains no plugins, only simple links. Data is only transmitted through these links when you click them. For the Meta Pixel, see section 8. We are joint controllers with Meta for the statistics of our profile pages (Insights) (Art. 26 GDPR). The agreement is available at facebook.com/legal/terms/page_controller_addendum.
10. Transfers to third countries
Some of our service providers are based in the USA. Transfers are based on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 or on standard contractual clauses (Art. 46 GDPR).
11. Your rights
You have the right to – access your data (Art. 15 GDPR), – rectification (Art. 16), – erasure (Art. 17), – restriction of processing (Art. 18), – data portability (Art. 20), – object to processing based on legitimate interests and to direct marketing (Art. 21), – withdraw your consent at any time with effect for the future (Art. 7(3)).
A simple message to welcome@sandgold.it is sufficient. We will reply within one month.
You also have the right to lodge a complaint with a supervisory authority. Our competent authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy, www.garanteprivacy.it. You may also contact the supervisory authority in your country of residence.
12. Obligation to provide data, no automated decisions
The data required for bookings and statutory reporting is necessary for the contract. All other information is voluntary. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
13. Changes
We update this policy when our services or the legal situation change. The version published here applies.
Last updated: November 2026