Privacy Policy

Tenuta Monteluce ("we", "us", "our") operates the tenutamonteluce.com website and booking platform and is the data controller responsible for your personal data within the meaning of the UK GDPR and EU GDPR.

Our estate address is Boscobasso 11, 83040 Montemarano (AV), Italy. For any privacy query, contact us at hello@tenutamonteluce.com.

When you make a booking, enquiry or request through our site, we may collect:

• Contact details — your name, email address and phone number.

• Booking details — dates, room or apartment, number of guests, and any notes you share (dietary requirements, arrival details, special requests).

• Family information (SEN Family Retreats) — your children's ages and any sensory, dietary, routine or support needs you tell us about, so we can plan a stay that works for your family.

• Experience & transfer details — preferred dates, guest numbers and notes about your booking.

• Payment data — card details are handled entirely by our payment provider, Stripe. We never see or store your full card number.

• Account data — if you create a "My Stay" account, the email address you register with.

We process your personal data only where we have a lawful basis under GDPR:

• To take and manage your booking — under the contract we're entering into with you (Article 6(1)(b)).

• To respond to your enquiries and communicate about your stay — in our legitimate interest to provide the service you've asked for (Article 6(1)(f)).

• For the sensitive family information you share for SEN retreats — only with your explicit consent (Article 9(2)(a)), given via the consent box on the booking form. You can withdraw this consent at any time.

• To send confirmation, reminders and balance requests relating to your booking — as part of the contract.

We do not use your personal data for unrelated marketing without separate opt-in consent.

Information about your children's health, sensory needs or neurodivergent needs is "special category data" under GDPR Article 9. We only process this where you have given us explicit, opt-in consent on the booking form.

We treat this information with particular care: access is restricted to the staff who need it to plan and deliver your stay, it is not used for any other purpose, and it is not shared with third parties except where necessary to fulfil your booking and you have agreed, or where we are legally required to.

You can ask us to delete this sensitive information at any time by contacting hello@tenutamonteluce.com, or via the account deletion option in your "My Stay" profile.

We share your data only with the service providers we need to run your booking, acting as data processors under contract:

• Stripe — to take your deposit and balance payments securely. Stripe processes your card data under its own PCI-DSS compliance; we only receive confirmation of payment.

• Base44 — our platform provider that hosts the booking database, email and authentication.

• Google (Gmail / Google Sheets) — used to send you booking emails and, where you've asked us to, to export booking records to a spreadsheet for our team.

We never sell your data. We only share it where necessary to fulfil your booking, where you've asked us to, or where we're legally required to.

Some of our providers (including Stripe and Google) may process data outside the UK/EU. Where this happens, transfers are made under the safeguards required by GDPR — typically Standard Contractual Clauses — so your data is protected to a comparable standard.

We keep your booking records for as long as needed to provide your stay and for a reasonable period afterwards (generally up to 7 years) for accounting, tax and legal record-keeping. Sensitive SEN family information is deleted as soon as it is no longer needed for your stay, unless you ask us to keep it for a future visit. You can request earlier deletion at any time.

Under GDPR you have the right to:

• Access — ask what data we hold about you (you can also see your own bookings in the "My Stay" portal).

• Rectification — ask us to correct anything that's inaccurate.

• Erasure — ask us to delete your data (the "delete account" option in your profile removes your account and personal data).

• Restriction — ask us to limit how we use your data while a query is resolved.

• Portability — receive a copy of your data in a structured format.

• Objection — object to processing based on legitimate interests.

• Withdraw consent — for any data processed on consent (including SEN special category data), at any time, without affecting what we've already done with it.

To exercise any of these rights, email hello@tenutamonteluce.com. We'll respond within one month.

We use secure, access-controlled systems and restrict access to your data to staff who need it. Payment card data never touches our servers. No method of transmission or storage is completely secure, but we work to protect your data using appropriate technical and organisational measures.

Our site is not directed at children, and we don't knowingly collect personal data directly from children. Any information about children (for SEN retreats) is provided by their parent or guardian as part of a booking, and only with the explicit consent described above.

We use only the cookies needed for the site to function and (where enabled) basic, anonymised analytics to understand how the site is used. We don't use cookies for cross-site advertising profiling. Where non-essential cookies or analytics are used, we'll ask for your consent first.

We may update this policy from time to time. We'll post any changes on this page and, where significant, let you know by email. This page was last updated in August 2026.