Book room
Book Restaurant

Privacy Policy

INFORMATION ON THE PROCESSING OF PERSONAL DATA
of users of the hotelkalura.com website
(pursuant to Articles 13 and 14 of EU Regulation 2016/679 – “GDPR”)

Last updated: 13 October 2026

1. WHY THIS INFORMATION?

In accordance with Regulation (EU) 2016/679 (hereinafter the “Regulation”) and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, this page describes how the personal data of users who visit the website is processed www.hotelkalura.com, whether they make a purchase in the online shop, book a stay, sign up for the newsletter or get in touch with us.

This information does not concern other sites, pages or online services that can be reached via links that may be published on the site, but which refer to resources outside the domain.

2. DATA CONTROLLER

The data controller is COSTA CALDURA S.R.L., with its registered office at Via Vincenzo Cavallaro 13 – 90015 Cefalù (PA), VAT number IT06497310828, which operates Hotel Kalura.
Email: info@hotel-kalura.com – Tel.: +39 0921 422 501

3. DATA PROTECTION OFFICER

COSTA CALDURA S.R.L. has not appointed a Data Protection Officer (DPO), as it does not fall within the categories for which such appointment is mandatory under Article 37(1)(a), (b) and (c) of the Regulation.

4. TYPES OF DATA PROCESSED, PURPOSES AND LEGAL BASES

(a) Browsing data
The IT systems and software procedures used to operate this website collect, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (e.g. IP addresses or domain names of the devices used, URI/URL addresses of the resources requested, the time of the request, the method used, the size of the file received in response, the response status code and other parameters relating to the user’s operating system and IT environment). This data is processed to ensure the functioning and security of the website.
Legal basis: the Data Controller’s legitimate interests (Article 6(1)(f) of the Regulation).

b) Contact requests
The optional, explicit and voluntary sending of messages to contact addresses, via the forms on the website or to official social media profiles, involves the collection of the sender’s contact details and any other data provided, which are processed solely for the purpose of responding to enquiries.
Legal basis: the performance of pre-contractual measures at the request of the data subject (Article 6(1)(b) of the Regulation).

(c) Bookings for stays
Online bookings are made via the booking engine provided by DIRS21 (TourOnline AG), which acts as the data controller. The data provided (personal details, contact details, accommodation details and, where required, payment or guarantee details) are processed to manage the booking and the stay. During the stay, the Data Controller is also required by law to provide the guests’ personal details to the Public Security Authority (Article 109 of the T.U.L.P.S.) and to transmit data in aggregated form for statistical purposes.
Legal basis: performance of the contract (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c) of the Regulation).

(d) Purchases from the online shop
For orders placed in the shop (name, delivery and billing addresses, email, telephone number, products purchased, and any customer account), data is processed for the purposes of order management, payment processing, dispatch, the right of withdrawal, the warranty, and to fulfil accounting and tax obligations. Payments are processed by third-party providers (e.g. WooPayments/Stripe, PayPal, Apple Pay, Google Pay): the Data Controller does not have access to the full payment card details.
Legal basis: performance of the contract (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c) of the Regulation).

(e) Newsletter
When you subscribe to the newsletter, your name and email address will be processed for the purpose of sending you information and promotional communications about the Kalura brand. You may withdraw your consent at any time by clicking the link included in every email or by writing to info@hotel-kalura.com.
Legal basis: consent of the data subject (Article 6(1)(a) of the Regulation).

f) Job applications (“Work with us”)
The data contained in CVs and unsolicited applications are processed solely for the purposes of assessing candidates’ profiles and recruiting staff. Please do not include data relating to special categories (Article 9 of the Regulation) in your CV unless strictly necessary.
Legal basis: pre-contractual measures at the request of the data subject (Article 6(1)(b) of the Regulation and Article 111-bis of Legislative Decree 196/2003).

5. COOKIES AND TRACKING TOOLS

This website uses:

  • Technical cookies, which are necessary for the website, the shopping basket and the checkout to function, for selecting the language and for storing cookie preferences. They do not require consent.
  • Analytical cookies from Google Analytics 4 (Google Ireland Ltd.), which are used to obtain aggregated statistics on website usage. They are only installed following express consent given via the cookie banner.
  • Third-party cookies and scripts related to the DIRS21 booking system, payment systems and any embedded content (e.g. maps, videos, social media), which are subject to their respective privacy policies.

Preferences are collected and managed via the CookieYes platform. You may amend or withdraw your consent at any time by using the relevant button or icon on the website’s cookie banner, as well as via your browser settings.

6. SOCIAL MEDIA

For data processing carried out by the operators of social media platforms (Facebook, Instagram), please refer to their respective privacy policies. COSTA CALDURA S.R.L. processes data provided via its social media pages solely for the purpose of managing interactions with users (comments, messages, public posts, etc.), in accordance with current legislation.

7. NATURE OF THE CONTRIBUTION

With the exception of browsing data, the provision of data is optional; however, failure to provide data marked as mandatory will prevent us from processing your enquiry, booking or order. Failure to consent to newsletters and analytical cookies has no impact on your browsing experience or purchases.

8. RECIPIENTS OF THE DATA

Data may be disclosed to parties providing services to the Data Controller, designated as data processors pursuant to Article 28 of the Regulation (e.g. website hosting and maintenance providers, booking engines, payment platforms, couriers, accounting and tax advisers, and providers of analytics and email marketing services), as well as to public authorities in the cases provided for by law. The data is also processed by authorised staff of COSTA CALDURA S.R.L., who act on the basis of specific instructions. The data is not disclosed.

9. TRANSFER OF DATA OUTSIDE THE EU

Some suppliers (e.g. Google, Stripe, PayPal) may also process data outside the European Economic Area, in particular in the United States. In such cases, the transfer takes place on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) for certified providers, or the Standard Contractual Clauses approved by the European Commission.

10. RETENTION PERIOD

  • Browsing data: no longer than seven days, unless required for the investigation of criminal offences by the judicial authorities;
  • Enquiries: for as long as is necessary to deal with the enquiry, but in any event for no longer than 12 months;
  • Bookings and orders: for the duration of the business relationship and, in the case of accounting and tax documents, for 10 years (Article 2220 of the Civil Code);
  • Newsletter: until consent is withdrawn;
  • Applications: valid for a maximum of 12 months from receipt;
  • Analytics data (Google Analytics): up to 14 months;
  • Cookies: in accordance with the expiry times indicated in the cookie banner.

11. RIGHTS OF DATA SUBJECTS

Data subjects have the right to obtain from COSTA CALDURA S.R.L., in the cases provided for, access to their personal data, rectification, erasure, restriction of processing, data portability, as well as to object to the processing and to withdraw their consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal (Articles 15–22 of the Regulation).

Enquiries may be sent to COSTA CALDURA S.R.L., Via Vincenzo Cavallaro 13 – 90015 Cefalù (PA), email: info@hotel-kalura.com.

12. RIGHT TO LODGE A COMPLAINT

Data subjects who believe that the processing of their personal data is in breach of the provisions of the Regulation have the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it), as provided for in Article 77 of the Regulations, or to bring the matter before the appropriate courts (Article 79 of the Regulations).

13. AUTOMATED DECISION-MAKING PROCESSES

Personal data is not subject to automated decision-making, including profiling, within the meaning of Article 22 of the Regulation.

14. AMENDMENTS

This privacy policy may be updated from time to time. Users are advised to check this page periodically; the date of the last update is shown at the top.