1. Who is responsible for your data
Villa Magnus is the data controller for the personal data described here. We decide what is collected and why.
For anything to do with privacy — a question, a correction, a request to delete what we hold — message us on WhatsApp at +34 637 472 828, or write to us through the enquiry form.
2. What we collect
When you send an enquiry. The form asks for your name, your email address, your check-in and check-out dates, the number of guests, and a message. Only the name and the email address are required; the rest is optional.
The form also carries a hidden field that only automated bots ever fill in. It collects nothing from a real visitor.
When you read the site. Serving a page means our host sees your IP address, your browser and device type, the pages you view, and the time of each request.
3. Why we use it, and the legal basis
To answer your enquiry and arrange your stay. Legal basis: Article 6(1)(b) of the GDPR — steps taken at your request before entering into a contract.
To keep the site online and secure. Legal basis: Article 6(1)(f) — our legitimate interest in a site that works and is not abused.
To see, in aggregate, how the site is used. Legal basis: Article 6(1)(f) — our legitimate interest in knowing which pages get read. What we see is counts, not people.
We do not sell your data, we do not use it for advertising, and we do not build a profile of you.
4. Who else handles it
A small number of service providers process data for us, each only on our instructions.
Web3Forms receives your enquiry when you press send and passes it to us by email.
Zoho hosts the mailbox where enquiries arrive and where the conversation is kept.
Cloudflare hosts and delivers this site, and provides one of our two analytics tools. It processes your IP address and request metadata to serve pages and to block attacks.
Plausible Analytics produces the aggregate visitor statistics.
Google supplies the map embedded in the location section of our homepage — see section 7.
Where any of them transfer personal data outside the European Economic Area, the transfer relies on the Standard Contractual Clauses approved by the European Commission.
5. How long we keep it
Enquiry correspondence — your form submission and the emails that follow it — is kept for 24 months, then deleted.
6. Your rights
The GDPR gives you the right to ask us for a copy of the data we hold about you (access), to have it corrected (rectification), to have it deleted (erasure), to have us pause our use of it (restriction), to receive it in a portable file (portability), and to object to our use of it where we rely on legitimate interests (objection).
Use either of the contact routes in section 1. There is nothing to pay, and the law gives us one month to reply.
If you think we have handled your data badly, you can complain to a supervisory authority: in Italy, the Garante per la protezione dei dati personali, or the authority in the EU country where you live.
7. Cookies
Both analytics tools on this site — Plausible Analytics and Cloudflare Web Analytics — are cookieless. They set no cookies, store nothing on your device, and cannot follow you from one website to another. That is why this site does not have to ask your permission to count a page view.
The map does set cookies. The location section of our homepage embeds a Google map, which loads only when you scroll down to it. When it loads, Google receives your IP address and sets its own cookies in your browser, under Google's privacy policy rather than ours.
Our own site. We store one small item in your browser so the cookie notice does not reappear on every page. Nothing else is stored, and the typefaces are served from our own server rather than a third party's.
8. Changes to this notice
If we change how we handle personal data, we will update this page and change the date below.
Last updated: 9 August 2026.