1Who we are (Data Controller)
The Data Controller, i.e. the one who decides how and why your data is used, is:
ControllerBagni Ricci
VAT number02514820402
AddressLungomare Guido Spadazzi, 16, 47924 Rimini (RN)
Our businesses operate under the same Controller: the Bagni Ricci beach club, the Ricci di Mare restaurant, the Munell chiringuito and the Bellavista apartments. For any privacy request you can write to the address above, whichever business you dealt with.
2What data we collect and where it comes from
We only collect data you provide to us (or that someone gives us on your behalf when sending you a gift) and a few technical data unavoidable for the website to work.
| When | Data processed |
|---|
| Contact forms, email, phone, WhatsApp | First name, last name, email, phone number, your message, date and time of the request, and the page it was sent from. Whatever you write in the message. |
| Table bookings | Booking details (name, contacts, date, number of guests) are entered on the external booking platform we use (see section 5). |
| Shop: vouchers and gift vouchers | Name or company name, tax code / VAT number, address, postal code, city, province, email, phone (optional), SDI code or PEC (optional) for the invoice; order code and ordered vouchers; payment outcome from PayPal (transaction ID, payer email); IP address and date of the order. If it is a gift: recipient's name and email and your personal message. |
| Newsletter and offers | Email address (and name if given), your consent and its date. |
| Meta ads (Facebook / Instagram) | Name, email, phone and any answers you give in our lead forms; campaign and ad you responded to; date and time. More in section 4. |
| Reserved area | Login credentials (email and password) and a technical identifier to remember your login. |
| Browsing the site | IP address, browser type, pages visited and timestamps (technical server logs), session data and the voucher cart (see Cookies). |
We do not ask for special categories of data (health, opinions, religion…). If, for instance, you tell us about an allergy for a booking, we use it only to serve you safely: avoid writing it in free-text fields if you prefer not to leave a trace.
If someone gives you a gift voucher: your name and email were given to us by the buyer, who is responsible for having the right to share them. We use them only to deliver the gift and for nothing else, unless you decide to contact us or consent to receive our news.
3Why we use the data, on what basis and for how long
| Purpose | Legal basis | Retention |
|---|
| Answering your requests and bookings | Contract / pre-contract art. 6.1.b GDPR | For the time needed to answer and follow up, then up to 12 months. |
| Selling vouchers, processing payment, delivering the voucher and the gift email | Contract art. 6.1.b | Until the order is completed; order data is kept as below. |
| Invoicing and accounting, tax obligations | Legal obligation art. 6.1.c | 10 years, as required by tax and civil law. |
| Fraud prevention and site security (IP address, logs, anti-spam) | Legitimate interest art. 6.1.f | IP address is kept with the order; technical logs for a limited period. |
| Newsletter and promotional offers by email, SMS or WhatsApp | Consent art. 6.1.a | Until you withdraw consent, and in any case up to 24 months after our last interaction. |
| Contacting people who showed interest through Meta lead ads | Consent art. 6.1.a and, to answer your request, art. 6.1.b | Up to 24 months from collection, unless you become a customer or withdraw consent. |
| Reserved area login | Contract art. 6.1.b | As long as the account is active. |
| Defending our rights | Legitimate interest art. 6.1.f | For the time of any dispute. |
Providing data is optional, but for some purposes it is necessary: without invoice data we cannot fulfil an order; without a contact we cannot reply. Marketing consent is always free and never a condition for a purchase or a service. We do not take decisions based solely on automated processing and we do not carry out profiling that has effects on you.
5Who we share data with
Your data is never sold. We share it only with those needed to provide the service, within what is necessary:
| Who | Why | Role |
|---|
| Web hosting, maintenance and email service (webrimini.com) | Hosting of the website and database, sending of emails from the site. | Processor |
| PayPal (Europe) S.à r.l. | Payment of vouchers. We never see your card number: we only receive the outcome of the payment. | Independent controller |
| Meta Platforms Ireland Ltd. (Facebook, Instagram, WhatsApp) | Advertising campaigns, lead forms, social pages and plugins, WhatsApp conversations. | Independent / joint controller |
| Google (reCAPTCHA, Maps, Fonts, YouTube) | Anti-spam protection of forms, maps, fonts and videos shown on the site. | Independent controller |
| External table-booking platform (prenotazionibagnoricci.lasmkt.com) | Online table reservations. | Processor |
| Accountant / tax advisor | Bookkeeping and tax obligations. | Processor / independent |
| Public authorities | Where required by law. | Legal obligation |
Staff of the Controller working in service, beach, administration and bookings access the data only as far as needed for their tasks and are bound to confidentiality.
7Cookie
Cookies are small files the site stores on your device. Here is what this website uses:
| Cookie | What it is for | Type | Duration |
|---|
| ASP.NET_SessionId | Keeps your session and your voucher cart while you browse. | Technical | Until you close the browser |
| .ASPXFORMSAUTH | Keeps you logged in to the reserved area. | Technical | 60 minutes |
| riccidimare-Utente | Remembers your login in the reserved area. | Technical | 365 days |
| Google reCAPTCHA | Protects forms from spam and abuse. Loaded on pages with a contact form. | Third party (Google) | Up to 6 months |
| YouTube, Facebook plugin, Google Maps | Videos, Facebook events and maps shown on the Chiringuito and Contacts pages. The provider may set its own cookies when the content loads. | Third party | Set by the provider |
| PayPal | Payment page, on PayPal's website: we do not control cookies set there. | Third party | Set by PayPal |
The site does not use its own analytics or profiling cookies. You can block or delete cookies from your browser settings: technical cookies, however, are needed for the reserved area and the voucher cart. For third-party services, information on their cookies is in their own policies:
Google ·
Meta ·
PayPal.
8Security and minors
Security. The site works over an encrypted HTTPS connection; payments are made on PayPal's secure pages; prices and orders are checked by the server; access to the databases is restricted. No system is 100% safe, but we take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.
Minors. Our online services are meant for adults. Under Italian law a minor under 14 can consent to online services only with the authorisation of a parent or guardian; if you believe a child has sent us data without it, write to us and we will delete it.
9Your rights
At any time you can exercise these rights free of charge:
AccessKnow whether we process your data and get a copy.
RectificationCorrect inaccurate or incomplete data.
ErasureAsk us to delete your data when no longer needed or if you withdraw consent (data we are legally required to keep, such as invoices, remains).
RestrictionAsk us to “freeze” the use of your data in certain cases.
PortabilityReceive your data in a machine-readable format.
ObjectionObject to processing based on legitimate interest and to direct marketing.
Withdraw consentWhenever you want, without effect on what was done before.
ComplaintLodge a complaint with the data protection authority.
To exercise your rights write to info@bagniricci.it. We reply within 30 days (extendable in complex cases). To protect you, we may ask for proof of identity. If you think we have not handled your data properly you can complain to the Italian authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority of your country.
Write to us about privacy
10Changes to this notice
We may update this notice, for example if we add a service or change provider. The version in force is always the one published on this page, with the date of the latest update at the top. If changes are significant, we will let you know with a clearly visible notice.