Last updated: July 2026

This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018. This English text is provided for your convenience. In case of any discrepancy, the Italian version prevails.

01 · DATA CONTROLLER

The controller of the data collected through this website is Michelangelo S.r.l. (the "Company", "we"), acting through its legal representative Maurizio Mangia, which operates the Leucasia Suites Collection. Registered office: [to be confirmed]. · VAT / Tax code: 5 395 750 754. · Certified email (PEC): michelangelosrl@tutelapec.it. For any question about this notice or your data, you can write to us at info@leucasiasuites.com. The Company has not appointed a Data Protection Officer (DPO), as the conditions requiring one under Article 37 GDPR do not apply.

02 · WHAT DATA WE COLLECT

We collect personal data at two moments: when you contact us through the site and when you become our guest.
Enquiries from the site
Name and surname, email, phone (optional), property of interest, preferred dates, number of guests, your message and how you heard about us.
Guests
Booking and stay details, data needed for payment (handled by the payment provider), and the identity-document data that the law requires us to register for every adult guest (see section 04). Messaging If you write to us via WhatsApp or the site chat, we process the content of the conversation and the associated contact details.
Technical data
While you browse, we collect limited technical and statistical data through cookies, described in the dedicated Cookie Policy.

03 · WHY WE USE IT AND ON WHAT BASIS

Purposes and legal bases We process your data for the following purposes, each on the legal basis indicated:
• To answer your enquiry and prepare your booking — pre-contractual measures taken at your request (Art. 6.1.b GDPR).
• To manage your stay and booking — performance of the contract (Art. 6.1.b GDPR).
• To manage payments and invoicing — performance of the contract and legal obligation (Art. 6.1.b and 6.1.c GDPR).
• Guest registration with the authorities, tourist tax, tax and accounting obligations — legal obligation (Art. 6.1.c GDPR).
• Browsing statistics (non-essential cookies) — your consent (Art. 6.1.a GDPR).
• Newsletter and promotional communications, if you subscribe — your consent (Art. 6.1.a GDPR).
• Personalised marketing and remarketing (Meta) — your consent (Art. 6.1.a GDPR); see the Marketing Privacy Notice.
• Establishing or defending a legal claim — legitimate interest (Art. 6.1.f GDPR).

04 · WHO WE SHARE IT WITH

We do not sell your data. We share it only with those who help us run the site and the properties, or where the law requires it:
• Website hosting and forms: Tilda (Tilda Publishing).
• Statistics: Google Analytics 4 — Google Ireland Ltd.
• Marketing and remarketing: Meta Platforms Ireland Ltd. (Meta Pixel) and the email marketing platform [to be confirmed, e.g. Mailchimp / Brevo].
• Booking engine and payment provider, where used for a booking: [to be confirmed].
• Messaging: WhatsApp (Meta Platforms Ireland Ltd.), if you contact us through this channel.
• Public authorities: the Italian State Police (guest registration through the Alloggiati Web portal) and the Municipalities of Lecce and Gallipoli (tourist tax), as required by Italian law. Each external provider acts as a data processor under a written agreement (DPA).

05 · TRANSFERS OUTSIDE THE EU

Some providers (for example Google and Meta) may process data outside the European Union, in particular in the United States. Where this happens, the transfer is protected by an adequacy decision (EU-US Data Privacy Framework) or by Standard Contractual Clauses approved by the European Commission. You may ask us for a copy of the safeguards in place.

06 · HOW LONG WE KEEP IT

We keep your data only as long as needed for the purpose it was collected:
• Enquiry messages (no booking): up to 12 months, then deleted.
• Booking and stay data: for the period required by tax law, as a rule 10 years.
• Guest registration data (Alloggiati Web): as required by public-security law.
• Statistical data (analytics): for the period stated in the Cookie Policy.
• Marketing consent / newsletter subscription: until you withdraw it.

07 · YOUR RIGHTS

You have the right to access your data, to rectify or erase it, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, write to info@leucasiasuites.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the supervisory authority of your country of residence.

08 · PROVISION OF DATA

Providing the data needed to answer your enquiry and manage your booking is essential: without it we cannot proceed. Providing identity-document data is a legal obligation. Providing data for marketing purposes is optional: refusing it does not affect your booking in any way.

09 · COOKIES

The site uses technical cookies and, with your consent, statistical and marketing cookies. Details, durations and how to manage your choices are in the Cookie Policy.

10 · CHANGES

We may update this notice over time. The current version and its date are always shown at the top. Material changes will be signalled on the site.