Updated: 3 October 2026 · 2026-10-02.1
Controller and contact
The controller is Paeonia Resources s.r.l., VAT/tax number IT08343120963, Via Antonio Gambacorti Passerini 2, 20900 Monza (MB), Italy. For privacy questions or to exercise your rights: privacy@paeoniasrl.com. For enquiries about stays: ciao@villaeuropahsiao.com.
Information we process
We process information you choose to send: name, email address, optional telephone number, message, stay dates and number of adults and children. The number of children helps us assess capacity; the form does not request their names. Do not include identity documents, health information or payment card details in your message. The hosting provider may process connection information and security logs.
Purposes and legal bases
We use stay enquiries to respond, check availability and prepare a possible confirmation: steps taken at your request before entering a contract and, if your stay is confirmed, performance of the contract (GDPR Article 6(1)(b)). We handle other enquiries and protect the website on the basis of our legitimate interest in providing assistance and maintaining security (Article 6(1)(f)). Administrative and legal obligations rely on Article 6(1)(c). The ‘I have read the notice’ checkbox records acknowledgement; it is not marketing consent.
How the forms work
The contact form prepares a message in your email app: it is sent only when you send it from that app. Stay requests always require confirmation by the property and do not collect payments. The booking method available on these pages is described in the form and the note below. We do not store form drafts in your browser. These pages do not collect newsletter subscriptions.
Retention
Enquiries that do not become bookings are kept for six months after the last contact and then deleted. The property applies the same rule to copies in email and working files. Documents for confirmed bookings follow applicable administrative and tax retention requirements; information needed to establish or defend a right may be retained for the period needed for that purpose. The technical preference for this notice lasts six months in your browser. The OVH application’s spam prevention counters use identifiers derived with a secret key, without storing a plain IP address, and are deleted within 24 hours after the counter expires. Hosting provider log retention depends on its service.
Recipients, external services and transfers
Authorised property staff and providers needed for hosting, email and technical support may access information under their respective roles and agreements. Information is not published or sold. On these pages photos, fonts and videos are local; social media opens through links. The embedded map loads from Google Maps only when you choose “Show the map”. Google may then receive your IP address and use cookies under its own privacy notice at policies.google.com/privacy. Before activation, no request is sent to Google for the map. Your choice applies only to the current page and is not stored. When you follow a link to Google, social media or the original booking website, those services apply their own privacy notices; they may process data outside the European Economic Area. Transfers by providers used by the property are subject to GDPR Chapter V safeguards, such as adequacy decisions or standard contractual clauses where required.
Your rights
You can request access, rectification, erasure or restriction and, where applicable, portability and object to processing based on legitimate interests. Email privacy@paeoniasrl.com with your request and, if available, your stay reference. The controller may ask only for information needed to verify your identity and responds within GDPR deadlines, normally one month. You may complain to the Italian Data Protection Authority (garanteprivacy.it) or the competent authority in your country.
Required information and automated decisions
Name, email, dates and guest numbers are necessary for a stay enquiry; without them we cannot handle it. A telephone number and additional message are optional in the direct request form. We do not profile visitors or make automated decisions with legal effects on them. Acceptance of a stay is a decision made by the property.
AI assistant for your stay
The assistant is optional: choose “Start the AI assistant”, then send a question. The server sends its text, the language and up to the last eight messages to OpenAI to generate a reply. Do not enter personal or sensitive information, identity documents or payment details. Help with planning a stay relies on steps taken at your request before entering a contract (GDPR Article 6(1)(b)); abuse prevention relies on legitimate interests (Article 6(1)(f)). AI can make mistakes: availability, prices and bookings need the property’s confirmation. You can use the stay request form, email or phone without AI.
Summaries sent to the property
After each exchange, questions and replies are summarised and emailed to giuseppe@paeoniasrl.com so the property team can follow up on enquiries. This is neither a booking nor a guarantee of a reply. A private queue keeps information needed for sending for up to seven days; content is removed once the email service accepts the message, which does not confirm delivery. Only authorised staff can access emailed summaries. They are kept to handle the enquiry and any resulting relationship, then deleted unless legal obligations or documented needs to establish or defend a right require otherwise. Stay enquiries that do not become bookings retain the six-month period after the last contact. The chat does not automatically collect contact details from the forms. Technical sending uses Microsoft 365 through ciao@villaeuropahsiao.com. A copy may remain in Sent Items and in the recipient’s mailbox; the same access and retention rules apply to both. Hosting backups may retain copies of queued content for up to 31 days; expiry is reapplied after restoration.
Assistant retention and providers
The conversation remains in temporary page memory without being saved in browser storage; the server manages the separate email queue described above. API requests use store:false. OpenAI does not train models on API data by default; it may retain abuse-monitoring logs for up to 30 days, subject to legal or security exceptions. The provider’s technical processing is separate from emailed summaries. Our pseudonymous abuse-prevention counters contain no chat text or plain IP addresses and are deleted within 48 hours. Processing may take place outside the European Economic Area with GDPR Chapter V safeguards where required; exclusive EU data residency is not guaranteed. Details: https://developers.openai.com/api/docs/guides/your-data.
Enquire
Direct requests on the OVH website send form information over HTTPS to the villa’s application. The reference, language, request contents, status and version of the notice acknowledged are recorded. Management access is restricted to the property. Direct requests become available only after the database and email service are configured.