Privacy Policy
As of: 08.10.2026
We are pleased that you have shown interest in our business. Data protection is a matter we take very seriously. Use of our website is possible without providing personal data; however, if a data subject wishes to use specific services offered through our website, the processing of personal data may become necessary. Where such processing is necessary and no statutory basis exists, we generally obtain the consent of the data subject.
The processing of personal data, such as name, address, e-mail address or telephone number, is always carried out in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national data protection provisions. Through this declaration, we wish to inform the public of the nature, scope and purpose of the personal data we collect, use and process, and of the rights to which data subjects are entitled.
As data controller, we have implemented numerous technical and organisational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may have security vulnerabilities, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g. by telephone.
Definitions
This declaration is based on terminology used by the European legislator in Regulation (EU) 2016/679 (GDPR):
a) Personal data — any information relating to an identified or identifiable natural person ("data subject"), who can be identified directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier, or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
b) Data subject — any identified or identifiable natural person whose personal data are processed by the controller.
c) Processing — any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, restriction, erasure or destruction.
d) Restriction of processing — the marking of stored personal data with the aim of limiting their processing in the future.
e) Profiling — any automated processing of personal data used to evaluate certain personal aspects of a natural person, in particular to analyse or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
f) Pseudonymisation — processing personal data so that they can no longer be attributed to a specific data subject without additional information, provided such information is kept separately and subject to appropriate technical and organisational measures.
g) Controller — the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.
h) Processor — a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
i) Recipient — a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether a third party or not.
j) Third party — a natural or legal person, public authority, agency or body other than the data subject, controller, processor, and persons authorised to process personal data under their direct authority.
k) Consent — any freely given, specific, informed and unambiguous indication of the data subject's wishes, by which they signify agreement to the processing of personal data relating to them.
Controller
The controller for the purposes of Regulation (EU) 2016/679 (GDPR) and other applicable national data protection provisions is:
Cardu's Residenze & C. S.R.L. Unipersonale Alberto Cardu (legal representative) Via Roma 167, 09124 Cagliari (CA), Italy Phone: +39 393 5445454 E-mail: cardusresidenze@gmail.com VAT ID: IT03957610920
Cookies / SessionStorage / LocalStorage
Our website uses cookies, LocalStorage and SessionStorage — technologies that allow your browser to store data on your computer or mobile device — in order to make our offering more user-friendly, effective and secure. You can prevent their use by adjusting your browser settings.
Many cookies contain a so-called "cookie ID", a unique string that allows websites to associate the visited pages with the specific browser in which the cookie was stored, distinguishing it from other browsers. This allows us to recognise users and make our website easier to use, for example so users don't have to re-enter access data on every visit.
You may, at any time, prevent the setting of cookies through your browser settings and permanently object to their use. Cookies already set may also be deleted at any time. Disabling cookies may mean that not all functions of our website can be fully used.
Collection of general data and information
Our website automatically collects a range of general data and information whenever it is accessed, stored in the server log files: browser type and version, operating system, referring website, sub-pages accessed, date and time of access, IP address, Internet service provider, and similar data useful in the event of cyberattacks.
This data does not allow any conclusions to be drawn about the data subject and is used solely to: correctly deliver the content of our website, optimise its content, ensure the security and functionality of our IT systems, and, in the event of a cyberattack, provide law enforcement authorities with the information necessary for prosecution. Anonymous log data is stored separately from any personal data provided by a data subject.
Contact possibility via the website
The website contains information enabling quick electronic contact with our business, including a general e-mail address. If a data subject contacts us by e-mail or via a contact form, the personal data transmitted is automatically stored and used solely for the purpose of processing the request or contacting the data subject. This data is not disclosed to third parties.
Routine erasure and blocking of personal data
We process and store personal data only for the period necessary to achieve the purpose of storage, unless otherwise required by law. Once the storage purpose no longer applies, or a retention period prescribed by law expires, personal data is routinely blocked or erased in accordance with legal requirements.
Processing methods
Personal data is processed using manual, IT and telematic tools, following logic strictly related to the purposes indicated above, and in a way that ensures its security and confidentiality, in compliance with the principles of lawfulness, fairness, transparency, data minimisation and accuracy under Art. 5 GDPR. We adopt technical and organisational measures appropriate under Art. 32 GDPR to prevent data loss, unlawful or improper use, and unauthorised access.
Data access
Personal data collected may be made accessible, for the purposes described above, to:
- our staff and collaborators, as persons authorised to process data;
- third parties carrying out outsourced activities on our behalf, such as our accountant/tax advisor, the provider of our booking management system (channel manager / PMS), our website hosting provider, and our laundry service provider, acting as external data processors under Art. 28 GDPR.
Personal data is never disseminated.
Transfer of data to third countries
As our website receives booking enquiries from guests worldwide, certain personal data may be processed through services (e.g. Google Analytics) that involve the transfer of data to countries outside the EU, in particular the United States. Such transfers take place on the basis of appropriate safeguards: where the provider adheres to the EU-U.S. Data Privacy Framework (recognised as adequate by the European Commission's decision of 10 July 2023), the transfer relies on that framework; alternatively, on the Standard Contractual Clauses approved by the European Commission under Art. 46 GDPR, or other appropriate safeguards provided by the service provider. Further information on these safeguards is available upon request, using the contact details above.
Rights of the data subject
Every data subject has the right to:
- Right of confirmation: obtain confirmation as to whether personal data concerning them is being processed.
- Right of access: obtain information about their stored personal data and a copy of it, including the purposes of processing, categories of data and recipients.
- Right to rectification: obtain, without undue delay, the correction of inaccurate or incomplete personal data.
- Right to erasure ("right to be forgotten"): obtain erasure of personal data where the conditions of Art. 17 GDPR apply.
- Right to restriction of processing: obtain restriction of processing where the conditions of Art. 18 GDPR apply.
- Right to data portability: receive personal data in a structured, commonly used, machine-readable format, and transmit it to another controller.
- Right to object: object at any time to the processing of personal data on grounds relating to their particular situation, as well as for direct marketing purposes.
- Right not to be subject to automated decision-making, including profiling, which produces legal effects concerning them. We confirm that we do not use automated decision-making producing legal effects on the data subject. The website may use advertising and remarketing cookies (e.g. Google Ads) for marketing purposes, activated only with specific consent given through the cookie banner: see our Cookie Policy for details.
- Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
- Right to lodge a complaint: every data subject has the right to lodge a complaint with a supervisory authority, in particular the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it), if they consider that the processing of their data infringes the GDPR.
To exercise any of these rights, data subjects may contact us at any time using the details above.
Legal basis for processing
- Art. 6(1)(a) GDPR: processing based on the data subject's consent.
- Art. 6(1)(b) GDPR: processing necessary for the performance of a contract to which the data subject is party (e.g. booking management).
- Art. 6(1)(c) GDPR: processing necessary to comply with a legal obligation (e.g. tax requirements, mandatory guest reporting to public security authorities).
- Art. 6(1)(f) GDPR: processing necessary for the purposes of legitimate interests pursued by the controller or a third party, provided such interests are not overridden by the data subject's fundamental rights.
- Art. 6(1)(a) GDPR: processing for marketing and targeted advertising purposes (e.g. remarketing via Google Ads), based on the data subject's specific consent given through the cookie banner, revocable at any time.
Retention period
Personal data is retained for as long as necessary to fulfil the purposes for which it was collected, in compliance with applicable tax and civil-law retention periods. In particular:
- data relating to simple contact requests (e.g. via the contact form, without a completed booking) is retained for a maximum of 6 years from the last contact with the data subject, after which it is deleted or anonymised;
- data contained in accounting and tax documents (e.g. invoices, receipts) is retained for 10 years, as required by Art. 2220 of the Italian Civil Code and applicable tax law.
Provision of personal data: statutory or contractual requirement
The provision of personal data is partly required by law (e.g. tax regulations, mandatory reporting to public security authorities) and partly necessary for the conclusion and performance of the accommodation contract. Failure to provide such data may result in the inability to complete a booking or stay.
Automated decision-making
As a responsible company, we do not use automated decision-making or profiling.
Updates to this declaration
This declaration was drawn up on 24.09.2026 and may be amended over time in response to regulatory changes or changes to our data processing activities. Data subjects are invited to check this page periodically.
General Cookies
Cookies from WordPress
| Name | Purpose | Validity |
|---|---|---|
| wordpress_test_cookie | This cookie determines whether the use of cookies has been disabled in the browser. Duration of storage: Until the end of the browser session (will be deleted when closing your internet browser). | Session |
| PHPSESSID | This cookie stores your current session with respect to PHP applications, ensuring that all features of this website based on the PHP programming language are fully displayed. Duration of storage: Until the end of the browser session (will be deleted when closing your internet browser). | Session |
| wordpress_akm_mobile | These cookies are only used for the administration area of WordPress. | 1 Year |
| wordpress_logged_in_akm_mobile | These cookies are only used for the administration area of WordPress and do not apply to other site visitors. | Session |
| wp-settings-akm_mobile | These cookies are only used for the administration area of WordPress and do not apply to other site visitors. | Session |
| wp-settings-time-akm_mobile | These cookies are only used for the administration area of WordPress and do not apply to other site visitors. | Session |
| ab | Is used for A / B testing of new features. | Session |
| akm_mobile | saves if the visitor wants to see the mobile version of a website. | 1 Day |
Cookies from Polylang
| Name | Purpose | Validity |
|---|---|---|
| pll_language | This cookie stores the language choice and the geographical origin of the user. | 1 Jahr |
Cookies from DSGVO AIO for WordPress
| Name | Purpose | Validity |
|---|---|---|
| dsgvoaio | This LocalStorage key / value stores which services the user has agreed to or not. | variable |
| _uniqueuid | This LocalStorage key / value stores a generated ID so that the user's opt-in / opt-out actions can be documented. The ID is stored anonymously. | variable |
| dsgvoaio_create | This LocalStorage key / value stores the time when _uniqueuid was generated. | variable |
| dsgvoaio_vgwort_disable | This LocalStorage key / value stores whether the service VG word standard is allowed or not (setting of the page operator). | variable |
| dsgvoaio_ga_disable | This LocalStorage key / value stores whether the service Google Analytics Standard is allowed or not (Hiring the site operator). | variable |
Google Analytics
This website uses various services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The use of these individual services is described in more detail below.
Our use of the following services and the associated collection of personal data (in particular IP addresses) is generally based on our legitimate interest in analyzing, improving and making our website content appear attractive as well as on our legitimate interest in tailoring any advertising to your needs (Article 6 (1) f GDPR).
Google Analytics uses cookies (see also 3.1 “Cookies”). Cookies are stored on your computer and enable Google to analyze how you use this website. The information generated by the cookie about your use of this website is generally transmitted to and stored on a Google server in the USA.
IP anonymization
We have activated IP anonymization on our website. This means that Google will shorten your IP address before transmitting it to the USA, provided the IP address originates from a member state of the European Union or a state that is party to the Agreement on the European Economic Area. The operator of this website contracts Google to use this information to evaluate how you use the website, to create reports about the website activity, and to provide other services relating to the use of the website and the internet. The IP address transmitted from your browser during the Google Analytics process is not linked to other data held by Google.
Your right to object to the collection of your data
You can block the storage of cookies by adjusting your browser settings accordingly; please note, however, that in such cases you may not be able to make full use of all the features available on this website. You can also prevent Google from collecting and processing the data generated by the cookie about your use of the website (including your IP address) by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.
Further information about how Google Analytics handles your data can be found in Google’s Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=en.
The processing of data on our behalf
We have concluded a data processing agreement for our use of Google Analytics and fully comply with the strict provisions of German data protection authorities when using this service.
Collection of demographic data by Google Analytics
This website uses the Demographics feature provided by Google Analytics. This feature enables reports to be created that contain statements about the age, gender, and interests of visitors to this site. This data is gathered from Google’s personalized advertising as well as visitor data from third-party providers. This data cannot be attributed to any specific individuals. You can disable this feature at any time by adjusting the ads settings in your Google account, or you can prohibit the general collection of your data by Google Analytics by following the steps outlined above.
Cookies from Google Analytics
- Name: _ga
Purpose: Distinguishes website visitors.
Expiration: 2 years
- Name: _ga_<container-id>
Purpose: Used by GA4 to maintain session state.
Expiration: 2 years
Google Tag Manager
This website uses Google Tag Manager (Google LLC. 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) Google Tag Manager allows marketed website tags to be managed using an interface. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not register personal data. The tool causes other tags to be activated which may, for their part, register data under certain circumstances. Google Tag Manager does not access this information. If recording has been deactivated on domain or cookie level, this setting will remain in place for all tracking tags implemented with Google Tag Manager.