PRIVACY & COOKIE POLICY

Last updated: 30 October 2026

1. Introduction

This Privacy & Cookie Policy describes how Lion Holiday Sardinia collects, uses, stores and protects the personal data of users who visit the website www.lionholidaysardinia.com, request information about accommodation properties, make reservations, communicate with customer service or subscribe to promotional communications.

This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree No. 196/2003, as subsequently amended, and the applicable Italian and European legislation on personal data protection and electronic communications.

This notice applies to the Lion Holiday Sardinia website. External services accessible through links, including booking platforms, may be subject to their own privacy policies.

2. Data Controller

The data controller is the entity operating under the business name Lion Holiday Sardinia, identified by the following business details:

Lion Holiday Sardinia

VAT Number: 02901950903

Registered address: Strada Vicinale Monti di Mannu, 8, 07100 Sassari (SS), Italy

Email: lionholidaysardinia@gmail.com

WhatsApp: +39 327 4131260

Website: https://www.lionholidaysardinia.com/

For any request concerning the processing of personal data or the exercise of rights provided for under the GDPR, the data controller may be contacted at the email address indicated above.

3. Categories of Personal Data Processed

The following categories of personal data may be collected when users access the website and its services.

Data Provided Voluntarily

First name, last name, email address, telephone number, information submitted through contact forms, availability enquiries, messages and other direct communications.

Data Relating to Accommodation Enquiries and Reservations

Arrival and departure dates, number of guests, requested property, accommodation preferences, information necessary to manage the reservation and any other data required to provide the services.

Where necessary to comply with legal obligations, additional identification data relating to guests may be processed in accordance with the legislation applicable to accommodation establishments.

Browsing Data

IP address, browser type, operating system, device used, date and time of access, pages visited and technical information necessary for the operation, security and performance analysis of the website.

Data Relating to Promotional Communications

Email address, newsletter subscription status, consent preferences and, exclusively where valid specific consent has been obtained, information relating to email openings and clicks on links contained in promotional communications.

Payment Data

Information necessary to manage any payments relating to accommodation stays, according to the booking and payment methods used.

Payment data that may be processed by external providers is also subject to the privacy notices and terms of the respective services.

4. Purposes and Legal Bases of Processing

Personal data is processed for the following purposes.

A. Managing Information and Availability Enquiries

Responding to user enquiries, providing information about available properties, communicating quotations and accommodation conditions, and assisting users in choosing accommodation.

Legal basis: taking pre-contractual steps at the request of the data subject, pursuant to Article 6(1)(b) of the GDPR.

B. Managing Reservations and Accommodation Stays

Confirming and administering reservations, organising guest arrivals, managing communications with guests, providing assistance during stays and fulfilling contractual obligations.

Legal basis: performance of a contract, pursuant to Article 6(1)(b) of the GDPR.

C. Compliance with Legal Obligations

Managing administrative, accounting and tax obligations, communications required by competent authorities and other obligations applicable to accommodation activities.

Legal basis: Article 6(1)(c) of the GDPR.

D. Website Security and Operation

Preventing unauthorised access, attempted fraud, misuse of services and technical problems.

Legal basis: the legitimate interests of the data controller, pursuant to Article 6(1)(f) of the GDPR, within the limits permitted by applicable legislation.

E. Newsletters and Promotional Communications

Sending newsletters, information about properties, availability, special offers, promotions, updates and other commercial communications.

Legal basis: the data subject's consent, pursuant to Article 6(1)(a) of the GDPR, except in cases expressly permitted by legislation applicable to commercial communications addressed to existing customers.

F. Tracking Promotional Communications

Individually detecting email openings and clicks on links contained in messages in order to measure campaign effectiveness and improve the relevance of communications.

Legal basis: the data subject's specific, freely given and separate consent, pursuant to Article 6(1)(a) of the GDPR and the legislation applicable to tracking technologies.

G. Statistical Analysis and Website Improvement

Analysing website usage, website performance and the effectiveness of digital activities through statistical tools and technologies used in compliance with applicable legislation.

Legal basis: consent, where required, or another appropriate legal basis in cases permitted by law.

H. Protection of the Data Controller's Rights

Managing complaints, disputes and claims, as well as establishing, exercising or defending rights in judicial or extrajudicial proceedings.

Legal basis: the legitimate interests of the data controller, within the limits established by applicable legislation.

5. Information Enquiries, Reservations and Guest Assistance

Users may contact Lion Holiday Sardinia through the forms available on the website, the business email address and the WhatsApp number provided.

The data submitted is used to respond to enquiries, check availability, provide information and quotations, organise reservations and assist guests.

Providing the data necessary to manage an enquiry or reservation is required in order for the data controller to provide the requested service.

Failure to provide essential information may make it impossible to respond adequately or proceed with a reservation.

Communications necessary to manage an accommodation stay are separate from promotional communications and do not automatically require subscription to the newsletter.

6. Reservations Through External Platforms

Some properties offered by Lion Holiday Sardinia may also be booked through external platforms, including Airbnb, where available.

When users choose to use an external platform, the processing of data carried out directly by that platform is also governed by its contractual terms and privacy policy.

Booking platforms may process identification data, accommodation information, payment data and other information necessary to manage reservations.

Lion Holiday Sardinia may receive and process the data necessary to manage accommodation stays, welcome guests and provide assistance.

For further information about the processing carried out by Airbnb, please refer to the Airbnb Privacy Policy.

7. Newsletters and Email Marketing Through Klaviyo

Lion Holiday Sardinia uses the Klaviyo platform to manage newsletter subscriptions, promotional communications and email marketing automations.

Users may subscribe to promotional communications through the dedicated forms available on the website.

Consent to receive communications is recorded through the features provided by the Klaviyo platform.

Subscription is voluntary and may be withdrawn at any time using the unsubscribe link included in the communications received.

Withdrawal of marketing consent does not prevent users from receiving communications necessary to manage reservations, accommodation stays or other contractual relationships.

Consent to receive promotional communications and consent to track interactions with emails are managed separately.

For further information about how the platform processes data, please refer to the Klaviyo Privacy Policy.

8. Consent to Track Email Opens and Clicks

Lion Holiday Sardinia uses Klaviyo to manage its email marketing communications.

Subject to the data subject's specific and separate consent, information may be collected regarding email openings and clicks on links contained in messages.

Email opens may be detected through small graphic elements, commonly known as tracking pixels, embedded in email communications.

Clicks may be monitored through tracked links.

These tools may make it possible to associate interactions with the recipient's email address and collect technical information connected with those interactions, according to the features of the service used.

The information is used to evaluate campaign effectiveness, understand recipient engagement and improve the relevance of promotional communications.

Consent to email tracking is separate from consent to receive newsletters.

Users may therefore subscribe to promotional communications without authorising individual tracking of email opens and clicks.

Refusing tracking does not prevent users from receiving newsletters or benefiting from offers reserved for subscribers.

Preferences expressed through subscription forms are recorded and managed through Klaviyo, allowing the data controller to document the choices made.

In the absence of valid specific consent, individual tracking of email opens and clicks must remain disabled.

Withdrawal and Modification of Tracking Consent

The data subject may modify or withdraw consent to the tracking of email opens and clicks at any time through the "Manage Preferences" link included at the bottom of each communication, without unsubscribing from newsletters.

Alternatively, the data subject may request withdrawal by writing to lionholidaysardinia@gmail.com and specifying the intention to disable email tracking.

Upon receiving the request, the data controller will update the data subject's tracking preferences on the Klaviyo platform without undue delay.

Withdrawal of tracking consent does not automatically result in unsubscription from promotional communications.

Withdrawal does not affect the lawfulness of processing carried out previously on the basis of consent.

Preferences relating to email tracking are independent of those expressed for website cookies.

9. Cookies and Similar Technologies Used by the Website

The website is built using the Wix platform, which uses cookies and similar technologies to ensure the operation of pages, security, session management and the provision of features requested by users.

Cookies are small text files stored on the user's device while browsing.

They may be temporary, when deleted at the end of a session, or persistent, when they remain stored for a specified period or until deleted by the user.

Technical and Essential Wix Cookies

According to the official Wix documentation, standard technical cookies may include:

Cookie NamePurposeApproximate Duration

XSRF-TOKENProtection against unauthorised requestsSession

hsPlatform securitySession

svSessionSecurity and core functionality12 months

SSR-cachingPerformance optimisation24 hours

TS*Platform protectionSession

bSessionTechnical system efficiency24 hours

fedops.logger.sessionIdTechnical monitoring and error tracking12 months

_wixAB3|*Platform technical experiments6 months

server-session-bindAPI protectionSession

client-session-bindAPI protectionSession

oAuthStateAuthentication proceduresSession

wixSessionCore website functionality12 months

sec-fetch-unsupportedTechnical security checksSession

This list provides examples of standard cookies documented by Wix and does not imply that all of them are necessarily present during every visit.

The actual presence, duration and characteristics of each cookie may depend on the features used, the device, the browser and the browsing method.

Updated information is available in the official Wix documentation on cookies.

Analytics Cookies

The website may use statistical analysis tools to understand page usage, measure performance and improve the browsing experience.

Where analytics cookies do not meet the requirements to be treated as technical cookies, they are used subject to the data subject's consent.

Marketing and Profiling Cookies

Marketing and profiling tools may be used to measure advertising activities, analyse interactions and deliver relevant commercial communications.

Where consent is required under applicable legislation, these tools are activated only after the data subject has made a positive choice.

Refusing non-essential cookies does not prevent users from accessing the website's essential features.

Third-Party Cookies and Technologies

Some website features may be provided by external services or applications integrated into the Wix platform.

These services may use cookies or similar technologies according to their own purposes and processing conditions.

The use of third-party tools subject to consent must respect the preferences expressed by the user.

The type and duration of additional cookies may vary depending on the applications and integrations actually used.

10. Managing and Withdrawing Cookie Consent

Users may express their preferences regarding non-essential cookies through the consent management tools available on the website.

Strictly necessary technical cookies may be used without consent, within the limits established by applicable legislation.

Analytics cookies requiring consent, as well as marketing or profiling cookies, must be activated only after obtaining the user's positive and informed choice.

Simply continuing to browse, scrolling through a page or closing the banner does not, in itself, constitute valid consent.

Users must be able to refuse non-essential cookies without losing access to the website's essential features.

Preferences may be modified or withdrawn through the consent management tools made available on the website.

Cookies may also be managed or deleted through browser settings.

Disabling essential technical cookies may affect the proper operation of certain features.

Instructions are available on the support pages of the main browsers:

• Google Chrome

• Mozilla Firefox

• Apple Safari

• Microsoft Edge

Preferences relating to website cookies and those relating to the tracking of email communications are separate and may be managed independently.

11. Data Processing Through Wix and Other Technology Providers

The website is hosted and managed through the Wix platform.

Wix may process data relating to browsing, website interactions, contacts and the features used.

Processing takes place according to the services activated by the data controller and in compliance with the contractual conditions and security measures provided by the platform.

For information about general data processing practices, please refer to the Wix Privacy Policy.

The website may also use digital analytics and advertising services, including Google and Meta tools, where actually activated.

The use of such services, where it involves the processing of personal data or the installation of technologies requiring consent, must respect users' preferences and applicable legislation.

For information about processing carried out by the respective providers, please refer to:

• Google Privacy Policy

• Meta Privacy Policy

• Klaviyo Privacy Policy

The data controller remains responsible for verifying that the technologies used and their settings comply with applicable legislation.

12. Processing Methods and Security Measures

Personal data is processed using computerised and electronic tools, with organisational methods appropriate to the declared purposes.

The data controller adopts appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration, disclosure or unlawful use.

Access to information is restricted to authorised persons and providers who require it to deliver the services.

13. Recipients of Personal Data

Personal data may be disclosed to parties providing services necessary for business operations, including:

• Wix, for website hosting and technical management.

• Klaviyo, for newsletter management and email marketing communications.

• External booking platforms, where used.

• Payment service providers.

• Administrative, accounting, tax and legal advisers.

• IT service and technical support providers.

• Digital analytics and marketing service providers, where actually used.

• Public authorities and other parties in cases required by law.

Where applicable, these providers act as data processors pursuant to Article 28 of the GDPR.

Some parties may instead act as independent data controllers, according to their respective purposes and responsibilities.

Personal data is not indiscriminately disclosed or transferred to third parties for purposes incompatible with those declared.

14. Transfers of Data Outside the EU

The use of international technology platforms, including Wix, Klaviyo and any external booking platforms, may involve the processing or transfer of personal data outside the European Economic Area.

Such transfers must take place in compliance with Chapter V of the GDPR, through adequacy decisions issued by the European Commission, Standard Contractual Clauses or other mechanisms recognised by applicable legislation.

Data subjects may request further information from the data controller regarding the safeguards applicable to transfers of their personal data.

15. Personal Data Retention Periods

Personal data is retained for the period necessary to achieve the purposes for which it was collected, in compliance with legal obligations and the principles of storage limitation and data minimisation.

Data Relating to Information Enquiries

Such data is retained for the period necessary to manage enquiries and, subsequently, within the limits necessary to document the activities carried out or protect any rights.

Data Relating to Reservations and Accommodation Stays

Such data is retained for the period necessary to perform the contractual relationship and, subsequently, to comply with applicable administrative, tax and legal obligations.

Data collected for specific obligations under accommodation legislation is processed according to the methods and retention periods established by the relevant legislation.

Data Relating to Tax Documentation

Such data is retained for the periods established by applicable civil, tax and accounting legislation.

For documentation subject to the relevant obligations, the ordinary retention period is generally 10 years, without prejudice to different applicable periods or requirements relating to the protection of rights.

Data Relating to Newsletters

Such data is processed for the duration of the subscription, as long as a valid legal basis remains in place and in compliance with applicable legal limits.

In the event of unsubscription, processing for the purpose of sending promotional communications is stopped, without prejudice to the possible retention of data strictly necessary to document withdrawal or prevent further unauthorised communications.

Data Relating to Tracking Consent

Consent preferences, withdrawals and related evidence may be retained for the period necessary to demonstrate compliance with processing requirements and protect the rights of the parties.

Any interaction data collected on the basis of valid consent is retained within the limits necessary for the declared purposes and according to the settings actually adopted on the platform.

Browsing Data and Cookies

Technical Wix cookies may have the durations indicated in Section 9, depending on the website's actual configuration.

Additional cookies and third-party technologies are subject to the retention periods established by the respective services and the settings actually adopted.

Data Processed Through Wix, Klaviyo and Other Services

Retention periods may also depend on the features activated, account settings, contractual obligations and policies applicable to the respective providers.

The presence of data on these platforms does not automatically justify indefinite retention.

At the end of the applicable periods, data is deleted, anonymised or retained exclusively in cases permitted by law.

16. Rights of the Data Subject

Pursuant to Articles 15–22 of the GDPR, data subjects may exercise the following rights, where applicable:

• Obtain confirmation as to whether their personal data is being processed and access that data.

• Request the rectification of inaccurate data or the completion of incomplete data.

• Request the erasure of personal data in the cases provided for by law.

• Obtain restriction of processing.

• Object to processing in the cases permitted by law.

• Receive their data in a structured, commonly used and machine-readable format, where the requirements for the right to data portability are met.

• Withdraw previously given consent at any time.

• Not be subject to decisions based solely on automated processing in the cases provided for under Article 22 of the GDPR.

To exercise these rights, please contact:

lionholidaysardinia@gmail.com

The data controller will respond within the time limits established by Article 12 of the GDPR.

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

17. Processing of Minors' Data

The website is not specifically intended for minors.

Personal data relating to minors who may be included in reservations and accommodation stays is processed exclusively for purposes necessary to provide the services and comply with applicable legal obligations.

Where processing is based on consent in connection with the direct offer of information society services to minors, the provisions of Article 8 of the GDPR and Article 2-quinquies of the Italian Privacy Code apply.

18. Changes to the Privacy & Cookie Policy

This policy may be updated to reflect regulatory, technical or organisational changes.

Any significant changes will be communicated to data subjects where required by applicable legislation.

The updated version will be available at:

https://www.lionholidaysardinia.com/cookie

Last updated: 30 October 2026.