Last updated: 13 September 2026
Data controller
The controller of personal data collected through this website is:
FIVCASA REAL ESTATE S.R.L.
Registered office: Corso Luigi Fera, 115 – 87100 Cosenza (CS), Italy
Subscribed share capital: € 39,000.00
REA: CS-254502 – VAT No. 03741590784
Property: Strada della Falconaia 145–147, 57039 Bagnaia, Rio (LI) — Island of Elba, Italy
CIN IT049021A1TFDOW83W
Email: info@elbitat.it
Telephone: +39 348 163 9945
Companies Register of Cosenza – REA CS-254502
Data Protection Officer (DPO): no Data Protection Officer has been appointed, as the conditions making one mandatory under Article 37 GDPR do not apply to our activity.
What data we collect
We collect only the data you give us voluntarily and what is strictly necessary for the website to work.
- Contact form. First name, last name, email address, subject and message. We use this to reply to your enquiry.
- Technical browsing data. IP address, browser and device type, pages visited and the date and time of your visit, recorded in the web server logs for security and diagnostics.
- Technical cookies. Necessary for the site to function, including storing your chosen language and your cookie preferences. Full details are in the Cookie Policy.
This website uses no analytics tools, advertising pixels or profiling systems.
Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Replying to enquiries sent through the contact form | Pre-contractual measures at the data subject’s request (Art. 6.1.b GDPR) |
| Managing your booking and stay | Performance of a contract (Art. 6.1.b GDPR) |
| Website security and prevention of abuse | Legitimate interest of the controller (Art. 6.1.f GDPR) |
| Tax and administrative obligations and reporting to public security authorities | Legal obligation (Art. 6.1.c GDPR) |
| Non-necessary cookies, where present | Consent (Art. 6.1.a GDPR) |
How long we keep your data
- Messages received through the contact form: 24 months from the last contact
- Contractual data and tax documents: 10 years, as required by Italian law
- Technical server logs: kept in line with the hosting provider’s policy
- Cookie preferences: 365 days
Who we share data with
Your data is neither disclosed publicly nor sold. It may be processed on our behalf, under an agreement pursuant to Art. 28 GDPR, by:
- The website hosting provider: Keliweb S.r.l.
- The email service provider: the hosting provider’s own infrastructure (Keliweb S.r.l.)
- The online booking system: if you complete a booking through the external booking engine, your data is processed by that provider under its own privacy notice. The provider is Simple Booking – QNT S.r.l. a socio unico (Via Lucca 52, 50142 Florence, Italy, VAT 02333620488), acting as data processor.
- Public security authorities and the tax administration, where required by law
Data collected through this website is processed on infrastructure located in Italy. The providers listed above declare no transfers outside the European Economic Area for the processing carried out on our behalf; Keliweb S.r.l. does however state in its own privacy notice that it relies, for administrative, anti-fraud and domain-registration purposes, on parties established in the United States, including MaxMind Inc. and NCC Group Software Resilience (NA) LLC. Should the providers use sub-processors outside the EEA, the transfer takes place on the basis of appropriate safeguards under Articles 44 et seq. GDPR.
Your rights
You may exercise at any time the rights set out in Articles 15–22 GDPR: access to your data, rectification, erasure, restriction of processing, portability, objection to processing, and withdrawal of consent where processing is based on it. Withdrawal does not affect the lawfulness of processing carried out beforehand.
To exercise your rights, write to info@elbitat.it. We will reply within one month of your request.
If you believe the processing infringes data protection law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – garanteprivacy.it).
Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure. The site uses an encrypted HTTPS connection.
Cookies
The full list of cookies used, their duration and their purpose are described in the Cookie Policy, where you can also change or withdraw your preferences at any time.
Changes to this notice
We may update this notice to reflect changes in the law or in the services we offer. The date at the top of the page shows when it was last updated.