Privacy
Privacy policy
In accordance with Articles 13 and 14 GDPR, this policy explains which personal data we process when you visit this website or send us an enquiry, what we use it for and what rights you have.
1. Controller
- Provider
- Susanne Living by Grunser
- Responsible person
- Susanne Obwexer
- Phone
- +39 347 702 6224
2. Principles of data processing
We only process personal data to the extent required for the respective purpose, keep it no longer than necessary and protect it with appropriate technical and organisational measures. The legal bases are in particular Art. 6(1)(a) (consent), (b) (contract and pre-contractual steps), (c) (legal obligation) and (f) GDPR (legitimate interest).
3. Server log files
When you open this website, our hosting provider automatically processes technical access data: IP address, date and time, requested page, HTTP status, browser and operating system and the previously visited page. This is necessary for stable and secure operation (Art. 6(1)(f) GDPR). The data is deleted after 30 days at the latest.
4. Hosting by Vercel
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. A data processing agreement is in place with Vercel (Art. 28 GDPR). The server functions of this website run in the Frankfurt am Main data centre. Any transfer to the USA is covered by the EU-US Data Privacy Framework and, additionally, by standard contractual clauses (Art. 46(2)(c) GDPR).
6. Google Analytics 4
If you have consented to “Analytics”, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to evaluate the use of the website in aggregated form. IP addresses are truncated. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings. Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework.
7. Enquiry form and email contact
If you write to us via the form or by email, we process your details (name, email, optionally phone, preferred property, travel dates, number of guests and your message) to answer your enquiry and, where applicable, prepare a booking (Art. 6(1)(b) GDPR). We delete the data once the enquiry has been dealt with, unless statutory retention obligations apply.
To deliver form messages we use Resend (Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, USA, as a processor (Art. 28 GDPR). The transfer to the USA is based on the EU-US Data Privacy Framework and, additionally, on standard contractual clauses.
8. Spam protection by Cloudflare Turnstile
To protect our form from abuse by bots, we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Technical data such as IP address, browser information and interaction characteristics are processed. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). Turnstile does not set advertising cookies.
9. Google Maps
Maps from Google Maps (Google Ireland Limited) only load once you consent (Art. 6(1)(a) GDPR). Your IP address, among other data, is then transmitted to Google.
11. Recipients and processors
We only share data with carefully selected service providers:
- Vercel Inc., website hosting (USA)
- Resend (Plus Five Five, Inc.), delivery of form messages (USA)
- Cloudflare, Inc., Turnstile spam protection (USA)
- Google Ireland Limited, Google Analytics 4 (Ireland, USA)
- Google Ireland Limited, Google Maps (Ireland, USA)
12. Transfers to third countries
Some of the services mentioned are based in the USA. Transfers are based on the EU-US Data Privacy Framework (adequacy decision of the European Commission) and, where it does not apply, on standard contractual clauses (Art. 46(2)(c) GDPR).
13. Your rights
You have the right at any time to:
- access your stored data (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing (Art. 21 GDPR)
- withdraw consent with effect for the future (Art. 7(3) GDPR)
An informal message to the following address is sufficient: susanne.obwexer@me.com
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). In Italy, the competent authority is: Garante per la protezione dei dati personali (www.garanteprivacy.it)
14. Data security
The connection to this website is encrypted via TLS. In addition, we take appropriate technical and organisational measures to protect your data against loss and unauthorised access.
15. Changes to this privacy policy
We update this policy when the website, the services used or the legal requirements change. The version published on this page applies.
Last updated: 12.10.2026
10. Social media profiles
On this website we link to the Instagram profiles of our properties:
These are simple links. Only when you click a link are you forwarded to Instagram, and Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) processes data such as your IP address. If you are logged in to Instagram, the visit can be linked to your account. No Instagram content or tracking services are loaded on this website itself. The legal basis is our legitimate interest in presenting our properties (Art. 6(1)(f) GDPR). Meta is responsible for processing on Instagram, details can be found in Instagram’s privacy policy.