Last updated: 10 October 2026
This notice explains how personal data is processed on stoneovenhouse.com, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the applicable Italian legislation.
1. Data controller
Associazione culturale Stone Oven House – APS
Via Maestra 4, 10060 Rorà (TO), Italy
Tax code (C.F.) 94577350013 · VAT no. 13127760018
Email: association@stoneovenhouse.com
2. What data we process, why, and on what legal basis
- Browsing the website. Like every website, our hosting provider’s servers record technical data (IP address, date and time, pages requested, browser type) in server logs. Purpose: operation, security and prevention of abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Emails and messages you send us. Name, email address and the content of your message. Purpose: replying to your request. Legal basis: pre-contractual measures and legitimate interest in answering enquiries.
- Membership application (card). First and last name, date and place of birth, address, country, Italian tax code (if provided), email, telephone, confirmation of the association’s statutes, payment method and payment status. Optional answers (social profiles, website, how you heard about us, previous stays, interests, how you would like to contribute) are provided voluntarily. Purposes: assessing and managing your membership, keeping the members’ register, issuing the card and receipts, fulfilling legal and accounting obligations. Legal bases: contract and pre-contractual measures (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)); for optional answers, your consent (Art. 6(1)(a)).
- Applications and bookings (events, retreats, microfestivals, BiljoFest, guest and volunteer stays). Name, email, telephone / WhatsApp, country or city, number of participants, dates, requests and comments, and, where a receipt or membership is needed, address and tax code (or year and place of birth and tax code for microfestival applications). Purposes: processing your application, organising your stay or participation, issuing receipts, accounting. Legal bases: contract and pre-contractual measures, legal obligations.
- News and invitations. Your email address, only if you tick the corresponding box. Legal basis: consent, which you may withdraw at any time.
- Payments. Online payments are processed by PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.). We do not see or store your card number; we receive confirmation of the payment and the payer’s identification data. PayPal processes payment data as an independent controller, under its own privacy statement.
Fields marked with an asterisk (*) are required: without them we cannot process your application or membership. All other fields are optional.
3. Who receives the data
Data is accessed only by the members of the association’s board who need it for the purposes above. Volunteers do not have access to the data collected through this website. It may be shared with service providers acting on our behalf (website hosting by Hostinger, email delivery services, accountants and professional advisers), with PayPal, which acts as an independent controller for payments, and with public authorities where required by law. We do not sell personal data and we do not use it for advertising, profiling or automated decision-making.
Where a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision or on standard contractual clauses approved by the European Commission.
4. How long we keep the data
- Membership data: for the duration of membership and afterwards for as long as required by law or to establish, exercise or defend legal claims.
- Applications, bookings and receipts: until the event or stay is completed and then for the period required by accounting and tax law (accounting records: 10 years).
- Messages and unsuccessful applications: for as long as needed to handle the request, then deleted.
- News and invitations: until you withdraw your consent.
- Server logs: for the period set by the hosting provider.
5. Your rights
You may at any time ask the controller for access to your data, rectification, erasure, restriction of processing, data portability, and you may object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of the processing carried out before. To exercise your rights, write to association@stoneovenhouse.com.
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
6. Cookies
The website uses technical cookies needed for it to work and a cookie banner that stores your cookie choice. We do not use analytics, advertising or profiling cookies, and we load no analytics or advertising scripts. A few older pages may embed content from other websites, which may set their own cookies. The membership page loads the PayPal payment button, which may set PayPal’s own cookies; the statutes are opened from a Google Drive link, governed by Google’s policies. You can change your cookie choice at any time through the cookie banner settings or your browser.
7. Other websites
This notice covers stoneovenhouse.com only. Linked websites, including stay.stoneovenhouse.com, book.stoneovenhouse.com and social networks, are managed separately and have their own privacy policies.
8. Changes
We may update this notice; the current version is always published on this page with its date of last update.