PRIVACY POLICY

Last updated: February 2026

This privacy policy describes how Casa Ghiorsi ("we", "our" or "us") collects, uses and protects your personal data when you visit our website and use our services. We are committed to ensuring the protection of your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

Casa Ghiorsi, registered at Øverste Skovbymark 16, 5985 Søby Ærø, Denmark, is the data controller for the processing of personal data received or collected via this website. For contact information please see §16.

When you make a booking with us, we collect the following information:

• Name: Your first and last name
• Address: Your postal address
• Phone number: Your contact phone number
• Email address: Your email address for booking confirmation and communication
• Payment information: Details necessary to complete payment
• Period of stay: Arrival and departure dates
• Special requests / needs: Any special needs or requests in connection with your stay (e.g. allergies, accessibility requirements)

When you provide us with personal data to complete a transaction, verify your payment card, make a booking or arrange a service, this implies your consent for us to collect and use your data solely for that specific purpose.

If we ask for your personal data for a secondary purpose, such as marketing, we will either ask you directly for your explicit consent or give you the opportunity to decline.

Withdrawal of consent

By ticking the consent box, you agree to receive marketing communications from us. You may withdraw your consent at any time by following the instructions in our emails or by contacting us directly atmail@casaghiorsi.dk.

Booking information is used to:

• Process and confirm your booking
• Communicate with you regarding your stay
• Tailor our services to your needs
• Fulfil legal obligations (e.g. bookkeeping)
• Improve the quality of our services

We retain your personal data only for as long as necessary for the purposes for which it was collected:

Storage of accounting data — Legal obligation (GDPR Art. 6(1)(c)) / Danish Bookkeeping Act

Improvement of website and services — Legitimate interest (GDPR Art. 6(1)(f))

Data type Retention period

Booking information 6 years after the end of the stay (pursuant to the Danish Bookkeeping Act)

Correspondence and enquiries 2 years after the last point of contact.

Upon expiry of the retention period, your personal data will be securely deleted or anonymised.

We are committed to ensuring the protection of your data. We implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration and destruction.

These measures include, among others:

• Encryption of sensitive data
• Secure storage of physical and digital documents
• Restricted access to personal data, limited to authorised personnel only
• Regular updating of security procedures
• Secure backup procedures

We do not sell, trade or transfer your personal data to third parties without your explicit consent. Your data may only be shared with service providers who assist us in operating our business, provided they agree to keep the information confidential. This may include:

• Payment providers for processing transactions (who are subject to their own privacy policies)
• Legal or regulatory authorities, if required to do so by law

We do not use third-party tools such as Mailchimp or similar platforms for data processing or marketing.

As we do not use third-party tools or services that transfer data outside the EU/EEA, all your personal data remains within Denmark and the EU/EEA area.

We use cookies to improve your browsing experience on our website. Cookies are small text files stored on your device.

9.1 Which cookies do we use?

• Necessary cookies:Ensure basic functionality of the website
• Functional cookies:Remember your preferences (e.g. language selection)

Important information about cookies: We do NOT use third-party cookies from marketing or analytics tools. All cookies on our website are first-party cookies used exclusively to improve your experience on our own website.

You may manage your cookie preferences at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the website.

We do not carry out automated decision-making or profiling of our users. All decisions regarding bookings and customer service are made manually by our staff.

We take particular care to protect children's privacy. We do not knowingly collect personal data from children under the age of 16 without the consent of a parent or guardian.

If you are a parent or guardian and become aware that your child has provided us with personal data without your consent, please contact us so that we can delete the information.

Under GDPR, you have the following rights regarding your personal data:

Right of access (Article 15)

You have the right to be informed about what personal data we process about you.

Right to rectification (Article 16)

You have the right to have inaccurate or incomplete data about you corrected or supplemented.

Right to erasure (Article 17)

You have the right to have your personal data deleted, unless we are required to retain it for legal reasons (e.g. under the Danish Bookkeeping Act).

Right to restriction of processing (Article 18)

You have the right to request that the processing of your personal data be restricted.

Right to data portability (Article 20)

You have the right to receive your personal data in a structured, commonly used and machine-readable format and to have it transferred to another data controller.

Right to object (Article 21)

You have the right to object to the processing of your personal data.

Right not to be subject to automated individual decisions (Article 22)

You have the right not to be subject to a decision based solely on automated processing. As stated, we do not make such automated decisions.

How to exercise your rights

To exercise your rights, please contact us at:

Email: mail@casaghiorsi.dk

Post: Casa Ghiorsi, Øverste Skovbymark 16, 5985 Søby Ærø, Denmark

We will respond to your request within 30 days. In certain cases, this deadline may be extended by a further two months if the request is complex. If so, we will inform you accordingly.

You have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet) if you believe that we are processing your personal data in breach of data protection regulations.

Datatilsynet

Carl Jacobsens Vej 35

2500 Valby

Danmark

E-mail: dt@datatilsynet.dk

Telefon: +45 33 19 32 00

Hjemmeside: www.datatilsynet.dk

In the event of a data breach that may pose a risk to your rights and freedoms, we will notify you and the Datatilsynet within 72 hours of becoming aware of the breach.

The notification will include:

• A description of the data breach
• The consequences of the data breach
• Measures we have taken or plan to take
• A contact point for further information

We reserve the right to update this privacy policy to reflect changes in our practices or legal requirements. Material changes will be communicated on our website. We encourage you to review this policy regularly to stay informed about how we protect your data.

If you have any questions or concerns regarding this privacy policy or the processing of your personal data, please do not hesitate to contact us:

Casa Ghiorsi

Øverste Skovbymark 16

5985 Søby Ærø

Danmark

E-mail: mail@casaghiorsi.dk

We aim to respond to all enquiries within 2 business days.

© 2026 Casa Ghiorsi · All rights reserved

Casa Ghiorsi                 CVR: 39706113