Privacy notice
Last updated: October 2026
Draft to be checked by the data controller before publication.
Data controller
The data controller is FILE S.r.l., registered office Via A. Gramsci 12, 47011 Castrocaro Terme (FC), VAT no. 04218691204, email info@filesrl.org, PEC filesrl@pecodc.it.
What data we process
The data you enter in the contact form: first and last name, email, phone, room preference, length of stay, degree and your message. We do not ask for, and ask you not to send, special categories of data such as health information.
To run the site, our hosting provider records technical browsing data (IP address, date and time, page requested, browser) and uses it to produce aggregate visit statistics.
Why we process it, and on what basis
To answer your request and, if you ask, to start the process of assigning you a bed. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR), which is why we do not ask for your consent, only for confirmation that you have read this notice.
Technical browsing data is processed to keep the site secure and working, on the basis of the controller’s legitimate interest (Art. 6(1)(f)).
If you don’t provide the data
Every field in the form except the message is needed to answer your request; without them we cannot follow it up. You can still contact us by phone or on WhatsApp.
Who receives the data
Requests sent through the form pass through Web3Forms, which forwards them to the controller’s email address. The site is hosted by Cloudflare. Both act as data processors.
If your request leads to a bed being assigned, the strictly necessary data may be shared, where the law requires it, with the bodies that fund and audit the PNRR project (the Ministry of University and Research and Cassa Depositi e Prestiti) and, for reserved beds, with ER.GO.
Your data is never sold or shared with third parties for marketing.
Transfers outside the European Union
Web3Forms and Cloudflare may process data on servers outside the European Union, including in the United States. Transfers only take place with the safeguards set out in Arts. 44–49 GDPR: a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or standard contractual clauses.
Security
The site only uses encrypted connections (HTTPS), and requests can only be accessed by the people who handle them.
How long we keep it
Requests that do not lead to a contract are kept for up to 12 months after our last contact, then deleted. If a request leads to a contract, the data is kept for as long as the law requires.
Cookies
This site uses no profiling cookies or third-party tracking, and loads no fonts, maps or content from other domains. That is why there is no consent banner.
Your rights
You can ask at any time to access, correct or delete your data, restrict or object to its processing, or receive it in a portable format (Arts. 15–22 GDPR). Just write to info@filesrl.org.
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).