Privacy Policy

Privacy notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") — version of 8 October 2026

1. Data controller

Hyper srl, owner of the Dimore d'Epoca brand, registered office at Contrà Riale 13/a, 36100 Vicenza, Italy, VAT and tax code 02372320248. For any request concerning your personal data: This email address is being protected from spambots. You need JavaScript enabled to view it..

2. What data we process

• Data you provide in the forms on our website, in our booking widgets (including when they are published on our partners' websites), on dedicated pages and in requests for gift boxes, experiences and gift cards: first and last name, email, telephone, dates of stay, number of guests, any special requests, codes of gift boxes, bons cadeaux, bonos or gift cards.
• Payment data: collected and handled directly by PayPal or Stripe. Dimore d'Epoca neither sees nor stores card numbers.
• Technical browsing data and cookies, described in the Cookie Policy.

3. Why we process them and on what legal basis

• Handling your request for a booking, gift box, experience or gift card, forwarding it to the property or provider, and managing payment, confirmation, voucher and assistance. Basis: performance of a contract or of pre-contractual measures requested by you (Art. 6(1)(b) GDPR). Providing the data is necessary: without it we cannot process your request.
• Answering requests for information sent through our contact forms. Basis: Art. 6(1)(b) GDPR. Providing the data is necessary for us to reply.
• Complying with legal obligations, in particular tax and accounting obligations. Basis: legal obligation (Art. 6(1)(c) GDPR).
• Sending you newsletters, offers and proposals from Dimore d'Epoca. Basis: your consent (Art. 6(1)(a) GDPR), which is optional and can be withdrawn at any time. Your booking is not affected if you do not give it.
• Preventing fraud and abuse and protecting our rights, including in court. Basis: legitimate interest (Art. 6(1)(f) GDPR).
• Aggregate statistics on the use of our widgets and pages, without identifying data. Basis: legitimate interest (Art. 6(1)(f) GDPR).

4. Who we share the data with

• The property, hotel or experience provider you have chosen, limited to the data needed to confirm and deliver the service. The property processes them as an independent controller.
• Providers working on our behalf as data processors: hosting and database (Supabase, Netlify, our website host), email delivery (Brevo, MailerLite, Google Workspace), payments (PayPal, Stripe), digital assistance and artificial intelligence services used to answer requests, administrative and tax advisers.
• The partner whose website the request came from, only in aggregate form and without personal data, to calculate commissions.
• Public authorities, where required by law.

Your data is never sold or made public.

5. Transfers outside the European Union

Some providers are based in, or use servers in, the United States. Transfers rely on the EU-US Data Privacy Framework for certified providers, or on the Standard Contractual Clauses adopted by the European Commission.

6. How long we keep the data

• Requests and bookings: for as long as needed to handle them, then up to 10 years to meet tax and accounting obligations.
• Requests for information with no follow-up: 24 months.
• Newsletter and offers data: until consent is withdrawn, with a review at least every 24 months in case of inactivity.
• Consent records: for the duration of the processing they relate to and for the period afterwards needed to demonstrate them.

7. Your rights

You may at any time request access to your data, rectification, erasure, restriction of processing and portability, object to processing based on legitimate interest and withdraw your marketing consent, including through the link in every newsletter. Withdrawal does not affect processing already carried out. Simply write to This email address is being protected from spambots. You need JavaScript enabled to view it.. You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the country where you live.

8. Automated decisions

We do not take decisions based solely on automated processing that produce legal effects concerning you. The automatic check of availability and prices is not such a decision: confirmation always rests with the property.