Privacy

1. Controller

The controller is Francesco Cavallaro, ForumLingua Sprachschule, Bergerstraße 173, 60385 Frankfurt am Main, Germany. Telephone: +49 69 77 99 69. Email: info@forumlingua.de.

2. Hosting and server logs

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The web server processes technical data such as IP address, date and time, requested file, transferred data, referrer, browser and operating system to provide a secure and stable website under Article 6(1)(f) GDPR.

According to STRATO, IP addresses used to detect and prevent attacks are stored for no more than seven days. Access logs available to us contain anonymised IP addresses. STRATO acts as our processor.

3. Contact form, email and forwarding to the owner

When you contact us, we process your name, email address and message, plus optional details such as telephone number, dates and number of guests. The inquiry is sent to info@forumlingua.de. ForumLingua does not let the accommodation in its own name; it forwards the information needed to check availability and continue the direct accommodation process to the owner of Villa Casa Marina in Italy. If the inquiry leads to a stay, all binding arrangements are made directly with the owner; the owner processes the transferred data independently for the accommodation contract.

The legal basis is Article 6(1)(b) GDPR for the pre-contractual steps you requested and, where necessary, Article 6(1)(f) GDPR for orderly communication and protection against misuse. An inquiry is not yet a binding booking.

4. Spam protection with Cloudflare Turnstile

We use Cloudflare Turnstile to protect the contact form against automated misuse. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When the form is opened, Turnstile performs a security check; our server sends the generated token and IP address to Cloudflare for verification.

Cloudflare may process the IP address, user agent, browser and device properties, the website visited, and interaction and diagnostic data. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting the form and our systems against spam and misuse. Processing in the United States cannot be ruled out.

5. Cookies and audience measurement

We do not use analytics, advertising or tracking services. No non-essential YouTube or Google Maps content is loaded before your express selection. We do not store your selection of external content permanently in the browser.

6. YouTube, Google Maps and OpenStreetMap

YouTube videos and Google Maps are loaded only after you select the relevant button. By clicking, you consent to the connection to the provider and the related processing for that request. The legal basis is Article 6(1)(a) GDPR and, where information is stored on or read from your device, section 25(1) TDDDG.

YouTube is used in privacy-enhanced mode through youtube-nocookie.com. The provider for users in the EEA is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be processed in third countries, particularly the United States.

OpenStreetMap is linked externally. Data is sent to the OpenStreetMap Foundation only after you follow that link.

7. Recipients and international transfers

Recipients are limited to providers needed for hosting, communication and booking. STRATO processes hosting data on our behalf. Google receives data only after you select a video or map. Other transfers take place only where required for a contract or legal obligation.

8. Retention

We keep inquiries only as long as necessary for handling them, follow-up questions and a possible booking. If no contract is concluded, we generally delete an inquiry after no more than twelve months unless a legal retention or evidential obligation applies. Contract and accounting data is retained for the statutory periods.

9. Your rights

• Access
• Rectification
• Erasure
• Restriction of processing
• Data portability
• Objection
• Withdrawal of consent for the future
• Complaint to a data protection authority

10. Supervisory authority and version

The competent authority is the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de. Version: July 2026.