Last updated: 22 September 2026
This is an English translation provided for information purposes. In the event of any discrepancy, the Italian version shall prevail.
This notice describes how we process the personal data of users who visit the goldencoast.it website and use the contact forms, the quote configurator, the members’ area and the other services offered through the website. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Privacy Code”).
1. Data controller
The data controller is Dario Tolu, trading under the Golden Coast brand
Piazza Dessì n. 2 – 09045 Quartu Sant’Elena (CA), Italy
Tax code: TLODRA06C08H118B
Certified email (PEC): dariotolu6@pec.it
Phone: +39 391 114 0589
For any request concerning your personal data, you can write to the certified email address above.
2. What data we process
Browsing data
During normal operation, the IT systems running the website collect certain data whose transmission is implicit in the use of Internet communication protocols: IP address, browser and device type, operating system, pages visited, date and time of the request. This data is used to ensure the website works correctly and securely and, with your consent, for usage statistics (see section 5).
Data provided voluntarily
- Quote configurator and contact form: first name and surname, email, phone number, dates of stay, number of guests, services selected, any notes and special requests.
- “List your property or service” form: personal and contact details, name of the company or property, location, description of the proposal, links and attachments (photos, presentations).
- “Careers” form: personal and contact details, role of interest, availability, languages, professional profile and curriculum vitae.
- Registration and members’ area: data needed to create and manage the account (name, email, login credentials) and the history of requests sent.
- Communications by email, phone or WhatsApp: the data contained in the messages you send us.
We ask you not to include in the forms, and in particular in your CV, data belonging to special categories (for example health data, political or religious opinions) unless strictly necessary. Any preferences or needs you communicate to organise your stay (for example food intolerances or accessibility requirements) will be processed only to provide the requested service and with your explicit consent.
3. Purposes and legal bases of processing
- Responding to requests and preparing quotes – legal basis: performance of pre-contractual measures taken at your request (Art. 6.1.b GDPR).
- Organising and delivering the confirmed services, coordinating the partners involved (accommodation providers, rental, charter, personal services, experiences) – legal basis: performance of the contract (Art. 6.1.b GDPR).
- Managing the account and members’ area – legal basis: performance of the service contract (Art. 6.1.b GDPR).
- Assessing collaboration proposals from owners and suppliers – legal basis: pre-contractual measures (Art. 6.1.b GDPR) and legitimate interest in selecting partners (Art. 6.1.f GDPR).
- Recruiting staff on the basis of applications received – legal basis: pre-contractual measures (Art. 6.1.b GDPR); for unsolicited CVs, consent is not required under Article 111-bis of the Privacy Code.
- Complying with legal obligations, for example tax, accounting or public security obligations – legal basis: legal obligation (Art. 6.1.c GDPR).
- Ensuring the security of the website, preventing abuse and protecting our rights in the event of disputes – legal basis: legitimate interest (Art. 6.1.f GDPR).
- Analysing website usage in aggregate form through statistical cookies – legal basis: consent (Art. 6.1.a GDPR), which you can withdraw at any time.
4. Whether providing data is mandatory
Providing the data marked as mandatory in the forms is necessary to respond to your request: without this data we cannot prepare the quote or assess the proposal or application. Providing other data is optional.
5. Cookies and third-party tools
The website uses technical cookies, which are necessary for it to work, and, with your consent, statistical cookies from Google Analytics (Google Ireland Ltd.). Consent is collected and managed through the cookie banner and can be changed at any time. Full details are in the Cookie Policy.
6. How data is processed
Data is processed using electronic and, where necessary, paper-based tools by authorised and trained personnel, with technical and organisational measures appropriate to ensure its confidentiality, integrity and availability. No automated decision-making or profiling takes place.
7. Who we share data with
- Partners delivering the requested services (accommodation providers, car rental companies with or without driver, yacht owners and charter companies, chefs, wellness providers and other suppliers), limited to the data needed for the service. Partners act as independent data controllers.
- Technical service providers (website hosting and maintenance, email, analytics tools), appointed as data processors under Article 28 GDPR.
- Consultants and professionals (for example accountants or lawyers), to comply with legal obligations or protect the controller’s rights.
- Public authorities, where required by law.
Data is not disclosed to the public or sold to third parties.
8. Transfers of data outside the European Union
Some providers, such as Google, may also process data in the United States. In these cases the transfer takes place on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework or of the standard contractual clauses approved by the Commission.
9. How long we keep data
- Information requests and quotes not followed by a booking: 24 months from the last contact.
- Data relating to booked services and accounting records: 10 years, as required by civil and tax law.
- Account data: until you delete the account or ask us to do so.
- Applications and CVs: 24 months from receipt, unless an employment or collaboration relationship is established.
- Collaboration proposals not accepted: 24 months from receipt.
- Google Analytics statistical data: 14 months.
After these periods, data is deleted or anonymised.
10. Your rights
You may exercise the rights provided for by Articles 15-22 GDPR at any time:
- access to your data and a copy of it;
- rectification of inaccurate or incomplete data;
- erasure of data (“right to be forgotten”), where applicable;
- restriction of processing;
- portability of the data you have provided;
- objection to processing based on legitimate interest;
- withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal.
To exercise your rights, write to dariotolu6@pec.it. We will reply within one month of your request. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
11. Minors
The Golden Coast website and services are intended for adults. We do not knowingly collect data from persons under 18 through the website forms; data of any underage guests is provided by the adult customer and processed only to deliver the requested services.
12. Changes to this notice
This notice may be updated to reflect changes in legislation or in the services offered. The version in force is always published on this page, with the date of the last update.