Privacy notice

1. Who processes your data

The data controller is the accommodation business identified below: it decides the purposes and means of the processing of your data, and it is the party you should contact with any request.

Data controller

autonomo srl

Registered office

Via autonomo 1, autonomo

VAT number

00905811006

CIN

ITNNNNNNMNNNNFROWN

Phone

0000

2. Nagevo's role

The property uses Nagevo, the platform that runs this website, the booking engine and guest communications. Nagevo processes data solely on behalf of the property and on its instructions, as data processor under Article 28 GDPR.

To deliver the service, Nagevo in turn relies on suppliers (hosting, database, email delivery, payments, file storage), appointed as sub-processors and bound by the same obligations. The current list is published on Nagevo's website.

3. What data we process

Identity and contact details (first name, last name, email, phone), stay details (dates, room, number and age of guests, board chosen, special requests), identity document data where the law requires guest registration, payment data handled directly by the payment provider, and technical browsing data as described in the cookie settings.

Providing the data needed for the booking and for legal obligations is mandatory: without it, the property cannot accept your booking or host you.

4. Why we process your data

To manage the booking and the stay — receiving the request, confirming it, assigning the room, issuing tax documents. Legal basis: performance of the contract to which you are a party (Art. 6.1.b GDPR).

To comply with legal obligations — reporting guests' details to the public security authority through Alloggiati Web, ISTAT statistical returns on tourist movement, and the administration of the municipal tourist tax. Legal basis: legal obligation of the controller (Art. 6.1.c GDPR).

To collect deposits and prepayments through Stripe, which acts as an independent controller for the anti-money-laundering and anti-fraud obligations it is subject to. The property never holds your full card details. Legal basis: performance of the contract and legal obligation (Art. 6.1.b and 6.1.c GDPR).

To send you emails about your stay — confirmation, reminder before arrival, practical information, a message after departure. Legal basis: performance of the contract for necessary communications, the property's legitimate interest for courtesy ones (Art. 6.1.b and 6.1.f GDPR), always with the right to object.

Understanding how the property's website is searched, in order to decide prices, opening periods and conditions. When you open the property's website, search for availability or move forward with a booking, Nagevo counts on behalf of the property: the dates searched, the number of nights, rooms and guests, the search result (whether rooms were available and, if not, why), the booking step reached, the language, the type of device (phone or computer), a generic source (Google, social media, direct, other) and whether you are on the property's website or on its booking form placed on another website. All that remains of your visit are daily counts (for example: "today, 12 searches for 10 October, 2 nights"): no cookies, no IP address stored, no link to you or to your booking. The counts are deleted after 400 days. Legal basis: the property's legitimate interest (Art. 6(1)(f) GDPR).

Origin data of the request or booking: the identifier of a click on an ad (for example Google's gclid or Meta's fbclid), the campaign parameters (utm) and the landing page. They are recorded together with the quote request or the booking and are used to measure which channel bookings come from (legal basis: legitimate interest).

5. Who we share your data with

Public security authorities and public bodies in the cases provided for by law; the payment provider for transactions; Nagevo's technical suppliers, appointed as processors or sub-processors; the property's accountant and advisers for accounting and tax obligations. Your data is never sold or transferred to third parties for commercial purposes.

If the property has connected Google Analytics 4 or the Meta Pixel to its website, Google (Google Ireland Ltd.) and Meta (Meta Platforms Ireland Ltd.) also receive data, as the property's measurement tools and only with the consent you give in the cookie banner. Google receives your browser's identifiers (the _ga cookie and the session cookie), the pages visited, the origin data and, for bookings, the amount. Meta receives your browser's identifiers (the _fbp and _fbc cookies), the origin data and, for requests and bookings, your email address and, where available, your phone number in encrypted form (SHA-256 hash); for requests also your IP address and browser type, for bookings the browser type you paid or confirmed with. If the property has connected its Google Ads account, Google also receives, for requests and bookings, the ad click identifier and your email address and, where available, your phone number in encrypted form (SHA-256 hash). The tags in the browser also send your device's IP address to Google and Meta. Google and Meta may transfer this data to the United States on the basis of the Standard Contractual Clauses.

Technical providers that automatically read the identity document to fill in the report to the police (Questura); the images of the document are not kept by the property or used to train models.

6. How long we keep it

Booking data and tax documents are kept for the period required by accounting and tax law, currently ten years. Data transmitted for public security obligations follows the retention periods set by the relevant legislation. Other data is kept for as long as the purposes above require and is then deleted or anonymised.

7. Your rights

You may at any time request access to your data, its rectification or erasure, restriction of processing and data portability, and you may object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing already carried out.

To exercise these rights, write to the controller's contact details given at the top of this notice. The property replies within one month of the request.

8. Complaint to the supervisory authority

If you believe the processing of your data infringes the GDPR, you may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the country where you habitually reside.