Pursuant to EU Regulation 2016/679 (“GDPR”), Arcangelo Artuso, as Data Controller, informs users of this website about the methods, purposes, and scope of processing of their personal data.
1. Data Controller
The Data Controller is:
Name: Arcangelo Artuso
Tax Code (Codice Fiscale): RTSRNG92A28C129W
Email: [email protected]
2. Types of Data Collected
The website processes the following categories of personal data:
* Identity and contact details: First name, last name, email address, phone number, provided voluntarily by the user through booking or contact forms.
* Payment details: Data required to process payments (e.g., credit card information). These data are processed **exclusively** by secure external payment gateways (such as Stripe, PayPal, or similar). The Data Controller does not store or have access to full credit card details.
* Navigation and technical data:** IP addresses, browser type, operating system, and other data collected automatically during the user's visit, necessary for the correct functioning and security of the website. For further details, please refer to the Cookie Policy.
3. Purpose of Processing
Personal data are processed for the following specific purposes:
* Contractual management: To process, manage, and confirm bookings, and to provide the hospitality services requested;
* Legal and tax compliance: To fulfill all legal, fiscal, administrative, and public security obligations imposed by Italian and EU legislation (e.g., mandatory communication of guest data to local police authorities via the "Alloggiati Web" portal, issuance of tax receipts or invoices);
* Payment processing: To manage financial transactions related to bookings via secure external platforms.
⚠️ **Note:** No promotional messages, marketing communications, or newsletters will be sent to the users.
4. Legal Basis for Processing
The processing of personal data is lawful based on the following grounds:
* Performance of a contract (Art. 6(1)(b) GDPR): Processing is necessary to execute the booking request and provide accommodation services.
* Compliance with a legal obligation (Art. 6(1)(c) GDPR):** Processing is mandatory to comply with tax laws and public security regulations.
* Legitimate interest (Art. 6(1)(f) GDPR):** Processing is carried out for the internal administrative management, accounting organization, and protection of the Data Controller’s rights (e.g., fraud prevention or management of legal disputes).
5. Processing Methods
Personal data are processed both electronically (using automated IT systems) and, where necessary, on paper. The Data Controller implements appropriate technical and organizational security measures to protect data against unauthorized access, disclosure, alteration, or destruction.
6. Disclosure to Third Parties
Personal data will not be disseminated or sold to third parties for marketing purposes. Data may be disclosed exclusively to:
* Competent authorities: Public security authorities (Police), judicial authorities, or financial administrations, where strictly required by law;
* External professionals: Certified accountants, tax consultants, or legal advisors, bound by professional secrecy and appointed as Data Processors where applicable;
* Third-party technical service providers: Payment gateway providers (Stripe, PayPal) and IT service providers (hosting, cloud services) strictly to ensure website operations and booking transactions.
7. Data Retention Period
Personal data will be stored only for the period strictly necessary to fulfill the purposes for which they were collected, in compliance with the principle of storage limitation:
* Administrative and Fiscal Data: Data related to billing, invoices, and accounting records will be retained for **10 years**, as strictly mandated by Italian law (Art. 2220 of the Italian Civil Code).
* Booking and Contact Data: Personal data used for the management of the stay and guest communication will be retained for a maximum period of **5 years** from the check-out date, to handle potential contractual liability or legal claims.
* Technical Data: Technical navigation logs are stored for short periods (typically up to 30 days) for security purposes, unless extended retention is required by judicial authorities.
8. Hosting and Data Transfers Outside the EEA
The website is hosted on servers located within the European Union.
Some third-party service providers (such as payment gateways or cloud infrastructure tools) may process data outside the European Economic Area (EEA), particularly in the United States. In such cases, the Data Controller ensures that the transfer is fully compliant with Chapter V of the GDPR, relying exclusively on countries covered by an adequacy decision of the European Commission (e.g., the EU-U.S. Data Privacy Framework) or through the implementation of Standard Contractual Clauses (SCCs).
9. Data Subject Rights
Pursuant to Articles 15–22 of the GDPR, users may exercise the following rights at any time:
* Right of Access: To obtain confirmation as to whether or not their personal data are being processed and receive a copy;
* Right to Rectification: To request the correction of inaccurate or incomplete data;
* Right to Erasure ("Right to be Forgotten"): To request the deletion of data, provided it is no longer required for legal obligations or the defense of legal claims;
* Right to Restriction of Processing: To request the limitation of data processing under specific legal conditions;
* Right to Data Portability: To receive their data in a structured, commonly used, and machine-readable format;
* Right to Object: To object at any time to the processing of data based on legitimate interest.
To exercise these rights, requests must be addressed to the Data Controller by email at: **[email protected]**.
10. Complaint to the Supervisory Authority
Data subjects who believe that the processing of their personal data violates the provisions of the GDPR or national data protection laws have the right to lodge an official complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work, or place of the alleged infringement.
In Italy, the competent authority is the **Garante per la Protezione dei Dati Personali** (Piazza Venezia n. 11, 00187 Rome; www.garanteprivacy.it).
