Dear Guest,
you are making a booking through the online booking platform accessible from the property’s website. By clicking "Book now" you have been directed to that platform, operated by an external technical provider on behalf of the Data Controller, where you can select your stay dates and enter your identification data to complete the booking. Pursuant to art. 13 of Regulation (EU) 2016/679 (hereinafter the "GDPR"), we inform you that your personal data are processed by the undersigned Agati Piero, owner of the apartments of the booking, in the capacity of Data Controller, for the purposes described below. Please read this privacy notice carefully before providing any personal data.
1. Data Controller
Data Controller Agati Piero
Address Via Villa Agati 23, 53013 Gaiole in Chianti (SI)
Telephone 3894732817
E-mail [email protected]
2. Personal data processed
In connection with the booking made through the online platform and with the tourist rental activity, we process the following categories of personal data:
• Identification data: first name, surname, date and place of birth, nationality/country of origin;
• Contact data: e-mail address, telephone number;
• Technical and navigation data: collected automatically by the booking platform through technical cookies necessary for the proper functioning of the booking process;
• Stay-related data: arrival and departure dates, booking channel, booking status, number of guests accommodated;
• Contractual data: details of the tourist rental agreement;
• Identity document data: document type, number, issuing authority, date of issue (for public security obligations).
We do not process data belonging to special categories (so-called sensitive data) pursuant to art. 9 GDPR, nor data relating to criminal convictions or offences.
3. Purposes of processing and legal bases
Purpose Legal basis Mandatory nature
Management of the booking, the tourist rental agreement and the stay (check-in, check-out, operational communications) Art. 6(1)(b) — performance of the contract Mandatory in order to use the service. Refusal makes the booking impossible.
Public security obligations (communication of guests' personal details to the Police Headquarters via the Alloggiati Web portal) Art. 6(1)(c) — legal obligation (art. 109 Consolidated Public Security Act; Ministerial Decree 07/01/2013) Mandatory by law. Refusal is not possible.
Tax and accounting obligations (issuing receipts, rental income tax return, tourist tax) Art. 6(1)(c) — legal obligation (Presidential Decree 600/1973; tax legislation) Mandatory by law.
Protection of the Data Controller's contractual rights in or out of court Art. 6(1)(f) — legitimate interest of the Data Controller Optional, but connected to the performance of the contract.
4. Recipients of the data
Your personal data may be disclosed to the following categories of parties:
• Provider of the online booking platform, appointed as Data Processor pursuant to art. 28 GDPR, for the technical management of bookings made through the website;
• Independent Data Controllers for the fulfilment of legal obligations;
5. Transfers to third countries
Some of the technical providers used (online booking platforms) may transfer personal data to countries outside the European Union or the European Economic Area. Such transfers take place on the basis of adequate legal safeguards, such as: standard contractual clauses approved by the European Commission (SCC — Standard Contractual Clauses); adequacy decisions adopted by the European Commission in respect of the destination country.
6. Retention period
Type of data Retention period
Identity documents Deletion and destruction after the communications required by law have been made.
Tourist rental agreement and contractual data 10 years from the expiry of the contract (art. 2946 Italian Civil Code)
Tax and accounting documents (receipts, etc.) 10 years from the date of the document (art. 2220 Italian Civil Code)
Guest registration forms (Data Controller's copy) 5 years (the copy kept by the Police Headquarters is managed by the Authority)
7. Rights of the data subject
As a data subject, you have the right to:
Right of access (art. 15): obtain confirmation as to whether or not personal data concerning you are being processed and, where that is the case, access to such data and to information relating to the processing;
Right to rectification (art. 16): obtain, without undue delay, the rectification of inaccurate personal data concerning you or the completion of incomplete data;
Right to erasure (art. 17): obtain the erasure of personal data concerning you, in the cases provided for by law (e.g. if the data are no longer necessary for the purposes for which they were collected);
Right to restriction (art. 18): obtain the restriction of processing in the cases provided for by law;
Right to data portability (art. 20): receive the personal data provided to the Data Controller in a structured, commonly used and machine-readable format, where the processing is based on consent or on a contract;
Right to object (art. 21): object at any time to the processing of personal data concerning you carried out for the pursuit of a legitimate interest of the Data Controller;
Right to withdraw consent: withdraw at any time any consent given, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise your rights, you may contact the Data Controller at the contact details indicated in point 1. The Data Controller will respond to your request within 30 days of receipt, save for an extension in cases of particular complexity.
If you believe that the processing of your personal data infringes Regulation (EU) 2016/679, you have the right to lodge a complaint with the Supervisory Authority for the protection of personal data (Garante Privacy), in accordance with the procedures indicated on its official website:
Italian Data Protection Authority (Garante) | www.garanteprivacy.it | Piazza Venezia 11, 00187 Rome | Tel. 06.696771
