Privacy policy

Data controller

Mario Demurtas, Italian tax code DMRMRA55P11L140H, Via Mura di Levante 82, 58015 Orbetello (GR), Italia.

Property: Alle Volte di San Lorenzo, Via di San Lorenzo 12, 56127 Pisa.

For any request concerning personal data: allevoltedisanlorenzo@gmail.com.

What data we process

Booking data: first name, last name, email, phone, address, country, stay dates, number of guests and any notes you enter in the booking form.

Payment data: payment takes place on Stripe’s secure pages. The controller never receives or stores your full card number.

Data required by law after booking: for stays in Italy, guest identification details must be reported to the public security authority (art. 109 TULPS) and the City of Pisa tourist tax must be calculated. For this purpose, identity document details are collected before arrival.

Browsing statistics: only if you consent via the banner, Google Analytics 4 collects aggregated data with anonymised IP about how the site is used.

Direct communications: if you write by email or WhatsApp, we process the data you provide in order to reply.

Purposes and legal bases

Managing the booking and the stay: performance of a contract (art. 6.1.b GDPR).

Guest reporting and tourist tax: legal obligation (art. 6.1.c GDPR).

Keeping accounting records: legal obligation (art. 6.1.c GDPR).

Browsing statistics: consent (art. 6.1.a GDPR), which you can withdraw at any time.

Replying to requests and preventing abuse: legitimate interest (art. 6.1.f GDPR).

Who receives the data

Stripe Payments Europe Ltd (payments), Smoobu GmbH (booking management), Vercel Inc. (website hosting) and Google Ireland Ltd (statistics, only with consent), acting as processors or independent controllers.

Authorities: the Questura (police headquarters, Alloggiati Web portal) and the City of Pisa (tourist tax), as required by law.

Data is never sold or shared with third parties for marketing purposes.

Transfers outside the European Union

Some providers (Stripe, Google, Vercel) may process data in the United States. Transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

How long we keep the data

Booking data and accounting records: as required by tax obligations, up to 10 years.

Email communications: for as long as needed to handle the request.

Statistics: in aggregated form, 14 months (Google Analytics retention setting).

Cookie choice: 12 months, after which the banner is shown again.

Your rights

You can request access to your data, rectification, erasure, restriction of processing, portability, object to processing or withdraw consent at any time by writing to allevoltedisanlorenzo@gmail.com.

If you believe the processing infringes the law, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Updates

This notice may be updated: the version published on this page is the one in force.