Dear Guest,
This privacy notice describes how your personal data is processed by the company Eredi Amodeo S.r.l.s., with registered office in Rome, via Teodolfo Mertel, 7, VAT number 13187511004 (hereinafter, the "Company" or the "Data Controller"), in its capacity as Data Controller pursuant to Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and Legislative Decree No. 196/2003 and subsequent amendments (Privacy Code). The protection of your personal data is of fundamental importance to us, and we are committed to processing it with the utmost confidentiality and transparency, guaranteeing the protection of your rights.
1. Type of Personal Data Processed
The Company collects and processes the following personal data:
Identification and Contact Data: name, surname, date and place of birth, citizenship, tax code (codice fiscale), residential address, telephone number, email address.
Identity Document Data: type, number, and expiry date of the document, image of the document.
Stay Data: check-in date, check-out date, arrival and departure time, booked accommodation, price of the stay, amount of the tourist tax.
Payment Data: credit/debit card details (only the information strictly necessary for authorization and transaction, not the full card number data which is not stored in readable form), IBAN code, and other banking information.
Data related to potential requests for additional services: information relating to specific needs (e.g., requests for cribs, disabled access, requests for so-called "ancillary services," such as sea, air, or land transport services, catering, beach club, etc.), voluntarily communicated by the guest, which could indirectly reveal special categories of data (e.g., health data). Such data will be processed only if strictly necessary to fulfill the specific request and with your explicit consent, when required.
Navigation and Traffic Data (for Wi-Fi service): temporary IP addresses of devices used for the connection, start and end date and time of connection, volume of data downloaded/uploaded.
2. Purposes and Legal Bases of Processing
The personal data indicated above are processed for the following purposes and based on the following legal bases:
A. Management of Reservations and Provision of Accommodation and Tourist Services
Purpose: to manage your requests for information, availability, and quotes related to our properties, to process and confirm reservations, to allow the stay at the holiday homes, to manage your check-in and check-out, including the delivery of keys and the communication of all necessary instructions for accessing and using the holiday home itself, to collect and manage payments, to calculate and collect the tourist tax, to manage any assistance requests or requests related to additional services, as defined above.
Legal Basis: The processing is necessary for the performance of a contract you’re a party of or for the implementation of pre-contractual measures adopted at your request (Art. 6, par. 1, letter b) of the GDPR). In some cases, where the processing relates to assistance requests or requests concerning additional services, as identified above, the processing may be based on the legitimate interest of the Data Controller to ensure maximum customer satisfaction (Art. 6, par. 1, letter f) of the GDPR).
B. Fulfillment of Legal Obligations
Purpose: To comply with the obligations established by current legislation, in particular:
communication of guest data to the public security authorities (Police Headquarters - Questura), as required by Art. 109 of the Italian Law on Public Security (T.U.L.P.S.);
administrative compliance, including the transmission of presences to the competent regional bodies and Istat (National Institute of Statistics);
tax and accounting compliance, including the issuance and storage of invoices and the management of the tourist tax, where applicable.
Legal Basis: The processing is necessary to comply with a legal obligation to which the Data Controller is subject (Art. 6, par. 1, letter c) of the GDPR).
C. Provision of the Wi-Fi Service
Purpose: To allow guests internet access, manage connectivity, and ensure the correct functioning of the Wi-Fi network offered within the facility.
Legal Basis: The processing is necessary for the performance of the contract to which you are a party (Art. 6, par. 1, letter b) of the GDPR), if the Wi-Fi service is included in the accommodation package or offered as an ancillary service.
3. Obligation to Provide
Data The provision of your personal data for the purposes indicated in point 2 of this notice is mandatory. Any refusal to provide such data would make it impossible for the Company to manage your reservation and provide you with the requested services, as well as to comply with legal obligations.
4. Processing Methods and Data Security. Source of Data
The processing of your data is carried out by means of the operations indicated in Art. 4, no. 2) of the GDPR, and precisely: collection, recording, organisation, storage, consultation, elaboration, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure, and destruction of data. Your personal data is subject to both paper-based and electronic and/or automated processing. The Company adopts adequate technical and organizational security measures to ensure a level of security appropriate to the risk, in order to prevent data loss, unlawful or incorrect use, and unauthorized access. Personal data is provided directly by the data subject to the Data Controller or collected through other parties such as:
OTAs (Online Travel Agencies) such as, for example, Airbnb, Booking.com, VRBO, etc.;
Traditional travel agencies, as well as Bodies, Associations, Organizations, Companies, or private individuals.
5. Recipients or Categories of Data Recipients
Your personal data may be communicated to:
Public Security Authorities: (e.g., Police Headquarters - Questura) for the fulfillment of legal obligations.
Local Authorities: (e.g., Municipality of Conca dei Marini) for the fulfillment of legal obligations.
Tax and Accounting Consultants: for the fulfillment of legal obligations in tax and accounting matters.
Banks and Payment Service Providers: for the management of payments relating to the stay.
Service Providers operating on behalf of the Company as Data Processors: These are third parties who process personal data on behalf of and according to the instructions of the Data Controller, such as providers of reception and assistance services before, during, and after the stay, IT service providers (reservation management systems, accounting software, cloud platforms), external consultants (tax, legal), providers of Wi-Fi network management services or communication platforms. These parties are bound by specific contracts and instructions on data protection.
Partners who provide essential services for the stay: (e.g., property management and cleaning companies) limited to the data strictly necessary for the provision of the service.
Judicial Authorities and Law Enforcement: for the purposes of ascertaining and prosecuting crimes, in case of specific requests based on legal provisions.
Professionals or law firms: in case of necessity to protect the Company's rights in court.
An updated list of Data Processors, with their relative contact information, is available at the Data Controller's registered office and/or can be requested using the contacts indicated in point 9 of this notice.
6. Data Retention Period
Your personal data will be retained for the time strictly necessary to achieve the purposes for which it was collected and processed, and in any case, no longer than:
10 years, according to the provisions of the Civil Code
5 years for data subject to communication to the Public Security Authorities, based on the current legislation provided for by the T.U.L.P.S.
7 days after the check-out date for credit card data
6 hours for navigation and traffic data processed to provide the Wi-Fi service
Data relating to the use of the Wi-Fi service (e.g., access logs, IP and MAC addresses) will be retained for [specify the period, e.g., 6 months or 1 year] in order to comply with legal obligations and protect the Company in case of unlawful acts. At the end of the retention period, the data will be deleted or irreversibly anonymized, subject to further legal obligations.
7. Data Transfer Abroad
Your personal data is stored on servers located within the European Union. Should it be necessary to transfer personal data to countries outside the European Union, the Company undertakes to ensure that the transfer takes place in compliance with the provisions of the GDPR (e.g., through the adoption of Standard Contractual Clauses approved by the European Commission or by verifying the existence of adequacy decisions).
8. Rights of the Data Subject
As a data subject, you are granted the following rights in relation to your personal data, which can be exercised at any time and free of charge by contacting the Data Controller:
Right of Access (Art. 15 GDPR): to obtain confirmation as to whether or not your personal data is being processed, and, where that is the case, to receive a copy thereof.
Right to Rectification (Art. 16 GDPR): to obtain the correction of inaccurate personal data or the completion of incomplete data.
Right to Erasure ('Right to be Forgotten') (Art. 17 GDPR): to obtain the erasure of your personal data (e.g., if it is no longer necessary for the purposes or if consent is withdrawn).
Right to Restriction of Processing (Art. 18 GDPR): to obtain the blocking of the processing of your data under certain circumstances.
Right to Data Portability (Art. 20 GDPR): to receive your data in a structured, commonly used, and machine-readable format, and to request its transfer to another controller.
Right to Object (Art. 21 GDPR): to object to the processing of your personal data, on grounds relating to your particular situation, where the processing is based on legitimate interest.
Right to Withdraw Consent (Art. 7, par. 3 GDPR): to withdraw consent at any time, where processing is based on consent. The withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
Right to Lodge a Complaint (Art. 77 GDPR): to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (Piazza Venezia n. 11 - 00187 Rome - Tel. 06.696771 - Fax 06.69677.3785 - email: [email protected] - PEC: [email protected]), if you believe your rights have been violated.
9. Contact Details of the Data Controller
To exercise your rights or for any questions or requests relating to the processing of your personal data, you can contact the Data Controller: Eredi Amodeo S.r.l.s., via Teodolfo Mertel, 7 Email: [email protected], PEC: [email protected]
Last Updated Date: August 6, 2025
