Privacy policy

Data controller

Oreste Margiotta – impresa individuale, registered office Via Ostiense 353, 00146 Roma, VAT no. 17901501001. Email for privacy requests: ostiense353@romestays.com.

The property is managed on the controller’s behalf by RomeStays S.R.L.S., which processes guest data as a data processor.

What data we process

Browsing: the server hosting the site records technical data (IP address, browser, pages requested) needed to run and secure it. Visit statistics are collected in aggregate form, without cookies and without identifying you.

Booking: the data you enter in the booking form (name, contact details, address, dates, number of guests, any messages) and payment data. Card details are handled directly by the payment provider and never reach us.

Your stay: at check-in, the identity document details of each guest, which the law requires us to collect and report.

Why we process it

To manage your booking and stay (performance of a contract, Art. 6(1)(b) GDPR).

To meet legal obligations: reporting guests to the police (Art. 109 TULPS), the Rome city tax, tourism statistics, tax and accounting duties (Art. 6(1)(c) GDPR).

For website security and anonymous visit statistics (legitimate interest, Art. 6(1)(f) GDPR).

To show you Google’s interactive map, only if you ask for it (consent, Art. 6(1)(a) GDPR).

Who we share it with

Providers who process it on our behalf: Smoobu GmbH (Germany), for the calendar and booking form; Stripe, for online payments; Vercel Inc., for website hosting; Cloudflare, Inc., for the network that protects and speeds up the site and for visit statistics; RomeStays S.R.L.S., for managing the property.

The authorities, where required by law. We do not sell your data or use it for advertising.

Some providers may process data outside the European Union (for example in the United States). In that case the transfer relies on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

How long we keep it

Booking data for as long as needed to manage the booking and then for the periods required by law, in particular up to 10 years for tax and accounting records. Technical browsing data for no longer than strictly necessary.

Your rights

You can ask for access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest (Arts. 15–22 GDPR), by writing to ostiense353@romestays.com. You can withdraw your consent to the map at any time.

If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).