Privacy Policy

Data controller

Alessia’s Flat Srl, Via Emilia 22, 24035 Curno (BG), Italy, VAT and tax code 10517740964, REA BG-486856, tel. +39 391 7651535, email alessiasflat@gmail.com, certified email (PEC) alessiasflatsrl@pec.it

Data collected via the contact form

When you submit the contact form we collect: name, email address, optional company name, apartment of interest, the text of your request, which boxes you ticked (privacy notice read, marketing consent) and the date and time of submission. This data is transmitted via the EmailJS service to a Controller’s mailbox (hosted on Gmail/Google), solely to respond to your request. Providing the fields marked as mandatory is necessary to be able to reply: without them the request cannot be submitted.

If you tick the relevant checkbox, your name and email may also be used to send you direct marketing communications (updates on new apartments, offers and proposals). This consent is optional, separate from sending your request, and is not required to receive a reply. We do not carry out profiling or automated decision-making.

Legal basis: performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR) to answer the form; consent (Art. 6(1)(a) GDPR) for marketing. You can withdraw consent at any time, without affecting the lawfulness of earlier processing, by writing to alessiasflat@gmail.com.

Bookings and guest data

Bookings are completed on external platforms (the RoomCloud booking engine linked to the “Book” buttons, or Airbnb and other portals), which process the data you enter under their own notices. For confirmed stays the Controller processes guest data (identity, contact details, ID document) to perform the contract (Art. 6(1)(b) GDPR) and to comply with legal obligations, including reporting guests’ details to the public security authorities (Art. 109 TULPS, Art. 6(1)(c) GDPR) and tax and tourist-tax obligations. Check-in information is provided in a password-protected area of the site reserved for guests.

Technical data and cookies

The site uses first-party technical data and cookies/local storage, as well as third-party ones. For details on categories, purposes, and duration see our Cookie Policy.

Recipients and third-party providers

• EmailJS – delivery of emails generated by the contact form. Provider’s privacy policy
• Hygraph (GraphCMS) – management of site content (text, images); to serve content and images your browser connects to its servers, which receive your IP address and technical request data. Provider’s privacy policy
• Google Maps – interactive map display, loaded only with your consent to third-party content; Google may set its own cookies and track browsing once the map is loaded. Provider’s privacy policy
• Instagram/Meta – embedding of public Instagram posts, loaded only with your consent to third-party content; Meta may set cookies and track browsing. Provider’s privacy policy
• Podcast provider – embedded audio player, loaded only with your consent to third-party content; the provider may set its own cookies. See the notice shown in the player itself
• Google (Gmail) – the Controller’s mailbox that receives requests sent through the form. Provider’s privacy policy
• RoomCloud – booking engine outside this site, to which you are redirected via the “Book” button. Read its privacy notice before entering your data
• Airbnb – profile pictures shown in reviews are loaded from Airbnb servers (a0.muscache.com), which receive your IP address. Provider’s privacy policy
• Vercel Inc. – site hosting and technical request handling (connection logs, security and site operation; legal basis: legitimate interest, Art. 6(1)(f) GDPR). Provider’s privacy policy

Some providers may be based, or operate servers, outside the European Economic Area. Where this occurs, transfers rely on an adequacy decision (e.g. the EU-US Data Privacy Framework for certified providers) or on standard contractual clauses, as stated in each provider’s notice. You can request a copy by writing to the Controller.

Retention period

Contact form data is kept for 12 months from your request, unless a contract is concluded (in which case statutory periods apply, normally 10 years for accounting and tax records). Marketing data is kept until consent is withdrawn and in any case no longer than 24 months from the last contact. Technical logs are kept by the hosting provider only as long as strictly necessary. Cookie preferences remain stored locally on your device until manually cleared.

Your rights

Under Articles 15-22 GDPR you may at any time request: access to your data, rectification, erasure, restriction of processing, data portability, and objection to processing (including direct marketing). You may also withdraw any consent you gave at any time. To exercise these rights, write to alessiasflat@gmail.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Minors

The site is not directed at minors under 14, and we do not knowingly collect data from minors without parental consent.

Changes to this notice

This notice may be updated from time to time. The last-updated date is shown at the top of the page.