Privacy Policy

1. Data Controller

Marilena Civetta, owner and landlord of the property “Il Gatto e la Civetta”, Via del Vasaro 25, 61032 Fano (PU), Italy — CIN IT041013C2JAJ5LGCY, CIR 041013-LOC-01360.

For any request regarding the processing of your personal data, you can write to ilgattoelacivettafano@gmail.com.

Day-to-day management of the stay and communication with guests is handled by the property manager, who acts on the instructions of, and on behalf of, the data controller.

2. What data we process, why, and with whom

This section summarises every “channel” through which guests’ personal data may pass, what is collected and why.

2.1 Enquiries and direct bookings

Active

When you contact us via WhatsApp, phone or email (including through the links on the site), we process your name, phone number and/or email address, along with any other information you provide voluntarily (e.g. stay dates, number of guests). Purpose: to respond to your enquiry and, if it goes ahead, to manage the booking. Legal basis: pre-contractual measures taken at your request / performance of the tourist rental contract.

2.2 Bookings through platforms (Booking.com, Airbnb, Vrbo, Google Tourism)

Being activated

Once these platforms are active, we will receive from them the data needed to manage the booked stay (name, contact details, dates, any special requests). Booking.com, Airbnb, Vrbo and Google Tourism (Vacation Rentals) are, as a rule, independent data controllers for the data they collect on their own platforms: they have their own privacy policy governing that stage. We process the data they pass on to us only to manage and fulfil the booking. Legal basis: performance of the contract.

2.3 Channel manager / booking engine (Lodgify)

Active

Lodgify manages the site’s direct bookings on our behalf and synchronises the calendar and bookings with the various channels (Booking.com, Airbnb, Vrbo, Google Tourism) as they are activated. In this role it acts as a data processor, under the data processing agreement (DPA) provided for in its terms of service.

2.4 Legal obligations related to the stay

Active (applies to every stay, regardless of the booking channel)

By law, the identifying data of guests (ID document, personal details) is reported to:

• Alloggiati Web (Pesaro e Urbino Police Headquarters) — registration of guests, within 24 hours of arrival;
• ROSS 1000 (Marche Region) — regional register of accommodation facilities;
• Comune di Fano (Fano City Council) — for tourist tax purposes.

Legal basis: legal obligation. This kind of disclosure doesn’t require the data subject’s consent, but it must be stated in this privacy notice.

2.5 Virtual assistant for guests (AI)

Not yet active — section prepared in advance

We are exploring a conversational assistant (based on artificial intelligence, using Anthropic’s Claude technology) to answer guests’ practical questions during their stay (e.g. WiFi password, check-in/check-out times, recycling collection days). Once activated:

• It will only be accessible via a password-protected, non-indexed page reserved for guests, not from the public part of the site;
• Text typed by the guest is sent to Anthropic (the AI service provider, based in the United States), which processes it to generate a reply and acts as a data processor under a dedicated Data Processing Agreement that includes the Standard Contractual Clauses approved by the European Commission for transfers of data outside the EU;
• By default, this content is not used to train AI models, and is retained by Anthropic only for a limited period for safety purposes; depending on the plan chosen, the option to enable stricter retention settings will be considered;
• No sensitive data or identity documents will be requested through this channel;
• Before activation, this section will be updated with the final technical details and, if necessary, specific consent will be requested.

2.6 Google services linked to the site

Active

The site uses links to Google Maps (to reach the house and nearby points of interest) and displays events from a public Google Calendar managed by the property: the latter contains no personal data about guests, only information about local events. Google Maps links only open Google’s service if actively clicked by the user, who remains subject to Google’s own privacy policy. Google Analytics and any statistical tracking system are not currently active on our site (the payment page hosted by Lodgify has its own cookie management: see section 2.8): if activated in future, this notice and the cookie banner will be updated accordingly, with consent requested where required.

2.7 Social media and Meta Pixel

Links active · Pixel not active

The site and its contact channels include links to the property’s Instagram (@ilgattoelacivettafano) and Facebook (facebook.com/ilgattoelacivetta) profiles: clicking them takes you to the respective platforms, run by Meta Platforms Ireland Ltd., which acts as an independent data controller for the data collected there (under its own privacy policy). The link itself does not install any cookie or tracker on the site.

The Meta Pixel (Meta’s tool for measuring advertising conversions on Instagram/Facebook) is not currently installed. If it is activated in future for marketing purposes, Meta will act as an independent controller (or joint controller, depending on the technical setup) for data collected via the Pixel: before activation, this notice and the cookie banner will be updated with the details of the processing, and the user’s explicit consent will be requested, as required by the Italian Data Protection Authority’s guidelines on cookies and tracking tools (see the regulatory references in section 8).

2.8 Online payments (Lodgify, Stripe, PayPal) and the “Pay in instalments” message

Active

For direct online bookings, payment takes place on Lodgify’s payment page, which operates on our behalf (see section 2.3). Card or payment account details are entered directly into the payment providers’ systems: the property never sees or stores them, and only receives the payment outcome, the amount and the booking details.

• Stripe (Stripe Payments Europe, Ltd., Ireland) processes card payments and the other methods shown on the payment page. As a rule, it acts as a data processor for carrying out the payment and as an independent controller for fraud prevention and its own legal obligations, under its own privacy policy.
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg): if you choose PayPal, you log in to your account and complete the payment on the PayPal platform, which processes the data as an independent controller under its own privacy policy. Pay-in-instalments options, such as paying in three instalments, are an arrangement between the guest and PayPal, which decides whether to approve them.

Other payment methods. The payment page may also show other digital wallets (for example Google Pay, Satispay, Revolut Pay, Amazon Pay): if you choose one, you complete the payment in the relevant provider’s system, which processes the data under its own privacy policy. The same page may ask for your consent to charge future payments: in that case the payment method is kept by the payment provider, not by us.

Payment page and cookies. The payment page is on a Lodgify address (checkout.lodgify.com), not on our site, and is governed by Lodgify’s cookie policy. The cookies on that page belong to Codebay Solutions Limited (United Kingdom), the provider of Lodgify’s infrastructure: they are technical cookies (for example to remember the currency and the country) and, only if you consent in the banner on that page, Google Analytics statistics cookies. The consent you give or refuse on that page does not apply to our site, and vice versa.

Legal basis: performance of the rental contract; for the payment providers, also their own legal obligations (for example tax and anti-money-laundering rules).

“Pay in instalments” message on the home page. On the Italian version of the home page, next to the booking form, a short PayPal message about pay-in-instalments options may appear. The message is generated by a PayPal script which, in order to work, connects to PayPal’s servers (sending, for example, your IP address and browser information) and may use PayPal cookies or similar technologies. For this reason the script is only loaded if you accept the “marketing” category in the cookie banner: without consent the message does not appear and PayPal is not contacted. You can change your consent at any time using the “Manage consent” button. Legal basis: consent.

2.9 Online check-in and contract signing (Chekin)

Active

Before arrival, guests receive by email a link to complete online check-in on Chekin (Chekin Soluciones Digitales, S.L., Spain), a service connected to Lodgify bookings. Check-in collects the personal and contact details of the guests, the details and a copy of their identity document, and the signature of the tourist rental contract. The service’s emails (check-in invitations, a copy of the signed contract) are sent to the email address given in the booking.

Chekin acts on our behalf as a data processor, under the data processing agreement (DPA) provided for in its terms of service. Legal basis: performance of the rental contract and, for the identifying data and the document, legal obligation (see section 2.4).

2.10 Guest reviews

Active

On the home page we show a selection of reviews left by guests on Google. The reviews are written by users on Google, which is an independent controller for them; we copy them by hand (there is no automatic link with Google) and publish only the first name and the initial of the surname, the country of origin if we know it, the month, the stars and the text; we do not publish profile photos. If the author had a particular relationship with us (for example a complimentary stay or a friendship or family tie) we say so next to the review. The copies are kept in a restricted-access internal archive on Google cloud services (Firebase), which we use as a data processor.

After the stay we may send to the booking email address a message inviting guests to leave a review on Google; leaving one is optional.

Legal basis: the controller’s legitimate interest in presenting the property’s reputation transparently (Article 6(1)(f) GDPR), given that the author made the review public on Google. If you want your review, or your name or country, to no longer appear on our site, you can ask at any time at ilgattoelacivettafano@gmail.com: we will remove it from our site (it stays on Google, which decides independently).

3. Disclosure of data to third parties

To summarise the above, depending on the channel used, data may be disclosed to: Pesaro e Urbino Police Headquarters (Alloggiati Web), the Marche Region (ROSS 1000), Comune di Fano (tourist tax), Booking.com, Airbnb, Vrbo and Google Tourism (once active, as independent controllers), Lodgify and Codebay Solutions Limited, the provider of its infrastructure (as data processor), Chekin (online check-in and contract signing, as data processor), Stripe and PayPal (in the roles described in section 2.8; PayPal also for the “Pay in instalments” message, only with consent), Google (cloud services used for the internal archive of reviews, as data processor), Anthropic (once the AI assistant is active, as data processor). We do not sell or transfer personal data for third-party advertising or marketing purposes.

4. Data transfers outside the European Union

Some of the providers listed above (in particular Anthropic, for the potential AI assistant, the payment providers Stripe and PayPal, which belong to groups based in the United States, and Google, for the reviews archive and for Google Analytics on the payment page, only with consent) may process data on servers located in the United States. In these cases, the transfer takes place on the basis of the Standard Contractual Clauses adopted by the European Commission or other safeguards provided for by the GDPR (for example the EU-US adequacy decision, the Data Privacy Framework, for companies that have joined it), which guarantee a level of data protection equivalent to that required by the GDPR. Codebay Solutions Limited is based in the United Kingdom, which is covered by a European Commission adequacy decision.

5. Retention period

Data collected to handle an enquiry or a booking is kept for as long as necessary to complete the stay and to meet any subsequent tax, accounting or legal obligations (normally up to 10 years for tax records, as required by law). Data transmitted under legal obligation (Alloggiati Web, ROSS 1000, tourist tax) is retained according to the timeframes set by the relevant regulations, not by the property. Reviews published on the site stay for as long as the controller finds them useful or until the data subject asks for removal.

6. Your rights

At any time, you can request: access to your data, rectification, erasure, restriction of processing, portability, and objection to processing. Requests should be sent to ilgattoelacivettafano@gmail.com or, for formal communications, to our certified email address (PEC, the Italian legally-recognised certified email system) at ilgattoelacivettafano@pec.it. You can also lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority) — www.garanteprivacy.it, in the “Exercise your rights” section.

7. Cookies

For details on cookies and any tracking tools used by the site, please see the dedicated Cookie Policy.

8. Regulatory references

• Regulation (EU) 2016/679 (GDPR) — General Data Protection Regulation;
• Legislative Decree No. 196 of 30 June 2003 (the “Privacy Code”), as amended by Legislative Decree No. 101 of 10 August 2018 to align with the GDPR;
• Garante Provision No. 231 of 10 June 2021 — Guidelines on cookies and other tracking tools;
• Garante per la protezione dei dati personali (Italian Data Protection Authority) — official website, for contact details, complaints and further information.