Privacy and cookies
Notice version dated 8 September 2026
Information on personal data processing under Articles 13 and 14 of Regulation (EU) 2016/679.
Controllers and contact point
Stefano Gandolfi and Margherita Casati are joint controllers for processing connected with the website, shared email inbox and common handling of enquiries. Stefano owns the Perledo home; Margherita owns the Mandello del Lario and Carate Urio homes. Once an enquiry is assigned, each acts as controller for stay data relating to their own homes. They have agreed their respective roles and chosen one contact point: affittibrevilakecomo@gmail.com, +39 339 438 8233, Via della Pace 12, 23828 Perledo (LC), Italy. The essence of their arrangement is available on request. No data protection officer has been appointed because the conditions in GDPR Article 37 are not met.
Data and sources
The website collects the home, dates, number of guests and exempt guests, name, email, telephone, language, message, estimate amounts, enquiry status and technical references needed to manage it. Stripe provides the payment outcome and identifiers, without giving owners full card details. For stays originating from Airbnb or another platform, data may come from that platform or the booking guest, including details about other guests. iCal calendars provide unavailable dates and technical references. Do not send identity documents or health data in the availability form.
Purposes and legal bases
Data are used to prepare an estimate, check availability, reply and take precontractual steps at the person’s request (GDPR Article 6(1)(b)). For confirmed stays, data are used to perform the contract, manage payment and assistance (point b), and meet tax, statistics, public security and tourist tax duties (point c). Data strictly needed for disputes, damage, fraud or payments may be processed for the legitimate interest in establishing or defending a legal claim (point f). There are no newsletters, profiling or automated booking decisions.
Providing data
Browsing the homes is unrestricted. Fields marked as required are needed to assess an enquiry; without them the owners cannot reply or complete a booking. Consent is not required for a precontractual enquiry.
Recipients and services
Data may be processed, as necessary for their services, by OpenAI Sites and Cloudflare for the website, infrastructure and database; Resend for transactional email; Google for Gmail; Meta for WhatsApp if selected; Stripe for payment; Vikey for separately explained check-in procedures; and confidential accounting or technical advisers. For confirmed stays, legally required data may be disclosed to the Police through Alloggiati Web, Regione Lombardia or statistics bodies through ROSS1000, municipalities for tourist tax, the Italian Revenue Agency and other competent authorities. Google Maps and Airbnb open only when their links are selected.
Transfers outside the EEA
Some providers may process data outside the European Economic Area. A transfer then relies on an adequacy decision, including the EU-US Data Privacy Framework where applicable to the recipient, or on Standard Contractual Clauses and other safeguards under GDPR Chapter V. You can ask the contact point which safeguard applies and request an accessible copy of its terms.
Retention
Unconfirmed enquiries are deleted 6 months after the last contact, except data needed for a specific dispute. For confirmed stays, contractual, accounting and tax documents are kept for 10 years; tourist tax records for the period required by the municipality, currently 5 years in Mandello and at least 6 years for receipts in Carate Urio; mandatory submission receipts for the period needed to demonstrate compliance. Technical and security data are kept only as long as needed for the service and, after an incident, its handling. Identity document copies are not retained beyond identification and legal reporting unless required by law or a specific dispute.
Check-in and documents
Identification takes place in person or, when used, by real-time video call at the time of access. A dedicated check-in notice is provided before data are collected through Vikey or another dedicated channel. The booking website does not request document uploads.
Cookies and browsing
The website does not use advertising, traffic analytics or profiling. Photos and fonts are hosted locally and maps are not embedded. Only technical elements needed to deliver the website and protect the private area are used; language remains in the page address. A consent banner is therefore not required. Stripe uses its own technical elements when you open its checkout page. Any future non-essential tools will be blocked until the user chooses and this notice will be updated.
Rights and complaint
You may request access, rectification, erasure, restriction and, where applicable, portability, and object to processing based on legitimate interests. Use the contact point; a response is normally provided within one month. You may lodge a complaint with the Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome, certified email protocollo@pec.gpdp.it, www.garanteprivacy.it.
Privacy contact
Via della Pace 12, 23828 Perledo (LC)
affittibrevilakecomo@gmail.com
+39 339 438 8233
Italian Data Protection Authority