How we handle your data

1. What data we collect

We only collect what we need to manage your booking and to comply with Italian law:

• Contact details: first and last name, phone, email, preferred language.
• Stay details: apartment, arrival and departure dates, number of adults and children, expected arrival time, whether you travel with a dog, any notes you send us.
• Details of every guest: first and last name, date and place of birth, nationality, ID document type and number, and the photo of the document uploaded during self check-in.
• Financial details: price of the stay, deposit, balance, city tax. We never collect or store your payment card numbers.
• Footage from a camera installed inside the apartment, by the entrance, pointed only at the front door. There are no cameras in the bedrooms, the bathroom, the kitchen or any other room.

2. Why we process it and on what legal basis

• To manage the booking and the stay, answer your requests and send you the access instructions: performance of the contract (art. 6.1.b GDPR).
• To report guest details to the Italian police through the Alloggiati Web portal, as required by art. 109 TULPS: legal obligation (art. 6.1.c GDPR).
• To calculate, collect and declare the city tax to the Municipality and for regional statistics: legal obligation (art. 6.1.c GDPR).
• For tax and accounting duties on short lets: legal obligation (art. 6.1.c GDPR).
• For the security of the property and to check that only registered guests come in, through the camera pointed at the front door: legitimate interest of the controller (art. 6.1.f GDPR).
• To invite you to leave a review after your stay: legitimate interest of the controller (art. 6.1.f GDPR); you may object at any time.

3. Is providing your data mandatory?

Contact details and the identity details of every guest are required: without them we cannot accept the booking or allow the stay, because guest registration is imposed by law. Other data, such as notes or your expected arrival time, is optional and only helps us welcome you better.

4. How long we keep it

• ID document images: deleted within 7 days of reporting the data to the police.
• Identity details of registered guests: kept for the period required by Italian public security law.
• Booking and accounting records: 10 years, as required by tax law.
• Entrance camera footage: 24 hours at most, unless requested by the judicial or police authorities.
• Messages and communications: up to 12 months after the end of the stay.

5. Who we share it with

Your data is never sold or published. It may only be shared with:

• The Italian police, through the Alloggiati Web portal.
• The Municipality of Vibo Valentia, for the city tax, and the Calabria Region for mandatory statistics.
• Our tax adviser and the Italian Revenue Agency, for legal duties.
• Technical providers hosting the website and the management system: Supabase (servers in the European Union, Ireland) and Netlify. They act as data processors and do not use the data for their own purposes.
• Booking.com, limited to bookings coming from that channel, under the portal's own policy.

6. Transfers outside the European Union

Data is stored on servers located in the European Union. Some technical publishing services may involve a transfer to the United States: in that case the transfer relies on the standard contractual clauses approved by the European Commission and on the Data Privacy Framework.

7. Security

Documents uploaded during self check-in are stored in a private archive that only the host can open, through a password-protected login. The website pages use an encrypted connection. Your personal check-in link contains a private code: please do not share it with anyone else.

8. Children

Children's data is collected only because the law requires every guest to be registered, and it is entered by the adult who makes the booking, who declares to be entitled to provide it.

9. Your rights

At any time you may request access to your data, its correction or deletion, restriction of processing and data portability, and you may object to processing based on legitimate interest. To exercise these rights write to sweethomemontecristo@gmail.com: we reply within one month. Some data cannot be deleted before the legal retention periods expire, because keeping it is mandatory.

If you believe the processing of your data breaches the Regulation, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome - www.garanteprivacy.it).

10. Camera at the entrance

Inside each apartment, in the entrance area, there is a camera pointed only at the front door. It is there to check that only registered guests come in and to protect the property. It does not film the bedrooms, the bathroom, the kitchen or any other room of the house: in those rooms, simply closing the door gives you complete privacy.

The footage can be seen only by the host, is never published or shared, and is kept for 24 hours at most, unless requested by the judicial or police authorities. By booking, you confirm that you have been informed about the camera and that you have told the other guests about it.

11. Cookies

This website does not use profiling cookies or advertising trackers. Only the technical tools needed to run the pages and the check-in form are used.