Privacy Policy

Casa Santa Vincenza – Lovere (BG), Italy · pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 · Last updated: 4 October 2026

This notice explains how we process the personal data of guests staying at Casa Santa Vincenza (Terrazza S. Vincenza – Casa Lago and Santa Vincenza – Suite Indipendente), of anyone making a booking, and of visitors to www.vincenzaloverestay.com.

1. Data controller

Marcello Belleri – Casa Santa Vincenza, Via Cavallotti 10, 24065 Lovere (BG), Italy – Tax code BLLMCL84E19B157Q – CIN IT016128C2PWE7837Q

Email: [email protected] – Phone +39 345 22 88 511

The controller has not appointed a Data Protection Officer (DPO), as this is not required.

2. What data we process

Identification and contact data of the person booking: first name, surname, email, phone number, address, language.
Booking data: dates of stay, number of guests, accommodation, amounts, special requests, messages exchanged.
Identity document data of all guests (including minors and companions): name, surname, sex, date and place of birth, citizenship, document type and number, as required by law.
Payment data: method, amount and date. Full card details are processed directly by payment providers and are not stored by the controller.
Tax data (tax code/VAT number) if a receipt in a specific name is requested.
Browsing data and cookies collected by the website (IP address, browser type, pages visited), according to the preferences set in the cookie banner.

If you provide data about other people (e.g. travel companions), please inform them of the content of this notice.

3. Why we process data and on what legal basis

Managing the booking and the stay (confirmation, check-in, assistance, communications before, during and after the stay). Legal basis: performance of a contract and pre-contractual measures (Art. 6.1.b GDPR).
Reporting guests to the Police (Questura) via the Alloggiati Web portal, within the legal deadlines. Legal basis: legal obligation (Art. 109 of the Italian Public Security Act – R.D. 773/1931; Art. 6.1.c GDPR).
• Tourism statistics (ISTAT), through the regional system, using aggregated or anonymous data. Legal basis: legal obligation (Art. 6.1.c GDPR).
Tourist tax of the Municipality of Lovere: calculation, collection, payment and reporting. Legal basis: legal obligation and municipal regulation (Art. 6.1.c GDPR).
Tax and accounting obligations (receipts, income tax return). Legal basis: legal obligation (Art. 6.1.c GDPR).
• Protecting the controller’s rights (e.g. damage, security deposit, disputes, debt collection). Legal basis: legitimate interest (Art. 6.1.f GDPR).
• Asking for a review after the stay, with a single message. Legal basis: legitimate interest (Art. 6.1.f GDPR). You may object at any time.
Offers and promotional messages (e.g. newsletter, returning-guest discounts): only with your express consent, which is optional and can be withdrawn at any time (Art. 6.1.a GDPR).
Website operation and security: legitimate interest (Art. 6.1.f GDPR). Non-essential cookies (analytics or marketing) are used only with your consent via the cookie banner.

4. Whether providing data is mandatory

Providing data for booking and legal purposes is necessary: without it we cannot confirm the booking or allow the stay. In particular, identity document data is required by law, and failure to provide it prevents accommodation. Consent to promotional messages is optional and refusing it has no effect on your stay.

5. How we process data

Data is processed electronically and, where necessary, on paper, with appropriate technical and organisational measures to protect it against unauthorised access, loss or destruction. Copies or photos of identity documents are used only for reporting to the Police and are not kept longer than strictly necessary. We do not carry out profiling or decisions based solely on automated processing.

6. Who we share data with

Data may be shared, only for the purposes stated above, with:

Public authorities: Police/Ministry of the Interior (Alloggiati Web), ISTAT and Lombardy Region (statistics), Municipality of Lovere (tourist tax), Italian Revenue Agency and other authorities where required by law.
Service providers acting as data processors: booking management platform and website (Lodgify), payment services, email and cloud services (Google), messaging (WhatsApp/Meta), tax advisor.
Authorised collaborators (e.g. cleaning, guest reception), limited to the data needed for their tasks.
Booking platforms (e.g. Booking.com, Airbnb): if you book through them, they process your data as independent controllers under their own privacy policies.

Data is never published or sold to third parties.

7. Transfers outside the European Union

Some providers (e.g. Google, Meta) may process data outside the EU, in particular in the United States. In such cases the transfer is based on a European Commission adequacy decision (EU-U.S. Data Privacy Framework) or on Standard Contractual Clauses (Art. 46 GDPR).

8. How long we keep data

Booking data, receipts and tax records: 10 years, as required by Italian civil and tax law.
Identity document data: only for the time needed to submit it to Alloggiati Web; transmission receipts are kept for the period required by law.
Tourist tax data: for the period required by the municipal regulation and tax law.
Messages and requests: up to 24 months after the end of the stay, unless needed to protect our rights.
Data for promotional messages: until consent is withdrawn, and in any case no longer than 24 months after the last contact.
Cookies: as stated in the website cookie banner.

9. Your rights

You may exercise at any time the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and withdrawal of consent (without affecting the lawfulness of prior processing). Some rights, such as erasure, may be limited by legal retention obligations.

To exercise them, write to [email protected]: we will reply within 30 days.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.garanteprivacy.it).

10. Changes

This notice may be updated. The current version is always published on this page, with the date of the last update.

Testo da sostituire nei Termini e Condizioni

Sostituisci l’intero articolo 12 «Privacy e Trattamento Dati» dei Termini e Condizioni con questo testo breve, che rimanda alla Privacy Policy.

IT – 12. Privacy e trattamento dei dati

I dati personali degli ospiti sono trattati da Marcello Belleri, titolare del trattamento, per gestire la prenotazione e il soggiorno e per adempiere agli obblighi di legge (comunicazione alla Questura tramite Alloggiati Web, statistiche turistiche, imposta di soggiorno, adempimenti fiscali), come descritto nella Privacy Policy pubblicata su www.vincenzaloverestay.com/it/privacy-policy, che costituisce parte integrante dei presenti Termini.

EN – 12. Privacy and data protection

Guests’ personal data are processed by Marcello Belleri, data controller, to manage the booking and the stay and to comply with legal obligations (guest registration with the Police via Alloggiati Web, tourism statistics, tourist tax, tax compliance), as described in the Privacy Policy published at www.vincenzaloverestay.com/en/privacy-policy, which forms an integral part of these Terms.