Privacy Policy

The controller for the processing of personal data within the meaning of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, is:

La Serena Apartment, Via Monti 18, 37018 Malcesine sul Garda (VR), Italy

Contact details: laserenamalcesine@gmail.com — phone +39 376 129 8768

Regional identification code (CIR): 023045-LOC-00528. National identification code (CIN): IT023045C2BOE3M497. We have not appointed a Data Protection Officer, as we do not meet the criteria set out in Art. 37 GDPR. Please address all privacy-related requests to the contact details above.

This policy explains how we handle personal data when you browse this website, send us an enquiry, or stay in one of our apartments. It does not cover third-party websites we link to, including booking platforms and social media, each of which operates under its own privacy policy.

We process personal data only for the purposes set out below, and only on the legal bases indicated.

3.1 Visiting the website and viewing availability

Purpose: delivering the website, keeping it secure, and showing accurate availability in the booking calendar. When you open a page, our hosting provider records your IP address, the date and time of access, the pages you view, the referring URL, and information about your browser and operating system. When the booking form loads free dates, your browser sends a request to a service we operate on Cloudflare's infrastructure, which processes your IP address to route and protect that service.

Categories of personal data: IP address, date and time of access, pages viewed, referring URL, browser type and version, operating system. The availability data itself contains nothing but free and occupied dates — all guest information present in the calendar feeds we receive from booking platforms is discarded and is never stored or published.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in running a secure website and showing accurate availability.

3.2 Enquiries and bookings

Purpose: answering your enquiry, quoting a price, and — where a booking follows — performing the rental contract. The enquiry form asks for your name and email address and records the dates you selected in the calendar. You may also contact us by email or phone. The form is provided by Webflow: submissions are stored in our Webflow account and forwarded to us by email.

Categories of personal data: name, email address, phone number, selected dates, message content, and — once a booking is confirmed — billing address, the number and names of guests, payment reference, and any special requests.

Legal basis:

Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract, and performance of the rental contract itself.

Art. 6(1)(f) GDPR — for general enquiries unrelated to a booking, our interest being to reply to people who contact us. Art. 6(1)(c) GDPR applies to our invoicing and accounting obligations.

3.3 Reporting required by law

Italian law obliges every accommodation provider to transmit certain guest data to the authorities, and we cannot host you without doing so. Within 24 hours of check-in we transmit the identification details of every guest — name, date and place of birth, citizenship, and identity document details — to the Italian State Police through the Alloggiati Web portal, as required by Art. 109 of the Consolidated Law on Public Security (TULPS).

We also report the number of guests and nights stayed to the Comune di Malcesine, so that the local tourist tax (imposta di soggiorno) can be calculated and paid, and, where applicable, aggregated occupancy figures for regional and national tourism statistics.

Legal basis: Art. 6(1)(c) GDPR — compliance with a legal obligation.

This website uses only strictly necessary cookies. We do not use analytics, advertising, or profiling cookies, and nothing on this site tracks you across other websites.

Strictly necessary cookies do not require your consent under Art. 122 of the Italian Privacy Code, because they exist solely to deliver the service you asked for.

Full details of every cookie we set, and of how to change your choice at any time, are given in our Cookie Policy.

We do not sell your data and we do not share it for advertising purposes.

The following providers may handle your data, each acting either as our processor under Art. 28 GDPR or as an independent controller:

• Webflow, Inc. (United States) — hosting of this website and processing of enquiry form submissions
• Cloudflare, Inc. (United States) — infrastructure serving the availability calendar, and jsDelivr, the content delivery network from which parts of the site's code are loaded
• Google Ireland Limited and Google LLC — our email service, through which enquiries reach us

Where you book through Airbnb, Booking.com or a similar platform, that platform processes your data as an independent controller under its own privacy policy. Our accountant handles invoicing and tax compliance, and payments are processed by our bank or payment provider.

Disclosure to public authorities takes place only where required by law, as described in section 3.3.

Some of the providers listed above are established in the United States or process data there — in particular Webflow, Cloudflare, and Google. These transfers are made on the basis of the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR and, where the provider is certified, the EU–US Data Privacy Framework adequacy decision. You may request a copy of the safeguards in place by writing to us.

Personal data is kept only as long as necessary for the purpose it was collected for, or as long as the law requires:

• Technical server logs — a limited period for security purposes, then deleted or anonymised
• Enquiries that do not lead to a booking — up to 12 months after our last exchange
• Booking correspondence — for the duration of the stay and up to 12 months afterwards
• Invoices and accounting records — 10 years, as required by Italian tax law. Guest registration data transmitted to the police is retained by the authorities under their own rules.

Under the GDPR you have the right to:

• obtain access to your personal data (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data erased (Art. 17)
• restrict processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3))
• lodge a complaint with a supervisory authority (Art. 77)

Write to laserenamalcesine@gmail.com or to the postal address in section 1. We will reply within one month of receiving your request, and may ask you for information to confirm your identity first. Please note that data we are required by law to transmit or retain — in particular guest registration data and accounting records — cannot be erased on request until the relevant legal period has expired. If you believe your data has been handled unlawfully, you may lodge a complaint with the Italian supervisory authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it. You may also complain to the supervisory authority of the EU country where you live or work.

Providing your data is voluntary. However, without your contact details we cannot answer your enquiry, and without the identity details of every guest we are not permitted by law to accommodate you. This website is not directed at children, and we do not knowingly collect data from anyone under 16 other than the guest registration data of minors travelling with their parents or guardians.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.