Privacy

The data we collect

The data controller is IMMOBILIARE ANTOEL S.R.L., registered office Via Introzzi 2, 21057 Olgiate Olona (VA), Italy, VAT number and tax code 13280700967, email iltramontomanagement@gmail.com, certified email (PEC) immobiliare.antoelsrl@pec.it. We collect what you give us when you book: name, email, phone, the dates of your stay and any requests. Before you arrive, in the guest area, we ask for every person staying: surname, first name, sex, date and place of birth, citizenship and residence and, for whoever shows the document, its type, number and place of issue; when you arrive we check the original document in person. For check-in we also ask for a photo of the document (front and back), which we keep encrypted and delete as soon as the owners have checked the original document in person and, at the latest, when the report to the police has been made. For these data the legal basis is a legal obligation (art. 109 TULPS and regional tourism law); for the rest it is the performance of the accommodation contract. Data about the other guests reaches us from whoever books or from the guests themselves. If you book through a platform (Booking.com, Airbnb), the booking details reach us from that platform, which remains an independent controller for its own part. This English text is provided for your convenience: the contract is governed by Italian law and, in case of any discrepancy, the Italian version of this page prevails.

How we use it

We use your data to:

handle your request and your booking
reply to you and agree arrival and departure
meet our legal obligations (see below)
issue the receipt or the invoice
answer any question after your stay
meet tax and accounting obligations

Who else sees it

We do not sell your data and we do not profile you. We are required by law to send guest data to the Italian State Police through the Alloggiati Web portal within 24 hours of arrival (art. 6(1)(c) GDPR), to report statistical data to Regione Lombardia and ISTAT through the regional system ROSS1000, and, where it is due, to handle the tourist tax with the Comune di Olgiate Olona. Online payments are handled by Nexi Payments S.p.A. (Milan) on its own payment page, which receives the data needed for the payment; your card details never pass through our servers. Conversations with the site’s assistant are processed by OpenRouter, Inc. and the compute providers it selects (for example DeepInfra, Fireworks AI, Together AI, based in the United States) as data processors, outside the European Union on the basis of the standard contractual clauses; the providers are chosen among those that neither keep the messages nor use them to train models. Conversations with the assistant are kept on our server for 60 days, so the owners can read them and, if the assistant cannot answer or you ask for it, answer you in person in the same chat; whoever answers is a person, and you can see it. When the assistant cannot answer, or the request is special, it also leaves a note for the owners, kept for 12 months (the conversation excerpt that comes with it, for 60 days). Please do not type documents, card details or health data in the chat. Data may also be shared with our accountant and with the technical suppliers appointed as data processors: Hetzner Online GmbH (hosting of the site and of the data, Germany, European Union) and Resend, Inc. (sending of confirmation and reminder emails, United States, under standard contractual clauses).

Keeping it safe

We take appropriate measures to protect your data from unauthorised access: document numbers are stored encrypted, with a key that is not kept where the data is, and the guest area opens only with the booking code. The analytics or tracking tools listed below switch on only with your consent; fonts and images are still served from our own servers either way.

Your rights

You have the right to:

see the data we hold about you
have it corrected
have it deleted, within the limits of our legal obligations
object to the processing
lodge a complaint with the Italian Data Protection Authority

Cookies

This site uses technical cookies, which need no consent, and, only with your consent, Google Analytics (Google Ireland Ltd.), to measure visits in aggregate. You can change your choice at any time from «Cookie preferences» at the foot of the page. Technical cookies: the session cookie of the guest area, which keeps you signed in with your code for the length of your stay, the session cookie of the owners’ private area. Payment takes place on Nexi’s page, which applies its own cookie policy. It also remembers the language you chose, so that it does not ask you again. You can delete or block all of them in your browser settings.

How long we keep it

The photos of the document and the document number are deleted at once: the photos as soon as the owners have checked the original document in person and in any case when the report to the police has been made, the number as soon as the report is made (the photos are stored encrypted and only the owners can see them). If a stay is not reported (cancelled, no-show), photos and number are deleted within three days of the departure date. The other personal details of guests are deleted or anonymised 90 days after departure. Booking, contact and payment records stay for the periods tax and accounting law requires (up to ten years), and the receipt of the report to the police for five years. Conversations with the assistant are deleted after 60 days.