Privacy Policy - Michelangelo's Home

Data Controller Michelangelo’s Home di Luca Serrapica, Via Crapolla I n°53, 80045 Pompeii (NA), Italy — Tax Code: SRRLCU97B19C129S — Email: info@michelangeloshomepompei.com — Phone/WhatsApp: +39 349 245 4776

Types of Data Collected The Data Controller collects the following personal data:

Data voluntarily provided by the user

First and last name
Email address
Phone number
Messages and communications sent via the contact form or WhatsApp
Booking-related data (dates of stay, number of guests, chosen accommodation)

Browsing data — The website automatically collects, in its logs, certain data whose transmission is implicit in the use of Internet communication protocols, such as IP address and browser type. This data is not used for user identification.

Purposes and Legal Basis for Processing Personal data is processed for the following purposes:

a) Managing contact and booking requests — Legal basis: performance of a contract or pre-contractual measures (Art. 6, para. 1, lit. b GDPR).

b) Compliance with legal obligations — Including the communication of guest data to public security authorities pursuant to the Consolidated Law on Public Security (T.U.L.P.S.) and applicable regulations governing accommodation facilities. Legal basis: legal obligation (Art. 6, para. 1, lit. c GDPR).

c) Sending promotional communications and offers — Only with the explicit consent of the data subject. Legal basis: consent (Art. 6, para. 1, lit. a GDPR).

Processing Methods and Retention Data is processed using electronic and paper-based tools, adopting adequate security measures to prevent unauthorised access, loss or disclosure.

Data will be retained for the time strictly necessary for the purposes for which it was collected, and in any case:

Booking and stay data: up to 10 years, as required by law for tax and administrative purposes.
Contact data (without booking): up to 12 months from receipt of the request.
Data for promotional purposes: until consent is withdrawn.

Disclosure of Data to Third Parties Personal data is not sold or transferred to third parties for commercial purposes. It may be disclosed to:

Public security authorities, for compliance with legal requirements (guest registration form).
Technical service providers (hosting, online booking platforms) acting as data processors pursuant to Art. 28 GDPR.
The Controller’s professionals and consultants, to the extent necessary for the performance of their functions.

Transfer of Data Outside the EU Personal data is not transferred to third countries outside the European Economic Area, except where third-party services are used (e.g. international OTA platforms) that guarantee adequate levels of protection pursuant to the GDPR.

Rights of the Data Subject As a data subject, you have the right to:

Access – obtain confirmation as to whether or not personal data concerning you is being processed and, if so, to obtain a copy thereof (Art. 15 GDPR).
Rectification – request the correction of inaccurate or incomplete data (Art. 16 GDPR).
Erasure – request the deletion of data in the cases provided for by law (Art. 17 GDPR).
Restriction of processing – request that processing be restricted in certain circumstances (Art. 18 GDPR).
Portability – receive data in a structured, machine-readable format (Art. 20 GDPR).
Objection – object to processing on legitimate grounds (Art. 21 GDPR).
Withdrawal of consent – withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
Complaint – lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To exercise your rights, please contact the Data Controller at the email address indicated at the beginning of this document.