Notice on the processing of personal data

Data controller

The data controller is ETA SRL, VAT number 02665220139, which runs the tourist lettings gathered under the trade name “Palazzo Santa Croce”, with property units at Santa Croce 1478 (Campo San Giacomo dall’Orio), 30135 Venice.

For any request concerning your personal data you may write to the certified e-mail address (PEC) srleta@pec.it, or call or write on WhatsApp to +39 327 849 7091.

No data protection officer (DPO) has been appointed, as the conditions set out in Article 37 of the GDPR do not apply: requests are handled directly by the controller at the contact details given above.

• Registered office: Via Firenze 11, 22070 Casnate con Bernate (CO)
• Como-Lecco Companies Register, no. 02665220139 — REA CO - 272567
• PEC: srleta@pec.it
• Data controller: ETA SRL.
• VAT number: 02665220139.
• Properties: Santa Croce 1478, Campo San Giacomo dall’Orio, 30135 Venice (VE).
• PEC: srleta@pec.it. Telephone and WhatsApp: +39 327 849 7091.
• Telephone and WhatsApp: +39 327 849 7091.

What data we collect

We collect only the data needed to let you book, to host your stay and to discharge the obligations that the law places on anyone letting a property for tourist purposes. We do not buy contact lists and we do not collect data from sources other than you and the booking channels you have chosen.

Booking data. First name and surname, e-mail address, telephone number, country of residence, dates of the stay, the number and composition of the party, any special requests and the content of the messages we exchange.

Payment data. Payment is handled by Stripe: card details are entered directly into Stripe’s secure forms and neither pass through nor are stored on our systems. We receive only the outcome of the transaction, the last four digits of the card, the card scheme and the technical identifiers needed to reconcile the payment.

Identity documents. For every person accommodated we are required to record the details of their identity document and to transmit them to the Questura (the Italian State Police headquarters) through the Alloggiati Web portal, pursuant to Article 109 of the Italian Consolidated Law on Public Security (TULPS). The same data feed the regional and ISTAT statistical surveys on tourist movement and the calculation of the tourist tax due to the City of Venice.

Browsing data. The servers hosting the website record the IP address, the browser and device type, the pages visited and the date and time of the request. In the same way, the tool that measures visits processes the IP address and the technical data of the request in order to tell visits apart in statistical form, without storing anything on your device and without generating a stable identifier that follows you over time. These data are collected for technical, statistical and security reasons: they are not used to profile visitors, nor are they cross-referenced with booking data.

Purposes of the processing and legal bases

Every processing operation has a specific purpose and a legal basis that legitimises it. Where the basis is consent, you may withdraw it at any time without affecting the lawfulness of the processing carried out before the withdrawal.

Providing the booking data and the identity document data is mandatory: without them the contract cannot be concluded and we cannot lawfully accommodate you. Providing the data collected on the basis of consent, by contrast, is always optional.

• Managing the booking, the stay, payments and assistance before, during and after the stay — performance of the contract and pre-contractual measures, Article 6.1.b GDPR.
• Notification to the Questura through Alloggiati Web, regional and ISTAT statistical surveys, collection and payment over of the tourist tax, invoicing and retention of accounting records — legal obligation, Article 6.1.c GDPR.
• Prevention of payment fraud, security of the website and of our IT systems, ascertaining and documenting any damage to the properties, establishing or defending a legal claim — legitimate interest of the controller, Article 6.1.f GDPR.
• Statistical measurement of visits to the website. We collect in aggregate form the number of page views, the referring page, the country and the device type, in order to understand which content is useful to those looking for accommodation in Venice. The tool used installs no cookies and stores no identifiers on the device. Legal basis: our legitimate interest in knowing how the website is performing and in improving it (Article 6(1)(f) of the GDPR). You have the right to object to this processing at any time, pursuant to Article 21 of the GDPR, by writing to the contact details given in the section on the data controller.
• Sending newsletters, offers and promotional communications, should these be activated in the future — consent, Article 6.1.a GDPR, which may be withdrawn at any time.

Who we disclose the data to

The data are processed by the controller and by the authorised persons acting under its authority. They are also disclosed to the suppliers that allow us to run the website and manage bookings: each of them is appointed as a data processor pursuant to Article 28 of the GDPR and processes the data only in accordance with our instructions.

We do not sell or transfer personal data to third parties for those third parties’ own commercial purposes.

• Stripe Payments Europe Ltd — collection of online payments, handling of refunds and fraud prevention.
• Supabase — hosting of the database in which bookings, guest records and the credentials for the restricted area are stored.
• Vercel — hosting of the web application, delivery of the pages, technical service logs and aggregate statistical measurement of visits.
• Resend — sending of the transactional e-mails connected with the booking: confirmation, arrival instructions, reminders and service messages.
• Krossbooking — the property management system and channel manager used to synchronise calendars, rates and bookings across the various sales channels.
• Airbnb Ireland UC — limited to bookings arriving through that channel, in accordance with the platform’s own privacy notice.
• WhatsApp Ireland Ltd — if you choose to write to us on WhatsApp, including through the buttons on the website that pre-fill the residence, dates and number of guests, the message passes through the WhatsApp service, in accordance with the platform’s own privacy notice.
• Professionals and suppliers who assist us: our accountant, consultants, cleaning and maintenance firms, strictly within the limits of what is necessary.
• Public security authorities, the tax authorities, the City of Venice, the Veneto Region and ISTAT, in the cases provided for by law.

Transfers outside the European Economic Area

Some of the suppliers listed above are based in the United States or rely on infrastructure located outside the European Economic Area. Wherever possible we choose the European region of the services we use, so that the data remain stored within the Union.

Where a transfer outside the EU is unavoidable, it takes place only where the safeguards provided for in Chapter V of the GDPR are in place: an adequacy decision of the European Commission pursuant to Article 45, or the standard contractual clauses adopted by the Commission pursuant to Article 46, supplemented by the additional technical and organisational measures agreed with the supplier.

You may at any time request a copy of the safeguards adopted for a given transfer by writing to the PEC address srleta@pec.it.

How long we keep the data

We keep the data for as long as is necessary to achieve the purpose for which they were collected and, thereafter, for as long as legal obligations require. Once those periods expire, the data are deleted or irreversibly anonymised.

• Tax documents and accounting records: 10 years from the date of entry, as provided for by Article 2220 of the Italian Civil Code and by tax legislation.
• Contractual and booking data: for the entire duration of the relationship and for the 10 years thereafter, to protect the rights arising from the contract.
• Identity document details: transmitted to the Questura within the time limits set by law and kept only for as long as is necessary to demonstrate that the notification was made; we do not keep copies or scans of the documents beyond that point.
• Correspondence by e-mail or messaging that did not lead to a booking: 24 months from the last contact.
• Technical logs of the website and of the servers: no longer than 12 months, unless they have to be retained in order to establish an unlawful act.
• Data processed on the basis of consent: until that consent is withdrawn.

Your rights

Articles 15 to 22 of the GDPR grant you a series of rights which you may exercise free of charge and at any time in relation to the controller.

To exercise them, a written request to the PEC address srleta@pec.it is enough, enclosing a document that makes it possible to identify you: verifying identity serves to prevent your data from being disclosed to someone else. We reply within one month of receiving the request, which may be extended by two months in the case of particularly complex requests, as provided for by Article 12 of the GDPR.

• Access to the data concerning you and to the information about how they are processed (Article 15).
• Rectification of inaccurate data and completion of incomplete data (Article 16).
• Erasure of the data, in the cases provided for and subject to the retention obligations imposed by law (Article 17).
• Restriction of processing where you contest its accuracy or its lawfulness (Article 18).
• Portability of the data you have provided to us, in a structured, machine-readable format (Article 20).
• Objection to processing based on legitimate interest, on grounds relating to your particular situation (Article 21).
• The right not to be subject to a decision based solely on automated processing which produces legal effects (Article 22): we do not take decisions of this kind.
• Withdrawal of consent at any time, with effect for the future (Article 7(3)).

Complaint to the supervisory authority

If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), the supervisory authority competent for Italy, whose offices are at Piazza Venezia 11, 00187 Rome.

The complaint may also be submitted electronically, in the manner set out on the website www.gpdp.it. As an alternative, the possibility of bringing the matter before the courts remains open.

Before approaching the Authority you may contact us directly: in most cases a clarification settles the question far more quickly.

Updates to this notice

This notice may be updated to bring it into line with changes in the law, with new services offered on the website or with changes in the suppliers used. The date of the last revision is shown at the top of the page.

Significant updates affecting ongoing processing are notified to guests with active bookings at the e-mail address given when booking.