Privacy Policy

under Article 13 of Regulation (EU) 2016/679 ("GDPR")

Last updated: 7 October 2026

This is a translation of the Italian privacy notice, provided for convenience. In case of any discrepancy, the Italian version prevails.

1. Data controllers

The data controller for this website (Cinque Terre Apartments) and for all requests sent through the form or by email is Jacopo Crovara, sole proprietorship based at Via Tracastello 190c, 19017 Riomaggiore (SP), Italy, VAT no. 01586700112, REA SP-244545, who runs the website and is the lessor of the Nadir and Rio View apartments.

For bookings of apartments let by a private individual as a short-term rental (Casa Maja: Barbara Bonfiglio), the data needed (your request and contact details) is passed on to that lessor, who processes it as an independent controller for the contract, payment, stay and legal obligations (reporting to the police, tourist tax, tax obligations).

For any privacy matter, including towards the private lessor, you can write to jacrov05@gmail.com. No Data Protection Officer (DPO) has been appointed, as it is not required.

2. What data we process

a) Data you provide through the booking request form:

• first and last name;
• email address;
• phone number, with the international dialling code;
• check-in and check-out dates, chosen apartment, number of adults and children;
• preferred payment option (deposit or full amount, card or bank transfer);
• the text of your message (optional). Please do not include unnecessary data in the message, especially health data or other special categories of data.

b) Data you send us by writing directly by email, and data exchanged in the following correspondence (for example the booking confirmation and payment details, for a bank transfer or a card payment link).

c) Technical browsing data.Like any website, the servers hosting it automatically record some technical data (IP address, date and time of the request, requested page, browser type, any errors). This data is used only to run the website, keep it secure and prevent abuse, and is not used to identify or profile you. To limit repeated submissions, the IP address and the email address entered in the form are kept temporarily in the server's memory (for 24 hours at most) and are not stored in any database.

The website does not use analytics, advertising or profiling tools.

3. Why we process your data and on what legal basis

We do not use your data for marketing or newsletters and we do not pass it on to third parties for their own purposes.

4. Whether providing data is required

Name, email, phone, dates and number of guests are needed to reply to your request: without them we cannot get back to you. The message is optional. Sending a request is not a booking and does not involve any payment.

5. Mandatory reporting at the time of your stay

Regardless of this website, Italian law requires the lessor (host) of the apartment, on arrival, to:

• identify guests with an identity document and report their details to the police (Questura) through the Alloggiati Web portal (Art. 109 of the Consolidated Law on Public Security);
• report aggregated, anonymous data on arrivals and overnight stays for statistical purposes (ISTAT / Liguria Region tourism statistics system);
• apply, where due, the tourist tax of the Municipality of Riomaggiore.

This data is collected in person at check-in, not through the website.

6. Who we share your data with

Your data is handled directly by the controllers listed in section 1, each for their own part. To run the website, email and card payments we rely on the following providers, which process data on our behalf as processors (Art. 28 GDPR) or under their own terms of service:

• Cloudflare, Inc. (USA): website hosting and technical logs;
• Resend (Plus Five Five, Inc., USA): sending the controller the email with your request and, when enabled, the confirmation email you receive;
• Supabase, Inc.(USA; database hosted in the European Union, in Frankfurt): storage of the website's prices and availability and access to the controller's private area. Requests sent through the form are not stored in the database;
• Google(Google LLC / Google Ireland Ltd.): provider of the controller's Gmail mailbox, where we receive requests and exchange emails;
• Stripe Payments Europe, Ltd.(Ireland; Stripe, Inc. group, USA): card payments through the payment links we send you, issued from the Stripe account of the lessor of the booked apartment. You enter your card details directly on Stripe's pages: neither we nor the lessor ever receive them. For fraud prevention and legal obligations Stripe acts as an independent controller, under its own privacy policy.

Data may also be disclosed: to the private lessor, for bookings of Casa Maja (see section 1); to banks and payment institutions to handle payments; to the lessor's accountant for tax obligations; to public authorities where required by law (for example the police). Your data is not made public.

7. Transfers outside the European Union

Some providers are based in the United States or may access data from the United States. Transfers are based on:

• the European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework (Art. 45 GDPR), for certified providers (Cloudflare, Resend, Google, Stripe);
• the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR), included in the providers' data processing agreements (in particular for Supabase).

You can ask for information about these safeguards by writing to the controller. The list of certified companies is available at dataprivacyframework.gov.

8. How long we keep your data

• Requests that do not become a booking: deleted within 12 months of the last contact.
• Bookings and related correspondence: for the duration of the relationship and then for as long as needed for tax and accounting obligations, normally 10 years (Art. 2220 of the Italian Civil Code), or any other period required by law.
• Website technical logs: for the period set by the hosting provider, normally a few days and in any case no longer than 30 days, unless needed to investigate abuse.
• Copies of emails sent through Resend: for the period set by the service and in any case no longer than 30 days.
• Data collected at check-in for the police is handled according to the periods set by public security law.

9. Your rights

You can ask the controller at any time, by writing to jacrov05@gmail.com, for:

• access to your data (Art. 15 GDPR);
• rectification (Art. 16) or erasure (Art. 17);
• restriction of processing (Art. 18);
• portability of the data you provided (Art. 20);
• and you can object to processing based on legitimate interest (Art. 21).

We will reply without undue delay and in any case within one month. Some requests may be limited by legal obligations (for example keeping tax records).

10. Complaints

If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.

11. Cookies

This website does not use profiling, analytics or third-party cookies and does not set cookies on visitors' devices. The only exception is the controller's private area, where a technical session cookie, strictly necessary for authentication, is set on login; it does not concern guests. Technical cookies do not require consent (Art. 122 of the Italian Privacy Code), which is why the website shows no cookie banner.

External links (for example to the Airbnb listings) lead to third-party websites with their own privacy policies and cookies.

12. Automated decision-making

No automated decision-making or profiling takes place (Art. 22 GDPR). The price shown in the form is an automatic calculation based on the dates and number of guests you choose and is not a decision about you.

13. Changes

This notice may be updated; the date of the last update is shown at the top.