Privacy and cookie notice

How we process the personal data of people who visit this website, ask us for availability or stay with us, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003). The Italian version of this notice is the reference text.

Data controller

Emanuela Silvestrini, who runs the holiday rental Corte Vaticana 1913, Viale Vaticano 70, 00165 Rome, Italy (CIN IT058091C2J89FG96B). Email info@cortevaticana1913.it. No data protection officer (DPO) has been appointed, as it is not required.

When you visit the website

The service hosting the website (Netlify) automatically records some technical data for each visit: IP address, date and time, page requested, browser and operating system. This is used only to run the website and protect it from abuse; we do not use it to identify you or for statistics. Legal basis: legitimate interest in the security of the website (Art. 6(1)(f) GDPR).

Fonts, images and scripts are served from our own website: while you browse, the website does not load content from Google or other external services. Links to Booking.com, Airbnb and Wikimedia Commons are plain links: those sites receive no data until you open them, and they have their own privacy notices.

When you ask for availability through the form or by email

We collect only the data you enter: arrival and departure dates, number of guests, name, email and an optional message, plus the language of the page you write from. Dates, name and email are needed to reply with availability and price: without them we cannot handle your request. The message is optional. Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). We do not use this data for newsletters or advertising, and we make no automated decisions.

The form is received by Netlify, which forwards it to us by email. To block spam, Netlify checks messages with an automatic filter (Akismet, by Automattic Inc., United States) and with a hidden field that only automated programs fill in; we do not use reCAPTCHA.

When you book and pay

To manage the calendar, bookings and communication with guests we use Beds24, a property management system. It stores the booking data: name, contact details, dates, number of guests, amounts and any requests. If you book through Booking.com or Airbnb, the booking data reaches Beds24 from those platforms, which also process it as independent controllers under their own privacy notices.

Card payments (deposit and balance) are handled by Stripe: you enter your card details directly on Stripe's pages, and we neither see nor store them. We only receive the payment outcome, the amount and the last digits of the card. Stripe also processes some data as an independent controller, for anti-money-laundering obligations and fraud prevention.

For your stay we also process the data required by law: the identity document details of guests, which must be reported to the police (Questura, Art. 109 of the Italian Consolidated Law on Public Security), and the data for the City of Rome tourist tax. Legal basis: contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c) GDPR).

Minors

The website and the form are not intended for children under 14. Requests and bookings must be made by an adult, including for children travelling with them; we process the data of minor guests only for the legal obligations described above.

How long we keep data

• Technical browsing data: for the period set by Netlify for security purposes, usually a few days or weeks.
• Requests from the form or by email: up to 24 months from the last contact, if no stay follows.
• Bookings, payments and accounting records: for the duration of the relationship and then for the periods required by tax and civil law (up to 10 years).
• Identity document details: only for the time needed to report them to the police, as required by law.

Who receives the data

We do not sell or transfer data. It is processed on our behalf, as processors, only by the providers we need:

• Netlify, Inc. (United States): website hosting, technical logs and form handling, with the Akismet spam filter (Automattic Inc., United States);
• Aruba S.p.A. (Italy): domain and the info@cortevaticana1913.it mailbox;
• Beds24 GmbH (Germany): booking and calendar management system;
• Stripe Payments Europe Ltd. (Ireland), together with the Stripe group: card payments;
• our accountant, for tax obligations;
• public authorities, when required by law (police, City of Rome).

Netlify, Automattic and the Stripe group may process data in the United States, with the safeguards of Articles 44 and following of the GDPR: the EU–US adequacy decision (Data Privacy Framework) or the European Commission's standard contractual clauses.

Your rights

You can ask at any time to access your data, correct it, erase it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest. To ask for erasure, simply email info@cortevaticana1913.it with the subject “Data erasure”: we reply within one month. Only the data we are required by law to keep will remain. You can also lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of your country.

Cookies

This website uses at most technical cookies, strictly necessary for the pages to work, and today it sets none. It does not use statistics or profiling cookies, it contains no Google Analytics or other analytics tools, advertising pixels, maps or third-party videos, and it does not store data in your browser's storage (such as localStorage). That is why we do not ask for any consent and you do not see a cookie banner.

The Booking.com, Airbnb, Beds24 and Stripe pages you open from our links are external websites, with their own cookies and privacy notices. If we ever add statistics or advertising tools, we will switch them on only after your consent and update this page.

Last updated: 18 October 2026.