Privacy Policy
Version 2026-10-04 · under EU Regulation 2016/679 (GDPR)
This is an English translation provided for convenience. In case of any discrepancy, the Italian version prevails.
1. Data controller
Casa al Duomo — the controller's contact details are shown in the website footer. For any request about the processing of personal data, please write to the controller's email address shown on the website.
2. Data collected
- Identification data: first name, last name, email, phone (optional).
- Booking data: dates of stay, number of guests, room setup, any notes.
- Payment data: card details are NEVER seen or stored by us. They are collected and processed directly by Stripe Payments Europe Ltd., based in Ireland (controlled by Stripe Inc., USA), as an external data processor.
3. Purposes and legal basis
- Managing the booking and performing the contract — art. 6.1.b GDPR.
- Tax and accounting obligations — art. 6.1.c GDPR.
- Service communications about the stay — art. 6.1.b GDPR.
4. External processors and transfers outside the EU
To provide the service the controller uses the following providers, which process data as external processors (art. 28 GDPR):
- Stripe Payments Europe Ltd. (Ireland) — payment processing;
- Vercel Inc. (USA) — website hosting, application infrastructure and aggregate usage statistics (see section 7);
- Supabase (PostgreSQL database, EU data centre) — storage of booking data;
- Resend (USA) — sending transactional confirmation emails;
- Upstash (EU data centre) — anti-abuse protection for the website (rate limiting on IP addresses).
Some providers may transfer data to the United States. Transfers are based on the Standard Contractual Clauses approved by the European Commission and, where the provider has joined it, on the EU-US Data Privacy Framework (DPF).
5. Retention period
Booking data, including the contact details provided (email and phone number), are kept together with the booking record for the time required by tax and civil-law obligations (10 years) and then deleted. Contact details are used only for communications about the stay. Before that deadline you can ask at any time for the deletion of any data not required for those obligations by writing to the controller's email address (see section 6).
6. Your rights
You can exercise at any time your rights of access, rectification, erasure, restriction, objection and data portability by writing to the controller's email address. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).
7. Cookies and usage statistics
The website uses only technical cookies needed for it to work. No profiling, advertising or third-party cookies are used, and users are not profiled.
To understand how the website is performing, the controller uses Vercel Web Analytics and Vercel Speed Insights(Vercel Inc., external processor), which measure in aggregate form the pages visited, where visits come from, country, device type and page loading times.
This measurement does not use cookies and does not store information on the user's device: for this reason no consent banner is required. IP address and browser type are used transiently to derive a daily technical identifier that cannot be traced back to the person and is not stored. No data that could identify an individual visitor is collected, and browsing data is never combined with booking data.
The legal basis is the controller's legitimate interest (art. 6.1.f GDPR) in checking how the website works and performs. Aggregate data is kept for up to 12 months. No statistics or advertising tools from other providers are active (in particular: no Google Analytics, no social network pixels).