Privacy Policy
Information on the processing of personal data pursuant to Art. 13 GDPR
Last updated: March 2026
1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) and the Italian Personal Data Protection Code (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018) is:
Genovapartments
Owner: Tilo Oschatz
Salita di San Paolo 4/7
16126 Genova (GE), Italy
P.IVA (VAT): 02625230996
CITR: 010025-CAV-0048
E-Mail: genovapartments@gmail.com
Phone / WhatsApp: +39 340 069 7006
2. Personal Data Processed
2.1 Contact form
When you use our contact form, we process the following data:
- First and last name
- E-mail address
- Phone number / WhatsApp (optional)
- Check-in and check-out dates (optional)
- Number of guests
- Apartment preference (optional)
- Message content
2.2 Direct communication (e-mail / WhatsApp)
When you contact us directly by e-mail or WhatsApp, we process the data you provide (sender address, message content, and any metadata attached by the messaging service).
2.3 Booking and guest data
In connection with a booking, we process personal data of all guests (name, date of birth, nationality, ID/passport number) to fulfil the statutory reporting obligation to the Italian authorities (Alloggiati Web – see Section 5).
2.4 Server log files
Our web host (Hostinger) automatically collects technical information on every page visit (IP address, browser type, operating system, date/time, URL requested). These data are technically necessary for website operation and are not combined with other data.
3. Legal Basis for Processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Processing enquiries via the contact form | Art. 6(1)(b) (pre-contractual measures) and Art. 6(1)(a) (consent) |
| Fulfilment of the rental agreement (booking, billing) | Art. 6(1)(b) (contract performance) |
| Statutory reporting obligation (Alloggiati) | Art. 6(1)(c) (legal obligation) |
| Server log files | Art. 6(1)(f) (legitimate interest: IT security, fault diagnosis) |
4. Disclosure of Personal Data to Third Parties
Your personal data will not be shared with third parties, except:
- where you have given explicit consent,
- where a legal obligation requires disclosure (e.g. Alloggiati report to the Questura), or
- where disclosure is necessary for contract performance (e.g. payment service providers, where applicable).
Our web host (Hostinger International Ltd., data centres in the EU) processes technical data as a processor under a data processing agreement (DPA).
5. Statutory Guest Registration (Alloggiati – Italian Law)
Under Italian law (Art. 109 T.U.L.P.S. and related implementing regulations), operators of holiday apartments are required to report the personal details of all guests to the police (Questura Genova) via the Alloggiati Web portal within 24 hours of their arrival. For this purpose, we collect the first name, last name, date of birth, place of birth, nationality, and type and number of the identity document of all adult guests. These data are used solely to fulfil the statutory reporting obligation and are not processed for any other purpose.
6. Data Retention Periods
| Data category | Retention period |
|---|---|
| Contact form enquiries (no booking) | 2 years after end of correspondence |
| Booking and guest data | 10 years (Italian statutory accounting period) |
| Alloggiati registration data | As required by the authorities (currently 5 years) |
| Server log files | Maximum 30 days (Hostinger default) |
| E-mail correspondence | 2 years after last contact |
7. Cookies
Our website uses technically necessary cookies only. We do not use tracking cookies, analytics cookies, or advertising cookies. No Google Analytics, Meta Pixel, or comparable services are in use. Technically necessary cookies are required for correct navigation and are deleted when the browser is closed (session cookies) or have a short lifetime.
8. Your Rights as a Data Subject
You have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR): You may request information about the data we process about you.
- Right to rectification (Art. 16 GDPR): You may request correction of inaccurate data.
- Right to erasure (Art. 17 GDPR): You may request deletion of your data, provided no statutory retention obligations apply.
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR): Where processing is based on consent or contract.
- Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests.
- Right to withdraw consent (Art. 7(3) GDPR): Consent given may be withdrawn at any time with effect for the future.
To exercise your rights, please contact: genovapartments@gmail.com
9. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority. As the controller is based in Italy, the primary authority is the Garante per la Protezione dei Dati Personali:
Garante per la Protezione dei Dati Personali
Piazza Venezia 11, 00187 Roma, Italy
www.garanteprivacy.it
If you are located in the UK, you may also contact the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, UK
ico.org.uk
10. Data Security
This website is served exclusively over an encrypted HTTPS connection (TLS). Incoming form data are processed server-side and are not permanently stored in databases. E-mails are sent via the web host's mail server.
11. Updates to this Policy
This Privacy Policy is current as of March 2026. We reserve the right to update it where necessary to reflect legal requirements or changes to our services. The current version is always available on this page.