Information notice on the processing of personal data

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018

Last updated: March 2026

1. Data Controller

AffittaSardegna S.r.l.s.

VAT no.: 03058850904

Registered office: Porto Torres (SS), Sardinia, Italy

Email: info@affittasardegna.it

Phone & WhatsApp: +39 079 412 5245

Website: https://affittasardegna.it

Data Protection Officer (DPO): not appointed. AffittaSardegna S.r.l.s. does not fall within the categories of controllers required to appoint a DPO under Article 37 GDPR.

2. Categories of Data Subjects

This notice is addressed to the following categories of persons:

  • Guests and travellers who book or request information about accommodation
  • Property owners who entrust management to AffittaSardegna S.r.l.s.
  • Visitors to the website affittasardegna.it
  • Newsletter subscribers

3. Types of Data Collected

3.1 Guest Data

  • First name, surname, date and place of birth
  • Nationality
  • Type and number of identity document (identity card or passport)
  • Email address and telephone number
  • Dates of stay and number of persons
  • Payment data (processed securely through certified circuits)

3.2 Property Owner Data

  • First name, surname, tax code and/or VAT number
  • Bank details for the payment of rents
  • Land registry and lease data of the property
  • Tax documentation (for the purposes of the Certificazione Unica and DAC7 obligations)
  • Email and telephone contacts

3.3 Website Visitor Data

  • IP address
  • Browser and device type
  • Pages visited and duration of browsing
  • Traffic source
  • Aggregated behaviour data (through Google Analytics 4 and Microsoft Clarity)

4. Purposes and Legal Bases of Processing

4.1 Management of bookings and stays

Legal basis: performance of the contract (Art. 6.1.b GDPR).

Retention: 10 years from the end of the contractual relationship, for tax obligations.

4.2 Public Security Obligations (Alloggiati Web)

Under Article 109 of the T.U.L.P.S. (Royal Decree 773/1931), we are required to communicate guest data (first name, surname, date of birth, nationality, type and number of document) to the competent Questura (provincial police headquarters) within 24 hours of arrival through the Alloggiati Web portal.

Legal basis: legal obligation (Art. 6.1.c GDPR).

Retention: according to the terms laid down by public security legislation.

4.3 Tax Obligations and DAC7

Owners' data are processed for the issue of the annual Certificazione Unica and for the obligations under the DAC7 Directive (Legislative Decree 32/2023), which requires short-term rental platforms to communicate to the Agenzia delle Entrate (Italian Revenue Agency) the data of lessors and the related fees.

Legal basis: legal obligation (Art. 6.1.c GDPR).

Retention: 10 years under Italian tax legislation.

4.4 Management of the contract with Owners

Owners' data are processed for the performance of the management mandate, including periodic reporting, payment of rents and the operational management of the properties.

Legal basis: performance of the contract (Art. 6.1.b GDPR).

4.5 Newsletter and commercial communications

Legal basis: consent (Art. 6.1.a GDPR). Consent may be withdrawn at any time through the unsubscribe link in every email.

Retention: until consent is withdrawn.

4.6 Analysis and improvement of the website

Legal basis: consent obtained through the cookie banner (Art. 6.1.a GDPR).

5. Sharing of Data

Personal data are not sold to third parties. They may be communicated exclusively to:

  • Questura/State Police: guest data for public security obligations (Alloggiati Web)
  • Agenzia delle Entrate: owners' data for DAC7 and tax obligations
  • Property owners: guest data strictly necessary for managing the stay
  • Technical providers (Data Processors): hosting, email marketing, analytics, booking engine
  • Judicial or administrative authorities: where required by law

6. Third-Party Tools

Google Analytics 4 (Google LLC, USA)

Web traffic analysis with IP anonymisation active. Transfer of data outside the EU with Standard Contractual Clauses.

Policy: https://policies.google.com/privacy

Microsoft Clarity (Microsoft Corporation, USA)

Anonymous behavioural analysis (heatmaps, session recordings). Transfer outside the EU with Standard Contractual Clauses.

Policy: https://privacy.microsoft.com/it-it/privacystatement

GetResponse S.A. (Poland)

Email marketing platform used to send newsletters. Subject to the GDPR as a European company.

Policy: https://www.getresponse.com/legal/privacy

Tawk.to Inc. (USA)

Live chat service. Messages sent through the chat are recorded for support purposes.

Policy: https://www.tawk.to/privacy-policy/

KrossBooking

Online booking engine. Data entered in the booking process (name, contacts, dates) are processed by KrossBooking as Data Processor.

7. Cookie Policy

The site uses the following types of cookies:

  • Technical cookies (necessary): session, TranslatePress language preferences, site operation. They do not require consent.
  • Analytics cookies: Google Analytics 4, Microsoft Clarity. Activated only with prior consent.
  • Marketing cookies: Meta Pixel (Facebook/Instagram). Activated only with prior consent.

Cookie preferences can be managed through the banner on first access or by changing the browser settings.

8. Transfer of Data Outside the EU

Some providers (Google LLC, Microsoft Corporation, Tawk.to) transfer data outside the European Economic Area. Such transfers take place in compliance with the safeguards provided by the GDPR through Standard Contractual Clauses (SCC) approved by the European Commission.

9. Rights of the Data Subject

Under Articles 15-22 GDPR, every data subject has the right to:

  • Access (Art. 15): obtain a copy of their personal data being processed
  • Rectification (Art. 16): correct inaccurate or incomplete data
  • Erasure (Art. 17): request the deletion of data (except where required by law)
  • Restriction (Art. 18): restrict processing in certain cases
  • Portability (Art. 20): receive their data in a structured, machine-readable format
  • Objection (Art. 21): object to processing based on legitimate interest
  • Withdrawal of consent (Art. 7): at any time, without prejudice to previous processing

To exercise their rights: info@affittasardegna.it — reply within 30 days.

Right to lodge a complaint: the data subject has the right to lodge a complaint with the Autorità Garante per la Protezione dei Dati Personali (Italian Data Protection Authority) (www.garanteprivacy.it — Piazza Venezia 11, Rome).

10. Minors

The site is not intended for minors under 16. We do not knowingly collect data from minors. The personal data of minor guests are processed exclusively for the fulfilment of public security obligations (Alloggiati Web), under the responsibility of the parent or legal guardian.

11. Updates

This Notice may be updated at any time. Changes are published on this page with an indication of the update date. In the event of substantial changes, registered data subjects will be notified by email.