Go to content
ITENDEFRES
Book Now

Privacy Policy

This policy explains how we process the personal data of those who visit the kasavacanze.it website, contact us, or book directly with us, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Last updated: October 26, 2026.

1. Data controller

Roberto Lembo , owner of the sole proprietorship Kasa Vacanze (KASAVACANZE DI ROBERTO LEMBO), with registered office in Via Alcesti 3, 90151 Palermo (Italy), VAT number 07390350820. For any requests regarding privacy you can write to us at info@kasavacanze.it .

2. What data we process, why and on what basis

Site navigation

  • Data: technical browsing data (IP address, browser, pages visited, date and time).
  • Purpose: To operate the site and protect it from abuse.
  • Legal basis: legitimate interest of the data controller (Article 6.1.f GDPR).
  • Retention: For the short period required by the hosting provider.

Contact requests (form, email, phone, WhatsApp)

  • Data: name, email, telephone number (if applicable), and the content of the message (for example, dates and number of guests).
  • Purpose: to respond to you and prepare a quote for you.
  • Legal basis: pre-contractual measures taken at your request (Article 6.1.b GDPR).
  • Retention: Up to 12 months from last contact; longer only if followed by a booking.

Direct booking on the site

  • Data: first and last name, email, telephone number, residential address (country, street and number, city, province, postcode), dates of stay, number of guests and ages of children, special requests (e.g., crib or pets), language, payment status, and booking code.
  • Purpose: to conclude and execute the accommodation contract: confirmation, payments, balance, refunds, assistance and service communications.
  • Legal basis: performance of the contract or pre-contractual measures (Article 6.1.b GDPR).
  • Retention: for the duration of the relationship and thereafter for the legal terms indicated below.

Children's ages are used only to calculate the tourist tax. We do not collect any other data from minors, except those required by law upon arrival.

Legal obligations

  • Data: billing and payment information; guest information required by law at check-in.
  • Purposes: invoicing and accounting, tourist tax, reporting of guests to public security authorities, and tourism statistics.
  • Legal basis: legal obligation (Article 6.1.c GDPR).
  • Retention: accounting and tax documents for 10 years; other data for the terms required by law.

Site statistics

  • Data: Browsing data collected through Google Analytics.
  • Purpose: To understand how the site is used and improve it.
  • Legal basis: Your consent (Article 6.1.a GDPR), given by the cookie banner and revocable at any time.
  • Storage: for the time specified by the instrument settings.

3. Payments

Card payments are made on the secure Stripe Payments Europe Ltd. page: your card number never passes through our site, and we do not store it. Stripe processes payment data as an independent controller for its own purposes (security, fraud prevention, and legal obligations) in accordance with its privacy policy. For refundable rates, Stripe retains your card to charge the balance at the end of the free cancellation period, only if you authorize it at the time of booking; we only retain the technical details necessary for this. If you pay by bank transfer, we process the data appearing on the transfer.

4. To whom we communicate the data

The data is not disclosed or sold. It may be processed by:

  • Suppliers acting on our behalf (data controllers): Aruba SpA (website hosting and email); Smartness (Smartpms, the property management and channel manager, including the CiaoBooking booking engine); the email sending service; Google (automatic text translation and, only with your consent, Google Analytics);
  • entities that process data independently : Stripe and the bank for payments; the accountant and tax consultants;
  • public authorities , when the law provides for it (for example the State Police for the communication of guests, the Municipality for the tourist tax, the Revenue Agency).

5. Machine translation

We use Google Cloud Translation to display the website and send messages in your language. In booking messages, your name, email, phone number, address, and booking code are replaced with placeholders before being sent to the translation service and are not shared with Google.

6. Transfers outside the European Union

Some providers (for example, Stripe and Google) may also process data outside the European Economic Area, particularly in the United States, based on the European Commission's adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

7. Cookies and third-party sites

The site uses technical cookies, which are necessary for its operation. Statistical cookies and third-party cookies (e.g., Google Analytics) are installed only with your consent via the banner; you can change your settings at any time by clicking "Cookie Preferences" at the bottom of each page. The site contains links to third-party sites (such as Instagram and Facebook) and, on the home page, the Smartpms/CiaoBooking booking engine: each has its own privacy policy.

8. Nature of the transfer

To book, you must provide the requested information in the form; without it, we cannot complete or process the booking. Contact requests require at least your name, email address, and message.

9. Automated decisions

We do not make decisions based solely on automated processing and we do not perform profiling. The prices you see are based on the calendar and pricing rules, which are the same for everyone.

10. Your rights

You can ask us at any time for access to your data, rectification, erasure, restriction of processing, portability, and you can object to processing (Articles 15-22 GDPR). If processing is based on consent, you can withdraw it at any time, without affecting any processing already carried out. Write to info@kasavacanze.it : we will respond within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority ( www.garanteprivacy.it ).

11. Security

The site uses an encrypted connection (HTTPS) and access to booking data is limited to those who need it to manage them.

12. Changes to this policy

If the way we process data changes, we will update this page and the date at the top.