Privacy Policy / Data Protection Notice

Casa Montiluce - VAT Solutions Holding B.V. — Short-Term Tourist Rental

Last updated: 29 August 2026

This Privacy Policy ("Policy") describes how VAT Solutions Holding B.V. with registered office at Viale Monte Nero 84, VAT number 09604330960 acting as Data Controller ("we," "us," "our"), collects, uses, stores, and protects the personal data of guests who book or stay at Casa Montiluce located at Monti San Lorenzo 1, 19032 Lerici (SP) Italia ("the Property"), in compliance with:

• Regulation (EU) 2016/679 ("GDPR");
• Legislative Decree 196/2003 ("Italian Privacy Code"), as amended by Legislative Decree 101/2018;
• Italian public security legislation requiring guest registration (Art. 109 of the Consolidated Public Security Act — TULPS, Royal Decree 773/1931, and related "Alloggiati Web" reporting obligations to the local Questura/police authority);
• Local and regional tourist tax regulations, where applicable.

____________________________________________________________________________________________

1. Data Controller

Name: VAT Solutions Holding B.V. Address: Viale Monte Nero 84 20135 Milano (MI) Italia Email: vatsolutions@legalmail.it VAT/Tax ID: 09604330960 Data Protection Officer: Not applicable — a DPO has not been appointed as it is not required for our size/activity.

____________________________________________________________________________________________

2. What Personal Data We Collect

• Identity data — Full name, date/place of birth, nationality, gender, ID/passport number, ID document copy, fiscal registration number (i.e. "codice fiscale" for Italian guests only). Provided by guest at booking/check-in.
• Contact data — Email, phone number, home address. Provided by guest.
• Booking & payment data — Reservation dates, number of guests, payment card details (processed via payment provider), billing details. Provided by guest / booking platform.

____________________________________________________________________________________________

3. Purposes and Legal Basis for Processing

• Managing the booking and rental contract: Legal Basis (GDPR Art. 6) - Art. 6(1)(b) — performance of a contract
• Mandatory guest registration with local police authorities (Alloggiati Web / Questura) within 24 hours of check-in: Legal Basis Art. 6(1)(c) — compliance with a legal obligation
• Issuing invoices/receipts and tax reporting (incl. tourist tax collection where applicable): Legal basis Art. 6(1)(c) — legal obligation
• Responding to guest inquiries and providing customer support: with legal basis:  Art. 6(1)(b) / Art. 6(1)(f) — legitimate interest
• Sending pre-arrival information, house rules, and post-stay communications: with legal basis Art. 6(1)(b) — contract performance
• Marketing communications (newsletters, promotions): with legal basis Art. 6(1)(a) — consent (opt-in, revocable at any time)
• Preventing fraud, damage, or misuse of the Property: with legal basis Art. 6(1)(f) — legitimate interest
  

____________________________________________________________________________________________

4. Mandatory Police Registration (Important Italy-Specific Notice)

Italian law requires all accommodation providers to transmit certain guest identity data to the local police headquarters (Questura) via the Alloggiati Web portal within 24 hours of the guest's arrival. This applies to all guests, including EU citizens, and is a legal obligation independent of guest consent — we cannot offer accommodation without collecting a valid ID document and the data it requires (name, date/place of birth, nationality, ID type and number).

This data is transmitted securely to the Ministry of the Interior and is not used by us for any other purpose beyond this legal requirement and, where relevant, local tourist tax reporting.

____________________________________________________________________________________________

5. Data Retention

• Identity documents / police registration data — Deleted from our internal systems once transmitted to Alloggiati Web, unless required for tax/accounting purposes (see below).
• Booking, invoicing, and tax records — Retained for 10 years, per Italian civil and tax law (Art. 2220 Civil Code; Presidential Decree 600/1973).
• Marketing consent data — Retained until consent is withdrawn.
• Guest correspondence — Retained for up to 2 years after the stay, for support/dispute purposes.
• Website cookies/analytics — Retained per Cookie Policy (typically 12–24 months).
  

____________________________________________________________________________________________

6. Data Sharing and Recipients

We may share personal data with:

• Public authorities: local Questura/police (Alloggiati Web), municipal authorities (tourist tax), tax authorities, where legally required.
• Service providers acting as Data Processors: booking platforms (e.g., Airbnb, Booking.com), payment processors, property management software providers, cleaning/maintenance staff (limited data only), accountants.
• Professional advisors: lawyers, accountants, insurers, where necessary We do not sell personal data to third parties.

International Transfers

If any service provider is located outside the EU/EEA (e.g., certain booking platforms or cloud providers), transfers are carried out under appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision.

____________________________________________________________________________________________

7. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or disclosure, including restricted access to guest records, secure storage of ID copies, and secure transmission to Alloggiati Web.

____________________________________________________________________________________________

8. Your Rights (GDPR Articles 15–22)

As a data subject, you have the right to:

• Access your personal data (Art. 15);
• Rectify inaccurate data (Art. 16);
• Erase data ("right to be forgotten"), subject to legal retention obligations (Art. 17);
• Restrict processing (Art. 18); • Data portability (Art. 20);
• Object to processing based on legitimate interest or for marketing purposes (Art. 21);
• Withdraw consent at any time, where processing is based on consent, without affecting prior lawful processing;
• Lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it) or the supervisory authority in your EU country of residence.

To exercise your rights, contact us at: vatsolutions@legalmail.it

____________________________________________________________________________________________

9. Cookies (if applicable — website/booking widget)

If you interact with our website or online booking system, we use cookies as described in our separate Cookie Policy. You can manage cookie preferences via the cookie banner or your browser settings.

____________________________________________________________________________________________

10. Changes to This Policy

We may update this Policy from time to time to reflect legal or operational changes. The "Last updated" date at the top indicates the most recent revision. Material changes will be communicated to guests with active bookings where relevant.

____________________________________________________________________________________________

11. Contact

For any questions about this Policy or how we handle your data: VAT Solutions Holding B.V. Email: vatsolutions@legalmail.it.  Address: Viale Monte Nero 84 20135 Milano (MI) Italia.