Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the details above.

2. What Personal Data We Collect

We may collect and process the following categories of personal data depending on how you interact with our website and services:

2.1 Data You Provide Directly

• Contact information: name, email address, and phone number — when you submit an inquiry or booking request through our forms.
• Payment information: billing name, address, and payment card details — processed securely through Stripe when you make a reservation payment. We do not store your full card details on our servers.
• Communications: any messages or information you include in correspondence with us.

2.2 Data Collected Automatically

• Usage data: IP address, browser type and version, operating system, referring URL, pages visited, time and date of visits, and time spent on pages.
• Cookies and similar technologies: we use cookies and tracking scripts to analyse website traffic and improve our services (see Section 6 for details).

3. Purposes and Legal Basis for Processing

We process your personal data for the following purposes and on the corresponding legal bases under Article 6 of the GDPR:

Purpose	Legal Basis
Responding to your booking inquiries and managing reservations	Performance of a contract / pre-contractual measures (Art. 6(1)(b))
Processing payments via Stripe	Performance of a contract (Art. 6(1)(b))
Analysing website usage via Google Analytics to improve our services	Your consent (Art. 6(1)(a))
Processing reservation requests and inquiries via Formspree	Performance of a contract / pre-contractual measures (Art. 6(1)(b))
Syncing calendar availability with Airbnb and Booking.com via iCal	Legitimate interest in managing property availability (Art. 6(1)(f))
Complying with legal and tax obligations	Legal obligation (Art. 6(1)(c))

4. Third-Party Service Providers

We share your personal data with the following third-party processors, who act on our behalf or provide services that involve data processing:

Provider	Purpose	Data Processed	Privacy Policy
Google Analytics (Google LLC)	Website analytics and traffic measurement	IP address (anonymised), pages visited, usage behaviour, device data	Google Privacy Policy
Stripe (Stripe, Inc.)	Payment processing	Name, email, billing address, payment card details	Stripe Privacy Policy
Formspree (Formspree, Inc.)	Processing contact and reservation request form submissions	Name, email, phone number, message content, selected dates	Formspree Privacy Policy
Airbnb (Airbnb Ireland UC)	Calendar availability sync via iCal	Property availability dates only (no guest personal data)	Airbnb Privacy Policy
Booking.com (Booking.com B.V.)	Calendar availability sync via iCal	Property availability dates only (no guest personal data)	Booking.com Privacy Policy

5. International Data Transfers

Some of our third-party service providers (notably Google and Stripe) are based in the United States. When your data is transferred outside the European Economic Area (EEA), it is protected by appropriate safeguards, including:

• The EU–U.S. Data Privacy Framework, where the provider is certified.
• Standard Contractual Clauses (SCCs) approved by the European Commission.

You may request further information about these safeguards by contacting us at info@lagosereno.com.

6. Cookies and Tracking Technologies

Our website uses the following types of cookies:

6.1 Essential Cookies

These are strictly necessary for the website to function (e.g., navigation, security). They do not require your consent.

6.2 Analytics Cookies

We use Google Analytics (Measurement ID: G-7C9L9DLYJL) to understand how visitors interact with our website. Google Analytics uses cookies to collect anonymised information about page visits, traffic sources, and user behaviour. IP anonymisation is enabled.

These cookies are only loaded after you have given your explicit consent via our cookie banner. If you decline, no analytics cookies are set and no data is sent to Google. You may withdraw your consent at any time by clearing your browser's local storage or cookies for this site (see Section 8 below).

6.3 Third-Party Cookies

Payment interfaces (Stripe) and translation widgets (GTranslate) may set their own cookies when used. These are governed by the respective providers' cookie policies.

6.4 Managing Cookies

You can manage or delete cookies through your browser settings at any time. Disabling certain cookies may affect your experience on our website. You can also opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:

• Booking and inquiry data: retained for the duration of your stay plus 10 years thereafter, in compliance with Italian tax and accounting obligations.
• Payment data: processed and stored by Stripe in accordance with their retention policies and applicable financial regulations. We do not store full payment card details.
• Analytics data: Google Analytics data is retained for 14 months, after which it is automatically deleted.
• Communication records: retained for up to 3 years after your last interaction for customer service purposes, unless a longer period is required by law.

8. Your Rights Under the GDPR

As a data subject, you have the following rights under the GDPR. You may exercise any of these rights by contacting us at info@lagosereno.com.

• Right of access (Art. 15): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to request a copy of that data.
• Right to rectification (Art. 16): You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to erasure (Art. 17): You may request the deletion of your personal data where there is no compelling reason for us to continue processing it.
• Right to restriction of processing (Art. 18): You may request that we restrict the processing of your data in certain circumstances.
• Right to data portability (Art. 20): You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21): You may object to the processing of your personal data where we rely on legitimate interest as a legal basis.
• Right to withdraw consent: Where processing is based on your consent (e.g., analytics cookies), you may withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

We will respond to your request within 30 days. If we need more time, we will inform you of the reason and the extended timeframe.

9. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority:

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encrypted connections (HTTPS/TLS) for all data transmission, secure processing of payments through PCI DSS-compliant Stripe infrastructure, and restricted access to personal data on a need-to-know basis.

11. Children's Privacy

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child under 16, we will take steps to delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Material changes will be communicated via a prominent notice on our website.