Privacy Policy

Last updated: June 2026

Data Controller

Luciano Aprile, Lake Como Style Home, Via Castagnera 2, 23900 Lecco (LC), Italy.

Email: info@lakecomo-stylehome.com

Data We Collect

When you use our booking form or contact form, we collect:

• Name, email address, phone number (optional)
• Booking dates and number of guests
• Any message you include

When you complete the pre-arrival guest registration form, we additionally collect:

• Full name, date of birth, sex, nationality
• Identity document details (type, number, place of issue) — for the primary guest only
• Country and municipality of residence
• Country or municipality of birth

Purpose and Legal Basis

We use this data exclusively to:

• Process your booking request and manage your stay (legal basis: performance of contract — Art. 6(1)(b) GDPR)
• Communicate with you about your stay (legal basis: performance of contract)
• Comply with Italian accommodation regulations (legal basis: legal obligation — Art. 6(1)(c) GDPR):
• • Police registration (Art. 109 TULPS, DM 7/1/2013 as modified by DM 16/9/2021): we are legally required to transmit guest data to the Italian Ministry of Interior via Alloggiati Web within 24 hours of arrival
  • Regional tourism statistics (D.Lgs. 322/89, Reg. CE 692/2011): for direct bookings, we transmit anonymised arrival/departure data to Regione Lombardia via ROSS1000

Providing personal data for legal purposes is mandatory: without it, we cannot host you at our property.

Document Scanning (OCR)

If you choose to use the optional document photo scan feature:

• The image is sent via HTTPS to an EU-based AI provider (Mistral AI, Paris, France) for text extraction, in compliance with EU GDPR regulations
• The image is processed via Mistral AI's stateless API — per their Data Processing Agreement, inputs are not stored or used for training
• The image is held in memory only during processing and is never saved to disk or database on our server
• The image is deleted immediately from our server memory after extraction, regardless of success or failure
• Only the extracted text fields are retained (not the image)

Data Retention

• Guest registration data (personal details, document information): retained for 5 years after check-out, as required by DM 16/09/2021 art. 4-bis and D.Lgs. 322/89. After this period, data is permanently deleted.
• Booking data (dates, amounts, communication): retained for 5 years after check-out (legal obligation).
• Contact form messages: deleted after 12 months.
• Document images: never stored — deleted immediately after OCR extraction.

Third Parties & Data Processing

We do not sell or share your data with third parties for marketing purposes. Data may be shared with:

• Italian Ministry of Interior (Alloggiati Web): as strictly required by Art. 109 TULPS for guest registration. The Ministry is the data controller for the data held in the Alloggiati Web system (DM 16/09/2021 art. 4).
• PoliS-Lombardia / ROSS1000: regional tourism statistics. PoliS-Lombardia is the data controller; ARIA S.p.A. acts as data processor. Only for direct bookings (channel bookings are reported by the booking platform directly).
• Payment processors (Stripe): only for transaction processing. Stripe operates under EU data protection standards.
• OCR provider (Mistral AI, France): document images are processed in the EU. Only the image is sent; no other personal data is transmitted. Images are not stored by the provider.
• Technical service providers: your data is hosted on servers located in Germany (Hetzner Online GmbH), within the EU. Email communications are routed through Proton (Switzerland), which benefits from an adequacy decision by the European Commission.

No personal data is transferred outside the European Union.

Your Rights (GDPR)

• Before check-in (and before data is transmitted to authorities): you may access, correct, or delete your registration data via the registration form link.
• After transmission to authorities: your data is held by the Italian Police (data controller per DM 16/09/2021 art. 4) and by PoliS-Lombardia. The right to erasure does not apply, as processing is based on a legal obligation (Art. 6(1)(c) GDPR; Art. 17(3)(b) GDPR). You may exercise your rights with these controllers directly:
• • PoliS-Lombardia: privacy@polis.lombardia.it
  • DPO PoliS-Lombardia: dataprotection@polis.lombardia.it
• For data we hold locally (booking data, contact information): you may request access, rectification, or deletion by contacting us at info@lakecomo-stylehome.com. Deletion of registration data is subject to the 5-year legal retention obligation.

Complaint to Supervisory Authority

If you believe that the processing of your data is not compliant with applicable regulations, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): www.garanteprivacy.it.

Cookies

This website uses only essential technical cookies (session management). No tracking or analytics cookies are used.