Privacy Policy

1. Data controllers (joint controllership)

"DesignSuite" is a trading name under which four properties, owned by two distinct individuals, are promoted and managed. Personal data collected through the website designsuite.it is processed under joint controllership pursuant to Article 26 of EU Regulation 2016/679 by the following controllers:

Single point of contact for exercising your rights and for any communication relating to data processing: carlo@designsuite.it — Phone: +39 335 6810 310. The operational management of the website and of bookings is handled by Carlo Ardito, also on behalf of the other joint controller, under a joint-controllership agreement.

No Data Protection Officer (DPO) has been appointed, as the legal requirements for doing so do not apply. The controllers do not hold a VAT number for the rental activity, which is carried out on a non-business basis under the Italian flat-rate tax regime ("cedolare secca").

2. Categories of data processed

We may process the following categories of personal data:

• Contact data: first name, last name, email address, telephone number;
• Booking data: stay dates, number of guests, special requests;
• Guest identification data:data shown on identity documents, collected pursuant to Article 109 of the Italian Consolidated Public Security Act (Royal Decree 773/1931) for the mandatory notification to the "Alloggiati Web" service of the State Police;
• Payment data: processed directly by the payment service provider (Smoobu / banking networks). It is not stored on our website or by our systems.
• Browsing data: IP address, server logs, browser type, pages visited, collected automatically.

3. Purposes and legal basis of processing

4. Retention period

• Booking data and related accounting documents: 10 years from the end of the contract (Art. 2220 of the Italian Civil Code and tax obligations);
• Guest identification data (Alloggiati Web): 5 years;
• Data collected for marketing purposes: until consent is withdrawn or for a maximum of 24 months;
• Server browsing logs: maximum 12 months.

5. Recipients of the data

Data may be disclosed to the following parties, acting as data processors or independent controllers:

• Smoobu GmbH (Berlin, Germany) — Channel manager and booking system;
• Vercel Inc. (USA) — Website hosting;
• Google LLC (USA) — Google Maps and Google Fonts services for displaying the site;
• Booking portals (Airbnb, Booking.com, VRBO, etc.) for bookings originating from those channels;
• Public authorities: Police Headquarters (Alloggiati Web), Municipality (tourist tax), Italian Revenue Agency;
• Professional advisers: accountants, lawyers, technicians, where necessary.

An up-to-date list of data processors is available on request by writing to the single point of contact indicated in section 1.

6. Transfers of data outside the EU

Some providers (e.g. Vercel, Google) are based in the United States of America. Transfers of data outside the European Economic Area take place on the basis of adequate safeguards, in particular:

• Participation in the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023);
• Standard Contractual Clauses (SCCs) adopted by the EU Commission.

7. Rights of the data subject

At any time you may exercise the rights provided for in Articles 15-22 of the GDPR:

• right of access to the data;
• right to rectification;
• right to erasure ("right to be forgotten");
• right to restriction of processing;
• right to data portability;
• right to object to processing, in particular processing for direct marketing purposes;
• right to withdraw consent given, without affecting the lawfulness of processing based on consent given before its withdrawal.

To exercise these rights, simply send a request to carlo@designsuite.it.

8. Complaint to the supervisory authority

You have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) if you believe that the processing of your personal data infringes the GDPR.

9. Cookies

The site uses only technical cookies necessary for its operation and session cookies managed by the integrated services (Smoobu for bookings, Google Maps for maps). No profiling cookies or third-party analytics tools are used.

Should statistical analysis or profiling tools (e.g. Google Analytics, Meta Pixel) be integrated in the future, a consent banner compliant with the Italian Data Protection Authority Guidelines of 10 June 2021 will be implemented and this notice will be updated accordingly.

10. Provision of data

The provision of data for booking purposes and for contractual and legal obligations is mandatory: without such data it will not be possible to proceed with the booking. The provision of data for marketing purposes is optional.

11. Processing of minors' data

The site is not directed at children under 16. Data of minor guests is processed solely within the scope of the booking made by parents or legal representatives, who implicitly authorise its processing for the purposes of the stay and legal obligations.

12. Changes to this notice

This notice may be updated at any time. Updates will be published on this same page with an indication of the date of the latest revision.