Privacy
How we handle your data
This site collects very little, and the little it collects is there so we can reply to you. Below is exactly what, why, for how long, and who else sees it. It is written to be read, not to cover us.
Last updated: 28 August 2026
Who handles the data
The data controller is Simone Billeri, Italian tax code BLLSMN02C30A475B, Strada Vicolo Rancolfo 6, Perugia, Italy. There is no VAT number: this activity does not require one. The property’s national identification code is IT054039C204033329.
For anything to do with your data — including asking us to delete it — write to booking@casadeisanti.com. We reply within a month, as the law requires, though usually much sooner.
What we collect, and why
There are three separate purposes, on different legal bases. They are worth keeping apart, because your rights differ between them.
- Your stay request. When you fill in the form we collect your dates, the number of guests, your name, email, phone and whatever you write in the message. We need these to reply with availability and a quote: the legal basis is the performance of pre-contractual measures, not consent — which is why we do not ask you to tick a box. Without them we cannot reply, and that is the only reason they are required.
- Visit statistics. Google Analytics tells us how many people come by and where from. The legal basis here is your consent, which you can refuse and withdraw whenever you like: the site works just the same.
- Running and protecting the site. Whoever hosts the pages records the IP addresses that request them, as any server does. The legal basis is our legitimate interest in keeping the site working and defending it from abuse.
We do not profile anyone, we make no automated decisions about you, and we neither sell nor pass your data to anyone for commercial purposes.
How long we keep it
| What | How long |
|---|---|
| Requests that do not become stays | 24 months |
| Requests that become stays | 10 years, for tax and accounting obligations |
| Visit statistics | 14 months |
| Site access logs | As long as the hosting provider keeps them |
| Your cookie choice | 6 months, then we ask again |
After that we delete. If you ask us to delete sooner, we do — except for what the law obliges us to keep, such as the tax records of a stay you actually took.
Who else sees it
Nobody, apart from the suppliers we need to make things work. Each of them handles the data on our behalf, under a contract that binds them and within the limits we set.
| Who | What they do |
|---|---|
| Vercel, Inc. | Hosts the site. Pages are served from European servers in Frankfurt. |
| Plus Five Five, Inc. (Resend) | Sends the email carrying your request. Mail leaves from Ireland. |
| Namecheap, Inc. | Hosts the mailbox the request arrives in. |
| Google Ireland Limited | Visit statistics and the map, if you accepted them. |
If you write to us on WhatsApp, that conversation goes through Meta and their privacy notice applies, not this one.
There is also a recipient that is not a supplier: when you stay with us we are required by Italian law to report guest details to the Portale Alloggiati of the State Police. It is an obligation, not a choice — we cannot avoid it, and neither can you object to it if you wish to stay. We give you a separate notice about it on arrival.
Does data leave Europe?
Partly, yes. Vercel, Resend, Namecheap and Google are United States companies, even where the servers we use sit in Europe.
Vercel, Resend and Google are certified under the Data Privacy Framework: the decision by which the European Commission recognises an adequate level of protection in the United States, for companies that certify to it.
Namecheap is not. The transfer to them rests on the standard contractual clauses approved by the Commission, which the contract we hold with them incorporates — the other instrument the regulation provides for the same purpose.
What you can ask for
By writing to booking@casadeisanti.com you can ask us:
- what data of yours we hold, and for a copy of it;
- to correct it, if it is wrong;
- to delete it;
- to restrict its use, or to object to the processing;
- to receive it in a format another service can read;
- to withdraw your consent to statistics, from the “Cookie preferences” link at the foot of every page — and withdrawing does not make lawful what was done before unlawful.
If you think we are getting it wrong and we cannot settle it between us, you can go to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to a court.