Phaedra House – Privacy policy
Phaedra House uses guests' data only to manage the booking and the stay and to comply with legal obligations. It does not sell them and does not use them for advertising without consent.
This policy is provided under articles 13 and 14 of EU Regulation 2016/679 (GDPR). It applies to anyone who visits phaedrahouse.com, sends a booking request or stays at the apartment.
1. Data controller
The controller is Domenico Scarpato, VAT no. 10753461218, operator of the holiday home Phaedra House (CIN IT063049B4VV32UTCF).
- Address: Piazzetta Sant'Arcangelo a Baiano 7, 80138 Naples, Italy
- Privacy contact: info@phaedrahouse.com
No Data Protection Officer (DPO) has been appointed: for a business of this size it is not mandatory.
2. Data collected, purposes and legal bases
The data are used to answer requests, manage the stay and comply with the law. Without the mandatory data it is not possible to book or stay.
| Purpose | Data | Legal basis (art. 6 GDPR) |
|---|---|---|
| Answering a booking request | Name, email, phone, dates, number and ages of guests, message | Pre-contractual steps requested by the guest (letter b) |
| Managing the booking, payments and stay (automatic emails, access code, assistance) | Request data, amounts and payment status, preferred language | Performance of the contract (letter b) |
| Reporting guests to the Police (Alloggiati Web, art. 109 TULPS) | First name, surname, sex, date and place of birth, citizenship, type, number and place of issue of the document, photo of the document | Legal obligation (letter c) |
| City of Naples tourist tax | Number of guests and nights, data required by the City, any exemptions | Legal obligation (letter c) |
| Invoicing and accounting | Payer's details, amounts, any tax data | Legal obligation (letter c) |
| Protection in case of damage or disputes | Booking data, communications, photos of damage | Legitimate interest (letter f) |
| Website security and spam prevention | IP address, technical browsing data | Legitimate interest (letter f) |
- Data of minors: provided by the parent or the person booking, only for legal obligations and to organise the stay.
- No automated decisions are made and no profiling is carried out.
Statistics and online advertising: visitors who give their consent to cookies are measured with Google Analytics, Google Ads and Meta Pixel, to evaluate campaigns and show Phaedra House ads. The legal basis is consent (art. 6, letter a). Details are in section 5.
3. Who receives the data
The data are seen only by the controller, the authorities provided for by law and the technical providers that run the service.
| Recipient | Why | Role |
|---|---|---|
| Police (Alloggiati Web) | Mandatory reporting of guests | Public authority |
| City of Naples | Tourist tax | Public authority |
| Accountant (Stefano Nigro) | Accounting and tax obligations | Processor |
| Cleaning staff | Preparing the apartment (only dates and number of guests, no documents) | Authorised by the controller |
| Supabase | Database and document storage | Processor |
| Vercel | Hosting of the website and the platform | Processor |
| Neon | Website database (booking requests) | Processor |
| Vercel | Storage of the website's photos | Processor |
| Resend | Sending emails | Processor |
| Beds24 | Calendar and booking management | Processor |
| Intesa Sanpaolo/Stripe | Payments | Independent controller |
| Airbnb, Booking.com | Only for guests who book on those platforms | Independent controllers, with their own privacy policies |
| WhatsApp (Meta) | Only if the guest writes to us there | Independent controller, with its own privacy policy |
Only with consent to cookies are browsing data also sent to Google (Analytics and Ads) and Meta (Facebook and Instagram) for statistics and advertising: see section 5.
Transfers outside the EU: some providers are based in or have servers in the United States. In these cases the transfer relies on appropriate safeguards under the GDPR: the EU-US adequacy decision (Data Privacy Framework) for participating providers, or the European Commission's standard contractual clauses.
4. How long the data are kept
Each piece of data is kept only as long as necessary. Photos of documents are the data kept for the shortest time.
| Data | How long |
|---|---|
| Photos of identity documents | Deleted within 30 days of check-out |
| Guests' personal details (without photos) | 5 years from the stay, for any checks by the authorities and for the tourist tax |
| Invoicing and accounting data | 10 years, as required by law (art. 2220 of the Italian Civil Code) |
| Unconfirmed booking requests | 12 months from the request |
| Email and WhatsApp communications | Up to 2 years after the stay, or longer in case of ongoing disputes |
| Technical browsing data (logs) | Up to 30 days |
After these periods, the data are deleted or anonymised.
5. Cookies
The website always uses technical cookies. It uses Google and Meta statistics and marketing cookies only with the visitor's consent, to measure and improve Phaedra House's advertising campaigns.
| Category | Tools | Purpose | Consent | Duration |
|---|---|---|---|---|
| Technical | Chosen language, cookie preferences, form security | Making the website work | Not required | Up to 12 months |
| Statistics | Google Analytics 4 | Counting visits and page views in aggregate form | Yes | Up to 24 months |
| Marketing | Google Ads (conversions and remarketing), Meta Pixel (Facebook and Instagram) | Understanding which ads bring booking requests and showing ads to people who have already visited the website | Yes | About 3 to 13 months, depending on the cookie |
How consent is given. On the first visit a banner appears with three choices, all equally prominent: accept all, reject all, choose by category. If the visitor closes the banner with the X, this counts as a rejection. Until consent is given, the statistics and marketing tools remain off. The visitor can change their choice at any time from the "Cookie preferences" link at the bottom of every page. The choice is asked again after 6 months or if the cookies used change.
Google and Meta. Google Ireland Ltd and Meta Platforms Ireland Ltd receive the data collected by these tools and process them as independent controllers, under the terms of their advertising services. For collection via Meta Pixel, Phaedra House and Meta are joint controllers. The data may be transferred to the United States on the basis of the EU-US Data Privacy Framework. The two groups' privacy policies are at policies.google.com/privacy and facebook.com/privacy/policy.
The fonts are hosted directly on the website. The Google map loads only when the visitor clicks on it.
6. The guest's rights
The guest can write at any time to info@phaedrahouse.com to exercise their rights. The reply arrives within 30 days.
- Access: knowing which data are processed and receiving a copy.
- Rectification: correcting wrong or incomplete data.
- Erasure: asking for the data to be deleted, except those that the law requires to be kept.
- Restriction and objection: restricting processing or objecting to processing based on legitimate interest.
- Portability: receiving the data provided in a readable format.
- Withdrawal of consent: when processing is based on consent, without affecting what was done before.
- Complaint: lodging a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).
This policy may be updated. The version in force is always published at phaedrahouse.com/privacy.