What we do with your data

This page explains what happens to your data when you write to us, call us, visit this site or book the house.

If any passage is unclear, tell us and we will rewrite it.

This is a translation of the Italian privacy policy: if the two differ, the Italian text prevails.

Updated on 7 October 2026 · under Articles 13 and 14 of Regulation (EU) 2016/679

01Who processes your data

The data controller is Dimora Berchiatti di Alberto Maria Trivero.

Controller: Dimora Berchiatti di Alberto Maria Trivero
Registered office: Via Meinardi 5, 10090 San Giorgio Canavese (TO), Italy
VAT number: 11234960018
Email: info@dimoraberchiatti.it
Phone: +39 352 207 0661

We do not have a data protection officer (DPO) and are not required to have one: we are not a public authority, we do not process data on a large scale and processing special categories of data is not among our core activities (the three cases in Art. 37 GDPR). The controller deals with data protection matters directly and can be reached at the contact details above.

02Which data, and why

Nearly all the data we hold comes from you: you write to us, call us or fill in the form. Some of it reaches us from other platforms: enquiries from Matrimonio.com, bookings from Interhome and the reviews you write on Airbnb, Booking.com and Google. We do not buy data from anyone and do not collect it from social media or from contact lists. Below there is a box for each processing activity, with its legal basis and its retention period.

The enquiry you send from the contact form

Data: Name, email address, phone number, date of the event, number of guests, the message you write and, if you tell us, how you heard about us. With the enquiry the form also sends the page you send it from and, if your browser provides it, the name of the site you came from.
Purpose: To reply to you (on WhatsApp, if you ask for that in the form), check whether the date is free, prepare a quote and, if you are interested, show you the house. How you heard about us and the site you came from tell us where we should be visible.
Legal basis: Art. 6(1)(b) GDPR: pre-contractual steps taken at your request. This is not consent, which is why we do not ask you for it: it is the minimum data without which a reply is not possible. If you do not give it to us, we cannot answer you. For knowing where we should be visible the basis is Art. 6(1)(f), our legitimate interests: the question is optional, and we keep only the name of the site you came from, not the page address.
Retention: 24 months from our last exchange, then we delete it.

The enquiry you send us from Matrimonio.com

Data: Name, email, phone, the date or month of the celebration, the number of guests and the message, as Matrimonio.com sends them to us in the notification of your enquiry.
Purpose: The same as for an enquiry from the form: to reply to you, check whether the date is free and prepare a quote. Our management system reads the notification from our mailbox and keeps it with the other enquiries, so that none is lost. From there it also sends you the first reply, which Matrimonio.com adds to the conversation about your enquiry.
Legal basis: Art. 6(1)(b) GDPR: pre-contractual steps taken at your request. For the data it collects on its own site, Matrimonio.com has its own privacy policy.
Retention: 24 months from our last exchange, then we delete it.

Emails, phone calls and WhatsApp messages

Data: What you write or tell us, and the contact details you use to reach us or leave in the form. We do not record phone calls.
Purpose: The same things: to reply, keep track of the conversation and remember what we agreed.
Legal basis: Art. 6(1)(b) if the contact is about an event. If you write to us about something else (a question, or to point something out), the basis is Art. 6(1)(f), our legitimate interest in replying to you.
Retention: 24 months from our last exchange.

The proposal and the contract

Data: First name and surname, sex, place and date of birth, Italian tax identification number (codice fiscale) or VAT number, email and mobile number of the person signing, and the details of the bank transfer with which you pay the deposit and the balance. If you sign online, also the audit trail of the signature: the time of each step, the number or address the code is sent to and the IP address you sign from.
Purpose: To prepare your proposal, write the rental contract for the house and have it signed, from your event page; then to remind you of the payment deadlines, collect payment, invoice and keep the accounts. After the celebration we ask you for a review: on Matrimonio.com for a wedding, on Google for other celebrations.
Legal basis: Art. 6(1)(b) for the contract and Art. 6(1)(c) for tax and accounting obligations, which are not optional for either of us. For the request for a review after the celebration the basis is Art. 6(1)(f), our legitimate interests. If you would rather we did not ask, tell us.
Retention: We keep the contract and the invoices for 10 years: this is both the period Article 2220 of the Italian Civil Code sets for accounting records and the ordinary limitation period (Article 2946). If the contract is not signed, the data in the proposal stays for 24 months from our last exchange, like enquiries, and we delete it sooner if you ask.

Site visit statistics

Data: The pages you open, where you came from, the type of device and browser, the country and the approximate city. No cookies, no stored identifier: the IP address is used to estimate your location and, through a code that changes daily, to tell one visit from another on the same day; the address itself is never stored. No name, no contact details.
Purpose: To know which pages are useful and which are not.
Legal basis: Art. 6(1)(f): our legitimate interest in knowing whether the site works, with a tool (Umami, on servers we run ourselves) that identifies no one and passes no data to third parties. Under the guidance on cookies of the Garante, the Italian data protection authority, statistics made this way do not require consent: that is why there is no banner to accept (cookie policy).
Retention: The aggregate data stays for as long as we need it to compare one year with another. There is no individual profile to delete, because none exists.

The Google map, if you open it

Data: The IP address and the technical browser data that Google receives when it loads the map inside the contact page, and the cookies Google may write on its own domain. No data passes through us.
Purpose: To show you where we are on a map you can zoom, with the house’s listing and its reviews.
Legal basis: Art. 6(1)(a): your consent, given by pressing ‘Mostra la mappa’ (‘Show the map’). Before that tap nothing is sent to Google, and the two links below the map open Google only if you press them.
Retention: We keep nothing. How long Google’s cookies last is set out in its own policy, which the cookie policy links to.

The server’s technical logs

Data: IP address, date and time, the address requested, the type of browser and the outcome of the request. They are generated by the server, not by a cookie, and are collected even if you block the statistics.
Purpose: To keep the site running, understand why a page returned an error, and notice an attack or misuse.
Legal basis: Art. 6(1)(f): the legitimate interest in keeping a service we offer to the public running and secure. It is the technical minimum: without logs a server cannot be administered.
Retention: A short period, in the order of days, after which the hosting provider deletes them automatically. We do not archive them anywhere else.

The apartment booking

Data: The name of the person booking, the arrival and departure dates, how many of you there are (adults, children, infants), whether you are travelling with a dog, the country you are coming from, your language and the platform you booked on; for your arrival, also your phone number, your email, the time you expect to arrive and your requests. Interhome, which handles the apartment’s bookings, passes them on to us.
Purpose: To prepare your arrival and your stay, and to keep the house’s calendar, so that the apartment and celebrations do not overlap. On WhatsApp we write to you after you book; before you arrive we send you the link to your stay page and the door code, and, once you have left, a goodbye message. If your details are still missing a few days before arrival, we also remind you by email.
Legal basis: Art. 6(1)(b): the contract for the stay you have booked. For the goodbye message after you leave, which also invites you to leave us a review on the platform where you booked, the basis is Art. 6(1)(f), our legitimate interests. If you do not want the message, tell us and we will not send it.
Retention: We delete the phone number, the email, the arrival time and the requests 30 days after departure, and the name 12 months after departure. The dates, the number of people and the country remain, without a name, for the accounts and the statistics.

If you stay overnight in the apartment

Data: First name and surname, sex, date and place of birth, citizenship and place of residence of the people staying overnight; the type, number and place of issue of the identity document of the head of the family or the group leader, or of the person travelling alone. If you choose to photograph the document, also its photo.
Purpose: The notifications required of anyone who provides accommodation: transmission to the Questura (the provincial police headquarters) through the Alloggiati Web service of the Polizia di Stato, and the tourism statistics of the Piedmont Region, which also asks for the place of residence. The photo of the document serves only to write these details into the fields of the form: OpenAI reads it for us, and you check the details it has read before saving them.
Legal basis: Art. 6(1)(c): a legal obligation (Article 109 of the Italian public security act, T.U.L.P.S.). Neither you nor we have any choice in this: without these details we cannot host you. The photo, on the other hand, is a choice, and the basis is your consent (Art. 6(1)(a)), which you give by taking the photo: without it the details are typed in by hand.
Retention: We delete the identity document details the day after departure; name, sex, birth, citizenship and place of residence 30 days after departure. The country of residence remains, without a name, for the statistics. We keep the Questura’s receipts, which carry the names, for 12 months. We do not keep the photo of the document: once it has been read, nothing remains with us; OpenAI keeps it for at most 30 days in the logs it uses to check for abuse of the service. We do not use these details for anything else.

The reviews you leave on booking platforms

Data: From a review you leave for the house on Airbnb, Booking.com or Google we take only what the platform publishes: the date, the rating, the text, the language and our reply, if there is one. From Airbnb and Booking.com we also take the name the platform shows, and from Booking.com the dates of the stay. From Google we do not take the name of the person writing.
Purpose: To know how you found your stay and what to improve. Our management system links each review of the apartment to the stay it comes from, by the dates or by the name. Next to each celebration it places the Google reviews written in the two weeks that follow.
Legal basis: Art. 6(1)(f): our legitimate interest in knowing how you found your stay and in improving the house. We read the reviews on the house’s public pages, where you published them yourselves.
Retention: 24 months from the date of the review, then we delete them from the management system. On the platform they remain for as long as you leave them there.

This site does not set cookies in your browser: the reason is in the cookie policy. There we also explain how the Google map on the contact page works, which loads only if you open it.

03What we don’t do

Our commitments

We do not sell your data or hand it over to anyone for their own use. There is no commercial agreement that treats it as something to trade.
No profiling, no automated decision-making within the meaning of Art. 22 GDPR. We prepare the quote by hand, starting from the published price list: no algorithm decides what price to give you.
No newsletter, no promotional mailings. If you write to us for a quote, a person replies and that is all: you are not added to any list.
No advertising pixels and no remarketing. On this site there is no Meta, TikTok, LinkedIn, Google Ads or Google Analytics. We count visits with a cookie-free tool, on servers we run ourselves.
We do not ask for data we do not need. The form has no address field, because to reply to an enquiry we do not need to know where you live.

04Who receives your data

Today we use these service providers for email, messages, the site and its statistics, the signing of contracts, the map, the reviews, the apartment’s locks and the reading of the document. If we add another, this page changes.

Zoho, email

What it does: It hosts the mailbox info@dimoraberchiatti.it, where your emails, the enquiries sent from the form, copies of the emails about your event booking and the notifications from Matrimonio.com and Interhome arrive.
Where the data is: Servers in the European Union.
Role: Processor acting on our behalf (Art. 28 GDPR). It does not read the mail and does not use it for its own purposes.

WhatsApp, messages

What it does: It carries the messages we exchange on WhatsApp, when you write to us and when you ask us in the form to reply there, and those about a stay in the apartment. According to its privacy policy the messages are end-to-end encrypted: no one else can read them, not even WhatsApp. We read and write them in the WhatsApp Business app, on our phones. The messages about a stay are prepared by our management system, and we send them ourselves, one by one.
Where the data is: For people in Europe the service is provided by WhatsApp Ireland Limited, a company of the Meta group. According to WhatsApp’s privacy policy the data may also be processed in the United States and in other countries.
Role: It processes the data of your account and of your use of the service under its own privacy policy.

Resend, sending emails

What it does: On our behalf it sends the email with your enquiry to info@ and the automatic confirmation to you, and then the emails about your event booking: the contract with the signatures and its PDF, the confirmation of the deposit, the payment reminders. To guests staying in the apartment it sends the reminder about the check-in details. It sees the content of each email for the time needed to deliver it and keeps a technical log of each one for 30 days.
Where the data is: Emails are sent from the service’s European region (Ireland). Resend Inc. is a US company: the account data and the technical log are held in the United States.
Role: Processor acting on our behalf (Art. 28 GDPR), under the data processing agreement it publishes.

Google, the map if you open it

What it does: On the contact page, the Google Maps map that loads only if you open it: no Google Analytics, no Google Ads, no remarketing, no advertising tags.
Where the data is: The contract is with Google Ireland Limited; Google’s infrastructure may, however, also process the data in the United States.
Role: Independent controller for the data it receives when you open the map: that data does not pass through us.

Openapi, signing the contract

What it does: It collects the electronic signature of the contract: it receives the PDF and the name, email and mobile number of the person signing, sends the code by SMS or by email and records the audit trail of the signature. It keeps the trail for 10 years and the signed document for 3 months; we keep a copy of both.
Where the data is: Openapi S.p.A. is an Italian company, based in Rome. According to its privacy policy, Openapi processes data at its own operating sites and as a rule does not transfer it outside the European Economic Area.
Role: It receives the data in order to collect signatures on our behalf, under the terms of the service.

Railway, hosting the site

What it does: It runs the site and its database, which holds the enquiries, the proposals, the contracts with the details of the people signing, the apartment bookings, the details of the guests who stay there and the reviews read on the platforms. It also generates the technical logs. The management system running there reads from our mailbox only the notifications from Matrimonio.com and Interhome’s emails about the apartment’s bookings and payments, and from there sends the first reply to enquiries from Matrimonio.com. It reads the Airbnb reviews from the public page of the listing, and those on Booking.com and Google through Apify.
Where the data is: Today the application runs on infrastructure located in the Netherlands. Railway Corporation is, however, a US company, and in turn uses providers of its own.
Role: Processor acting on our behalf, under the data processing agreement it publishes.

Apify, reading the reviews

What it does: Every day it reads for us the reviews of the house on the public pages of Booking.com and Google and passes them to our management system. From Booking.com it also brings the name the platform shows and the dates of the stay; from Google, no name. As soon as the management system has saved the reviews, we delete the copy on Apify.
Where the data is: Apify Technologies s.r.o. is a Czech company, based in Prague. According to its privacy policy it processes data mainly in the European Union and in the United States, with the standard contractual clauses for the data that leaves the Union.
Role: Processor acting on our behalf (Art. 28 GDPR), under the data processing agreement that forms part of its terms.

Nuki, the apartment’s locks

What it does: It operates the apartment’s two keypad locks. For each stay our management system creates a code, registered under the booking number and not under your name, and removes it after departure. The code is valid from check-in time to check-out time. The locks record when they are opened and with which code.
Where the data is: Nuki Home Solutions GmbH is an Austrian company, based in Graz. According to Nuki, the data of its online service is held on servers in the European Union.
Role: It processes the data in order to operate the locks on our behalf, under the terms of the service. How long it keeps the record of openings is set out in its privacy policy.

OpenAI, reading the document

What it does: If you photograph your document in the apartment’s form, it reads the photo with one of its artificial intelligence models and returns to us the details written on it, which you check before saving them. We do not keep the photo. OpenAI does not use it to train its models and keeps it for at most 30 days, in the logs it uses to check for abuse of the service.
Where the data is: For people in Europe the service is provided by OpenAI Ireland Limited, based in Dublin. The data is processed in the United States, under the standard contractual clauses.
Role: Processor acting on our behalf (Art. 28 GDPR), under the data processing agreement OpenAI offers to the customers of its APIs.

Besides them, the data in contracts reaches our tax adviser for the accounts and, should it ever be needed, a lawyer to establish, exercise or defend a legal claim. This does not concern requests for a quote: those stay between you and us.

The details of the guests staying in the apartment are received by the Questura, through the Alloggiati Web service of the Polizia di Stato, because the law requires it. The Piedmont Region receives part of them, without the name, for its tourism statistics.

05If your data leaves Europe

The site

The application runs on Railway, on infrastructure located in the Netherlands: the technical logs and the database of the management system, with the enquiries, the contracts, the stays and the reviews, are created and remain in the European Union. Railway Corporation is, however, a US company, and it cannot be ruled out that its staff access the systems from the United States for maintenance or support. That kind of access is governed by the standard contractual clauses approved by the European Commission, referred to in the data processing agreement Railway publishes.

If in future we move the site outside the European Union, we will say so here the same day.

The statistics and the map

The statistics are on servers we run ourselves, in the same European region as the site: they do not leave the Union. The Google Maps map on the contact page, if you open it, sends data to Google, which may also process it in the United States: Google states that it is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision in July 2023, and that it applies the standard contractual clauses in addition.

The signature

Openapi S.p.A. is an Italian company. Its privacy policy says that as a rule data does not leave the European Economic Area; if it did, the safeguards of Articles 44 and following of the GDPR would apply.

Email

The mailbox is on Zoho Mail, with servers in the European Union. Zoho group companies outside the Union may access it for technical support, on the basis of the standard contractual clauses. The emails from the form and about an event booking are sent by Resend from its European region; Resend Inc. is a US company and keeps its technical logs in the United States, on the basis of the standard contractual clauses referred to in its data processing agreement.

WhatsApp messages

WhatsApp Ireland Limited is part of the Meta group. WhatsApp’s privacy policy says that data may also be processed in the United States and in other countries, in order to run the service. The content of the messages remains end-to-end encrypted. How WhatsApp processes the data of your account is explained in its privacy policy.

The reviews and the locks

Apify Technologies s.r.o. is a Czech company. Its privacy policy says that it processes data mainly in the European Union and in the United States and that, for the data leaving the Union, it applies the standard contractual clauses. We delete the copy of the reviews left on Apify as soon as the management system has saved them. Nuki Home Solutions GmbH is an Austrian company and says it keeps the data of its online service in the European Union.

The photo of the document

If you photograph your document in the apartment’s form, the photo is read by OpenAI. The contract is with OpenAI Ireland Limited, which processes it on the group’s servers in the United States, under the standard contractual clauses of its data processing agreement. We do not keep the photo; OpenAI keeps it for at most 30 days, in the logs it uses to check for abuse.

If you would like a copy of the contractual safeguards applied to any of these transfers, write to info@dimoraberchiatti.it and we will send them to you.

06How long we keep it

There is one rule: data is kept for as long as it is needed for the purpose it was collected for, and not a day longer. All the periods are here:

Enquiries and emails: 24 months from our last exchange
Unsigned proposals: 24 months from our last exchange
Contracts and invoices: 10 years (Articles 2220 and 2946 of the Italian Civil Code)
Apartment bookings: phone and email 30 days after departure, the name 12 months after departure; dates, people and country, without a name, for the accounts
Visit statistics: aggregate, on servers we run ourselves, for as long as they are needed to compare one year with another
Server logs: days, then automatic deletion
Details of overnight guests: the identity document details the day after departure, the rest 30 days after; the country of residence, without a name, for the statistics; the Questura’s receipts 12 months
Photo of the document: nothing with us, once it has been read; with OpenAI at most 30 days, in the logs against abuse
Reviews read on the platforms: 24 months from the date of the review

When the period ends we really do delete: for email that means removing the message from the bin as well.

07How we protect it

The site is served over HTTPS: between your browser and our server the traffic travels encrypted. Email is on Zoho Mail, with servers in the European Union. Your enquiries are read by the controller and by those who help run the events: we do not pass them to other suppliers, caterers included, unless you ask us to.

Your event page opens only from its address and does not appear in search engines. The address contains a long, random code that no one can guess. Anyone who has the link can see the page: share it only with the people you choose. If you need a new link, we will send you one, and the old one stops working. The page for a stay in the apartment also opens only from its address. From two days before arrival until departure it shows the door code: keep the link to yourselves and the people staying with you. For proposals, contracts and stays we use a management system each of us signs in to with our own passkey, unlocked on the phone by fingerprint or face recognition.

If, despite all this, a personal data breach occurs that puts your rights at risk, we will notify the Garante (the Italian data protection authority) within 72 hours and, where the law requires it, we will tell you too, explaining what happened and what you should do (Articles 33 and 34 GDPR).

Minors

The site is not aimed at minors and we do not knowingly ask for data from anyone under 14. If we realise that an enquiry comes from a minor, we delete it without acting on it.

08Your rights

Your data is yours to decide on. Under Articles 15 to 22, the GDPR gives you the right to:

know what data we hold about you and have a copy of it (access);
correct it, if it is wrong or incomplete (rectification);
have it deleted, when there is no longer a reason to keep it (erasure);
freeze its use while we discuss a point (restriction of processing);
take it with you in a machine-readable format (data portability);
object to processing we carry out on the basis of legitimate interests, such as the technical logs, the visit statistics and the reviews read on the platforms (right to object). The statistics identify no one, so there is no profile to remove; if you do not want to appear even in the count, a content blocker in your browser stops the script and the site works just the same.

To exercise them you need no form and it costs nothing: an email to info@dimoraberchiatti.it is enough, even a single line. We reply within one month, as Art. 12(3) requires; if the request is complex we may take up to two more months, and will tell you before the first month is out.

09Complaining to the Garante

If you think we are handling your data badly, you can lodge a complaint with the Italian supervisory authority. You do not need a lawyer and it costs you nothing.

Authority: Garante per la protezione dei dati personali
Address: Piazza Venezia 11, 00187 Roma, Italy
Switchboard: +39 06 696771
Email: protocollo@gpdp.it
Certified email (PEC): protocollo@pec.gpdp.it
Website: garanteprivacy.it

You can also take the matter to court. Writing to us first is the quickest way.

10Changes

If we change tools, suppliers or purposes, we change this page and update the date at the top. If the change concerns processing based on your consent, we ask for your consent again: we do not take it for granted.