Privacy Policy
Last updated: 13 July 2026 · version 1.1
1. Data controller
The data controller is Palermo Holiday House S.R.L.S., registered office at Via Agrigento 10, 90141 Palermo (Italy), VAT/Tax code 07153740829, REA PA-440502, legal representative Arch. Emanuela Di Gaetano.
For any request concerning personal data: email phh.palermo@gmail.com · certified email (formal channel) palermoholidayhouse@pec.it.
The property is identified by the Italian codes CIN IT082053B4TREUMPPU and CIR 19082053B455865.
2. What data we process
- Technical browsing data. The website is hosted on Netlify: servers record technical logs (IP address, date and time of the request, user agent) needed to deliver the service and keep it secure.
- Requests by email or WhatsApp. If you write to us, we process the data you choose to share (name, contact details, message content). Email and WhatsApp are channels used voluntarily by the user; WhatsApp is a Meta service, also subject to its own privacy notice.
- Direct bookings. Bookings made on this website are handled through the Smoobu booking engine (Smoobu GmbH): we process name, surname, contact details, stay dates, number of guests and any requests.
- Payments. Direct bookings are paid via PayPal, integrated in the Smoobu checkout. The controller does not receive or store full payment instrument data (card numbers or PayPal credentials), which are handled directly by PayPal.
- Check-in and guest registration. Before arrival or at check-in we collect identity document data of all guests, also through the Vikey self check-in platform, for the legal obligations described in section 3.
- Bookings via online travel agencies (OTAs). When a booking is made through Booking.com, Airbnb or other portals, the data is not initially collected by the controller directly from the guest: the source of the data is the portal through which the booking was made, which acts as an independent controller for its own processing. Palermo Holiday House receives from the portal only the data made available by it and needed to manage the stay. Information on processing carried out directly by the OTA is provided by the platform itself in its own privacy notice.
3. Purposes and legal bases
- Managing the booking and the stay → performance of a contract (Art. 6(1)(b) GDPR).
- Replying to information and availability requests → pre-contractual measures (Art. 6(1)(b)).
- Guest registration and mandatory reporting to the police authorities through the Italian Alloggiati Web portal → legal obligation (Art. 6(1)(c) GDPR; Art. 109 of the Italian TULPS).
- Managing and remitting the tourist tax to the Municipality of Palermo → legal obligation (Art. 6(1)(c)).
- Administrative, accounting and tax obligations → legal obligation (Art. 6(1)(c)).
- Website security and abuse prevention → legitimate interest (Art. 6(1)(f)).
4. Newsletter and marketing: not active
This website currently has no newsletter and no marketing activity. Guests who book, email us or contact us on WhatsApp are not added to any promotional list.
Any future newsletter will be activated only through a dedicated form, with a separate, specific, optional, non pre-ticked consent that can be withdrawn at any time. Consent will never be a condition for booking. This notice will be updated before activation.
5. Analytics tools: not active
At this stage the website uses no statistical analysis tools: Google Analytics 4 (ID G-TDJV25RGCL) is not active and no measurement cookies are set. Any activation will take place only after a compliant consent system is implemented; this notice and the Cookie Policy will be updated at the same time.
6. Automated decision-making and profiling
Palermo Holiday House does not carry out decision-making based solely on automated processing that produces legal effects concerning the guest or similarly significantly affects them, and does not perform profiling through this website.
Any activities carried out independently by the providers of the services used are governed by their respective privacy notices.
7. Recipients
For the purposes above, data may be processed by:
- Smoobu GmbH (Berlin) — booking engine and reservation management (service provider; privacy role determined by the applicable agreements);
- PayPal — payment processing (independent controller);
- Vikey S.r.l. — self check-in and guest registration platform (service provider; privacy role determined by the applicable agreements);
- Netlify, Inc. — website hosting (service provider; privacy role determined by the applicable agreements);
- OTA portals (Booking.com, Airbnb) — for bookings made on their channels (independent controllers);
- Public security authorities — via the Alloggiati Web portal (legal obligation);
- Municipality of Palermo — for the tourist tax (legal obligation);
- The controller's administrative and tax advisors, for mandatory compliance.
Providers processing personal data on behalf of the controller act, where applicable and on the basis of the agreements in place, as processors under Art. 28 GDPR. Other providers may act as independent controllers for their own processing, as stated in their respective privacy notices.
8. International transfers
Some providers may process data outside the European Economic Area, notably in the United States. In such cases, processing takes place in compliance with the conditions set out in Art. 44 ff. GDPR, on the basis of the safeguards made available by the provider concerned.
Data subjects may ask the controller, at the contact details given in section 1, for further information about the transfers, details of the applicable safeguards, and how to obtain a copy of them, where available. Up-to-date information is also available in the providers' own privacy notices.
9. Retention periods
- Booking, accounting and tax data: up to 10 years, as required by Italian civil and tax law.
- Data reported via Alloggiati Web: within the terms set by public security regulations.
- Correspondence (email/WhatsApp) not followed by a booking: up to 24 months from the last contact.
- Technical hosting logs: according to the provider's technical policies.
- Any future analytics or newsletter tools: retention periods will be declared upon activation.
10. Your rights
You may exercise at any time the rights under Arts. 15–22 GDPR: access, rectification, erasure, restriction of processing, portability, objection and, for consent-based processing, withdrawal of consent without affecting the lawfulness of prior processing.
To exercise them, write to phh.palermo@gmail.com or to the certified email palermoholidayhouse@pec.it. The controller will respond without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests; in that case the data subject will be informed of the extension and of the reasons for it within one month of receipt of the request. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
11. Provision of data
Providing the data needed for the booking, the stay and legal obligations is essential: without it, the service cannot be delivered. Any future consent (analytics, newsletter) will always be optional.
12. Minors
This website is not addressed to minors. Data of minor guests are processed exclusively for legal obligations (guest registration) and are provided by the accompanying adults.
13. Updates
This notice may be updated to reflect changes in the law or in the services used. The current version, with its date, is always published on this page.
For details on technical tools, see also our Cookie Policy.