Privacy policy
Last updated: July 28, 2026
Data controller
The controller of the personal data collected through this site is Luigi Zannella, Roccaraso, Italy. For any request regarding your personal data, write to privacy@monteluceroccaraso.it.
What data we collect and why
Booking data — first name, last name, email, phone number, stay dates, number and age of guests. Collected to manage your booking request and perform the stay contract (legal basis: performance of a contract, GDPR art. 6.1.b).
Guest ID documents— front/back photo of each guest's ID document, uploaded via the "Your bookings" portal. Collected to comply with the legal obligation to report guests to the local police via the Alloggiati Web portal (art. 109 TULPS, Italian Law Decree 59/1978) within 24 hours of arrival (legal basis: legal obligation, GDPR art. 6.1.c).
Payment data— payment happens directly on Stripe's or PayPal's secure pages: we never see or store your card number. We only receive confirmation of the payment outcome and amount (legal basis: performance of a contract).
Technical data — if a technical error occurs on the site, a monitoring tool (Sentry) automatically collects IP address, browser type and the page visited, to help us find and fix the issue (legal basis: legitimate interest, GDPR art. 6.1.f).
Who we share your data with
Your data may be shared, to the extent necessary, with:
- Stripe and PayPal, to process payments;
- Resend, to send confirmation emails and booking-portal access links;
- Cloudflare (R2) and Neon, to securely store photos and booking data;
- Vercel, which hosts the site;
- Sentry, for technical error monitoring;
- the competent local police authority, via the Alloggiati Web portal, limited to the data required by public-security law.
We never sell or share your data for third-party marketing purposes.
Data transfers outside the European Union
Some of the providers listed above (e.g. Stripe, Sentry, Vercel) may process data outside the European Economic Area. In such cases, transfers rely on Standard Contractual Clauses approved by the European Commission or equivalent GDPR safeguards.
How long we keep your data
- Booking and accounting data: up to 10 years, for tax and civil-law obligations.
- ID documents: kept only for as long as needed to fulfil the Alloggiati Web obligation, and in any case no longer than 12 months after the end of the stay, unless otherwise required by law.
- Technical data collected by Sentry: up to 90 days.
Your rights
You can request access, rectification, erasure, restriction of processing, data portability, or object to the processing of your data at any time, by writing to privacy@monteluceroccaraso.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
Providing your data
Providing your booking data and ID document is necessary: without it we cannot manage your booking or fulfil the legal obligations related to hospitality.
Changes to this policy
This policy may be updated over time, for example following changes in the law or in the services we use. The last-updated date is shown at the top of this page.