Information on the processing of personal data
Last updated, 6 October 2026 · Version 1.0
In case of any difference, the Italian version prevails.
This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, to those who visit the website bnbbergamo.it and those who contact us for information or an availability request.
1. Data controller
Antonio Farhat, owner of the Bed and Breakfast Bergamo property
Tax code FRHNTN77H06D969M
Via Ghislanzoni 16, 24122 Bergamo
Phone and WhatsApp 334 941 8796
Email info@bnbbergamo.it
The Controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 of the GDPR are not met.
2. What data we process, why, and on what legal basis
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| “Request availability” form | First and last name, phone number, email (optional), chosen apartment, arrival and departure dates, number of guests, text of the message | To reply to the request and check the availability of the apartments | Art. 6.1.b GDPR, pre-contractual measures at the request of the data subject | 24 months from the last contact, then deletion |
| Direct contact (WhatsApp, phone, email) | Phone number, email address, content of the conversation | To manage the enquiry, the booking and the stay | Art. 6.1.b GDPR | 24 months from the last contact |
| Guest registration | Identity document details of the guests staying | Communication to the local police headquarters (Questura) (Art. 109 TULPS, the Italian Consolidated Act on Public Security Laws) and tourist tax obligations | Art. 6.1.c GDPR, legal obligation | The periods set by public security and tax legislation |
| Server technical logs | IP address, date and time, page requested, browser type | Security, diagnostics and operation of the site | Art. 6.1.f GDPR, legitimate interest in the security of the systems | Maximum 30 days, unless unlawful acts are being investigated |
| Anti-spam protection for the form | Encrypted fingerprint (hash) of the IP address, from which the IP address cannot be recovered | To limit automated submissions and abuse of the form | Art. 6.1.f GDPR, legitimate interest in a properly working service | 1 hour |
| Google map (optional) | IP address and device data, transmitted to Google when the map loads | To show where the apartments are located | Art. 6.1.a GDPR, explicit consent given by pressing the button | See Google's policies, the site stores nothing |
What we do not do
- We do not use statistics or traffic analysis tools, neither Google Analytics nor any other.
- We do not use advertising pixels, and we do not carry out profiling or remarketing.
- Fonts are hosted on our own server, so no data is sent to Google Fonts while you browse.
- We do not send newsletters, and we do not transfer or sell data to third parties.
- No automated decision-making within the meaning of Article 22 of the GDPR takes place.
3. Nature of providing the data
The data marked as mandatory in the form, that is name, phone number, apartment, arrival and departure dates, number of guests and consent to the notice, are needed so that we can reply to you and check availability. Without that data we are unable to get back to you. Email and message are optional and only help us prepare a better reply.
4. WhatsApp
If you choose to write to us on WhatsApp, the conversation takes place on the platform of WhatsApp Ireland Limited, under the rules of its privacy notice. The site only contains the link that opens the app, and loads nothing from WhatsApp until you press it.
5. Recipients of the data
The data is processed by the Controller and the persons he authorises. The following parties may become aware of it as processors appointed under Article 28 of the GDPR.
- The hosting service provider for the domain and for the mailbox that receives the form requests, with servers in Italy. Company name being verified, it will be stated here before final publication.
- Google Ireland Limited, for the map, if you choose to load it.
- All Service Web Agency, for the technical maintenance of the site.
- The booking portals on which the apartments are listed, limited to bookings made through them, as independent controllers.
The data is not disseminated. It may be disclosed to the local police headquarters (Questura), the judicial authorities or the police when required by law.
6. Transfers outside the EU
Loading the Google map may involve a transfer of data to the United States. The transfer takes place on the basis of the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, and, failing that, on the basis of the standard contractual clauses approved by the Commission. If you prefer to avoid this transfer altogether, do not press the map button and use the link that opens Google Maps only when you decide, or write to us.
7. How we protect the data
The site is served exclusively over an encrypted HTTPS connection. The form does not save requests to disk, it only forwards them to the property's mailbox. Access to the mailbox is protected by personal credentials. We adopt technical and organisational measures appropriate to the risk, pursuant to Article 32 of the GDPR.
8. Your rights
At any time you can exercise the rights provided for in Articles 15 to 22 of the GDPR.
- access to your data and to information about the processing (Art. 15)
- rectification of inaccurate or incomplete data (Art. 16)
- erasure of data, the so-called right to be forgotten (Art. 17)
- restriction of processing (Art. 18)
- data portability, in a format readable by an automated device (Art. 20)
- objection to processing based on legitimate interest (Art. 21)
- withdrawal of consent at any time, without affecting the lawfulness of the processing carried out before withdrawal (Art. 7.3)
To exercise them, write to info@bnbbergamo.it or call 334 941 8796. We reply within one month of the request, as provided for by Article 12 of the GDPR.
9. Complaint to the supervisory authority
If you believe that the processing of your data breaches the law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, garanteprivacy.it, or to bring proceedings before the judicial authority.
10. Cookies
The site does not use profiling cookies and does not store anything on your device. The details are in the cookie policy.
11. Changes
The Controller may update this notice. The version in force is always the one published on this page, with the date of the update shown at the top.