Privacy Policy
Last updated: 01/10/2026
This notice explains how Sophia Boutique Suites processes the personal data of website visitors and of people who contact us, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR").
1. Data controller
Sophia Boutique Suites
Email: info@sophiaboutiquesuites.it
Phone: +39 040 9570801
2. Data processed and purposes
- Enquiries and quotes — name, email, phone, stay dates, number of guests and message sent through the contact form, by email, phone or WhatsApp. Purpose: to answer and handle your request. Legal basis: pre-contractual measures at your request (Art. 6.1.b GDPR).
- Bookings — online bookings are handled by an external booking system acting as data processor. Legal basis: performance of a contract (Art. 6.1.b) and legal obligations, including reporting guest details to the Italian police authorities (Art. 109 TULPS) and tax requirements (Art. 6.1.c).
- Handling your enquiry and quotes — our staff follows up by email, phone or WhatsApp (in that case the message goes through WhatsApp/Meta servers, an independent controller). Quotes and confirmations may also be shared through a personal page reachable from a private link: we record whether and when you open it, to know the offer reached you. Legal basis: pre-contractual measures and performance of a contract (Art. 6.1.b).
- Enquiry source — when you send an enquiry we record the campaign or website you came from (UTM parameters and similar) to assess our marketing. Legal basis: legitimate interest (Art. 6.1.f).
- Internal statistics — we measure site visits in aggregate form (pages viewed, source, device type) with our own system that uses no cookies and does not store IP addresses: each visitor is represented by a pseudonymous code derived from IP address and browser with a key that changes daily and is never stored, so it cannot be traced back to a person. Legal basis: legitimate interest in improving the site (Art. 6.1.f). Data is kept for 25 months.
- Technical browsing data — IT systems collect data implicit in Internet protocols (e.g. IP address, server logs), used for security and proper operation of the site and kept only as long as necessary.
3. Retention
Enquiries are kept for 24 months from the last activity (for confirmed bookings, from departure); after that, name, contact details and messages are anonymised automatically and only statistics remain (dates, outcome, campaign). Backup copies are kept for a further limited period. Data about completed stays is kept for the periods required by tax and public-security law.
3b. Providing your data
Name, email and message are needed to answer your enquiry: without them we cannot handle it. Everything else is optional. Cookie consent is never required to use the site or send an enquiry.
4. Recipients
Data may be processed by suppliers acting as data processors: website hosting and maintenance, email services, web fonts served by Bunny Fonts (BunnyWay d.o.o., EU: receives the IP address only), spam protection of the forms and the chatbot with Google reCAPTCHA (Google Ireland Ltd.: receives the IP address and page-interaction data), booking system (Beddy). Maps are provided by Google Maps (Google Ireland Ltd.) and load when you open a page that contains them: Google receives your IP address and may set its own cookies, as described in the Cookie Policy. Data is not disclosed to the public.
5. Your rights
You may at any time request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest (Arts. 15-22 GDPR) by writing to info@sophiaboutiquesuites.it. You may withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the authority of your country.