1. Data Controller
The Data Controller is MoreBnB Salento, registered office at Vico dei Cirioli 6, 73037 Poggiardo (LE), Italy. CIN IT075061C200070728.
Email: morebnb.salento@gmail.com
The Controller operates as a private individual (non-professional tourist rental), with no Italian VAT number (Partita IVA).
2. Data we collect
We collect the data you give us directly through the enquiry form and WhatsApp contact: first and last name, email, phone number, stay dates, special requirements. For all adult guests Italian law (T.U.L.P.S. art. 109) requires us to record an ID document, which is transmitted to the local police authority.
Automatically, our hosting provider records technical server logs (IP address, timestamp, browser type) for security and diagnostics.
3. Purposes and legal basis
(a) To manage your booking and stay — basis: contract performance; (b) to fulfil legal obligations (guest registration, invoicing, tourist tax) — basis: legal obligation; (c) to reply to your email/WhatsApp messages — basis: legitimate interest.
4. Retention
Booking data is kept for 10 years per Italian tax law. Copies of ID documents are deleted within 24 hours of check-in after transmission to the police authority.
5. Sharing and hosting
Your data may be shared with: booking platforms (only if you book via Airbnb / Booking.com), the Italian electronic invoicing system (Agenzia delle Entrate), and the local police authority for the mandatory guest registration.
Digital data is stored on infrastructure with servers located in the European Union: a database managed via Supabase (EU region) and application hosting on Vercel. These providers act as data processors.
6. Your rights
Under GDPR articles 15-22 you have rights of access, rectification, erasure, restriction, portability, objection. Exercise them at morebnb.salento@gmail.com. You can also lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
7. Transfers outside the EEA
We do not transfer your data outside the EEA. Booking platforms may do so independently as separate controllers — refer to their policies.