Who is the data controller
The controller is ABC SRLS, trading as «Abitare Affitti Brevi».
- Registered office: Via Padre Semeria 25, 18038 Sanremo (IM)
- VAT number and tax code: 01783410085
- Email: abcsrls2023@gmail.com
- Certified email (PEC): abcsrls2023@pec.it
- Phone: +39 0184 189 1740
For any privacy question, you can write to us at these addresses.
What data we process
- Contact details: name, email, phone, preferred language, when you fill in a form or write to us.
- Stay details: dates, number of adults and children, chosen home, special requests, amounts and payments.
- Payment data: amount, outcome and transaction references, card type and last digits that Nexi passes on to us. We do not receive or store the full card number.
- Identity document data of guests, collected through the online check-in because the law requires it.
- Billing details, if you ask for an invoice.
- Owners' data: contact details, town and features of the home, and after signing the contract the data needed for payments and tax obligations.
- Applicants' data: contact details, role or town of interest, experience, LinkedIn profile if you provide it.
- Technical browsing data: IP address and browser information, logged by the servers for security and to run the website.
- Usage statistics with Microsoft Clarity, only if you consent.
We don't ask for sensitive data. If you include it in a message on your own initiative, we only use it to reply to you.
Why we process it and on what legal basis
Stay requests and quotes
To reply to you, check availability and send you a quote. Legal basis: pre-contractual steps taken at your request (art. 6(1)(b) of EU Regulation 2016/679, «GDPR»).
Bookings and stays
To manage the booking, your arrival, support during the stay, payments and invoicing. Legal basis: performance of the contract (art. 6(1)(b) GDPR).
Direct bookings on the website and payment
To hold the dates, collect payment through Nexi, send you the confirmation and receipt, and handle cancellations and refunds. Legal basis: performance of the contract (art. 6(1)(b) GDPR). To prevent payment fraud: our legitimate interest (art. 6(1)(f) GDPR).
Offers and news by email
Only if you choose it at checkout (the box is optional and never pre-ticked): we occasionally send you offers and news from Abitare. Legal basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time using the link in every email or by writing to us. If you don't give consent, your booking is not affected.
Owners' enquiries
To get back to you, assess your home and propose our management. Legal basis: pre-contractual steps taken at your request (art. 6(1)(b) GDPR). After signing, the management contract.
Applications
To assess your application as a collaborator or partner. Legal basis: pre-contractual steps taken at your request (art. 6(1)(b) GDPR).
Legal obligations
To report guests' details to the police (Questura) through the Alloggiati Web service (article 109 of the Italian Consolidated Public Security Act), for the tourist tax owed to the town, for mandatory statistical reporting on tourist flows and for tax and accounting obligations. Legal basis: legal obligation (art. 6(1)(c) GDPR). Without this data we cannot host you.
Website security and spam prevention
To protect the website and forms from abuse (technical logs, hidden anti-spam field, sending limits). Legal basis: our legitimate interest (art. 6(1)(f) GDPR).
Website usage statistics
To understand, in aggregate form, how to improve the website with Microsoft Clarity. Legal basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time. Details are in the cookie policy.
Website forms
Each form only asks for the data needed for that request. Before sending, we ask you to confirm you have read this policy: we record the version you read (currently 2026-10).
Data travels encrypted (HTTPS) and never appears in the page address. It goes directly to the management system we use.
In the direct booking checkout we record, with date and time, the version of the booking terms you accepted, the version of this policy you read and your separate, optional choice about offer emails. You enter your card details only on Nexi's page.
How long we keep it
- Requests without a booking and owners' enquiries without a contract: up to 24 months from the last contact, then we delete them.
- Booking, contract and invoice data: 10 years, as Italian law requires for accounting records (art. 2220 of the Civil Code).
- Consent to offer emails: until you withdraw it; after withdrawal we keep only proof of the consent and of its withdrawal.
- Guests' identity documents: only for the time needed for police reporting and related obligations.
- Applications: up to 24 months, unless you ask us to delete them sooner.
- Server technical logs: for a short period, unless needed to investigate abuse.
- Microsoft Clarity statistics: according to the service settings, for at most 13 months.
Who we share it with
- The management system we use (Abitare OS), software owned by Federico Aresio and licensed for use to ABC SRLS, hosted on servers in the European Union.
- Booking platforms (for example Airbnb or Booking.com): only for bookings made on those platforms, which remain controllers of the data they collect.
- Nexi Payments S.p.A., the payment service provider for direct bookings: it receives your card details directly from you and processes them as an independent controller, under its own privacy policy, including for anti-money-laundering and anti-fraud obligations.
- Technical providers who help us run the service (hosting, email, payments, signature or communication tools), appointed as processors.
- Authorised collaborators (check-in, cleaning, maintenance), only for strictly necessary data.
- Public authorities: police, the town council, the Italian Revenue Agency and other bodies, when required by law.
- Advisers (accountant, legal advisers), bound by confidentiality.
- Microsoft, for Clarity, only with your consent.
We don't sell or hand over your data to third parties for commercial purposes.
Transfers outside the European Union
We store data in the European Union. Some providers, such as Microsoft for Clarity, may also process it in the United States: in that case the transfer is based on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.
No advertising profiling
We don't use your data for targeted advertising and we don't take decisions based solely on automated processing that have legal effects on you. Dynamic prices for the homes depend on dates, season and demand, not on who you are.
Your rights
At any time you can ask us to:
- access your data and receive a copy;
- correct or complete it;
- erase it, when we are not required by law to keep it;
- restrict its processing;
- receive it in a machine-readable format (portability);
- object to processing based on our legitimate interest;
- withdraw your consent, without affecting processing carried out before.
Write to abcsrls2023@gmail.com or to our certified email abcsrls2023@pec.it. We reply without delay and in any case within one month. For statistics you can also change your cookie preferences.
Complaints to the supervisory authority
If you believe the processing of your data breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): garanteprivacy.it. If you live in another EU country, you can also contact your national authority.
Changes to this policy
This is version 2026-10. If we change the policy significantly, we update the version and date at the top of the page and, where needed, ask for your consent again.