Privacy notice for Maison des Fleurs guests
Provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Last updated: October 2026 · also available in Italian
The holiday accommodation “Maison des Fleurs” (San Maurizio Canavese, Turin, Italy) processes guests’ personal data in accordance with Regulation (EU) 2016/679. The information required by Articles 13-14 GDPR is set out below.
Data controller: HI-COM S.r.l. Unipersonale, registered office in Milan, Foro Buonaparte 50 (20121), tax code and VAT no. 10413490011; operating site in San Maurizio Canavese (TO), Via Canonico Maffei 58/16 (10077). Contact: e-mail info@maisonbnb.it; certified e-mail (PEC) info@pec.maisonbnb.it. The day-to-day running of the property is entrusted to a manager appointed as data processor under Article 28 GDPR.
| Purpose | Legal basis | Notes |
|---|---|---|
| Management of the booking and the stay (accommodation contract, check-in/out, assistance, payments) | Art. 6(1)(b) (contract) | Provision of data necessary |
| Identification of guests and reporting of their details to the Police Headquarters (Questura, “Alloggiati Web” portal) and statistical surveys (ISTAT/Region) | Art. 6(1)(c) (legal obligation: Art. 109 of the Italian Consolidated Law on Public Security, TULPS) | Mandatory: without these data the stay cannot begin |
| Tax and accounting obligations | Art. 6(1)(c) | — |
| Marketing (newsletters, offers, greetings, review requests, by e-mail or WhatsApp) | Art. 6(1)(a) (consent, which may be withdrawn under Art. 7(3)); for e-mails about similar services, Art. 130(4) of the Italian Privacy Code (opt-out) | Optional |
| Protection of property and security of the premises, through outdoor video surveillance facing the entrance gates | Art. 6(1)(f) (legitimate interest) | Indicated by signs; footage kept for max. 72 hours |
Personal details and identity document details (the document is shown at check-in for the identification required by law, which takes place in person or via a live video call with a member of staff), contact details, stay details, payment data (handled by the payment service provider; the property does not store card numbers), and correspondence (e-mail, WhatsApp). Identification by video call does not involve recording the image and does not use any automated facial recognition. For minors, only the data required by public security legislation are collected. No copy of identity documents is kept beyond what is necessary for transmission to Alloggiati Web.
The data are processed by authorised staff of the property manager and disclosed to: the platform managing bookings, check-in and access (processor under Art. 28); the cloud service providers hosting the property’s direct booking system (processors under Art. 28); the payment service provider; the tax advisory firm and the administration company (processors under Art. 28); and, as independent controllers, the Police Headquarters (Alloggiati Web), statistical bodies, the booking platforms used by the guest and the messaging service provider. The list of processors is available on request. The data are not made public.
The data are stored in Italy/the EU; some providers (cloud services of the platform and of the booking system, payments, messaging) may transfer data outside the EU with the safeguards of Chapter V GDPR (adequacy decisions, standard contractual clauses). Retention: accommodation contract and accounting records 10 years; incomplete online booking requests (payment not completed), with the related IP address, max. 30 days; Alloggiati Web receipts 5 years; WhatsApp messages max. 12 months; video surveillance footage max. 72 hours; marketing data until consent is withdrawn.
You may at any time exercise the rights under Articles 15-22 GDPR (access, rectification, erasure, restriction, portability, objection — including to direct marketing — and withdrawal of consent under Art. 7(3)) by writing to the contact details above; the controller will reply within one month (Art. 12(3)), which may be extended by two further months for complex requests, with reasons given. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali,www.garanteprivacy.it). No automated decision-making or profiling is carried out.
With the guest’s optional consent, the property may send newsletters, offers, greetings and review requests by e-mail or WhatsApp. Consent may be withdrawn at any time (unsubscribe link in e-mails; reply “STOP” on WhatsApp; or by writing to the controller’s contact details), with no consequences for the stay. Without consent, the Company may still send e-mails about services similar to those already purchased under Art. 130(4) of the Italian Privacy Code, with the option to object in every message.
The maisonbnb.it website presents the property and allows direct booking through the property’s booking system (prenota.maisonbnb.it), hosted on cloud services (Laravel Cloud for the application, Supabase for the database; processors under Art. 28). To book, we ask for first and last name, e-mail, mobile number, dates of stay, number of guests (with the age range of any children), whether you are bringing a dog and any extra services; billing details only if you request an invoice. The IP address is recorded for security and abuse prevention. Payment takes place on Stripe’s secure page (payment service provider, independent controller), to which the system only sends the e-mail address, amount and booking references: the property neither receives nor stores card data. The confirmed booking is recorded in the management platform (processor under Art. 28), which sends the check-in e-mail and handles the collection of documents, the accommodation contract and legal reporting. The booking system only uses technical cookies (session and security). The website uses no analytics or marketing tools. Apart from strictly necessary technical cookies, it loads only one piece of third-party content, the Google Maps map on the Location page, and only with the consent given through the banner shown on the first visit (Italian Data Protection Authority guidelines of 10/06/2021): if you close the banner or choose “Decline”, the map is not loaded and no data are sent to Google. Your choice is stored in a technical cookie for 6 months and can be changed at any time via the “Cookie preferences” link in the footer. Google map: when the map is loaded, the visitor’s browser connects to Google’s servers (Google Ireland Limited, with possible transfers to Google LLC in the USA, which participates in the EU-US Data Privacy Framework), which receive the IP address and the technical data of the request and may set their own cookies, according to Google’s privacy policy (policies.google.com/privacy). The “Get directions to Maison des Fleurs” button opens Google Maps only when the visitor requests it. Fonts are served from the website’s own server, with no connection to Google Fonts. The property’s National Identification Code (CIN) is displayed on the website and in listings under Art. 13-ter of Decree-Law 145/2023. The data entered when booking are processed to handle the request and the contract (Art. 6(1)(b)) and to meet legal obligations (Art. 6(1)(c)); retention and rights as above. Hosting on servers in the European Union.
This notice may be updated: the version in force is the one published on maisonbnb.it. Last updated: October 2026. In case of discrepancy, the Italian version prevails.
This website only uses technical cookies. With your consent we also show the Google Maps map on the Location page: Google may collect browsing data and use its own cookies. Privacy notice