top of page

PRIVACY POLICY

Website: https://www.letstay.it
Last updated: 21/07/2026
Effective date 21/07/2026​
​
Provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018 ("Privacy Code").
​
Letstay S.r.l. attaches great importance to the protection of personal data and ensures its processing in compliance with the principles of lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, integrity, and confidentiality (Art. 5 GDPR). This privacy policy describes the methods and purposes by which we process the personal data of users who browse the website, request information, or conclude a contract with us.
​
1. Data Controller
The Data Controller is Letstay S.r.l., with registered office at Via Principe Nicola 76, 95126 Catania (CT), Italy.
(hereinafter, the "Data Controller").
​
2. Data Protection Officer (DPO)
For the activities carried out, the appointment of a Data Protection Officer is not mandatory pursuant to Art. 37 of the GDPR. For any issue relating to data processing, the data subject may contact the Data Controller directly using the contact details provided above.
​
3. Categories of Processed Data and Source
In the context of relations with users, the Data Controller may process the following categories of personal data:
  • Personal and identification data (name, surname, and, where required for guest registration, date and place of birth, citizenship);
  • Contact data (email address, phone number, physical address);
  • Data contained in identity documents, necessary for guest registration and communication to the Public Security Authority;
  • Booking and stay data (dates, number and composition of the guest group, any special requests or preferences);
  • Payment data, usually managed through payment service providers; the Data Controller does not retain complete data of payment instruments except where strictly necessary;
  • Navigation data and cookies (e.g., IP address, system logs, technical identifiers), as detailed in the Cookie Policy.
Data is usually provided directly by the data subject. However, some data may be collected from third parties, particularly through tourist intermediation platforms (OTAs) through which the booking is made.
As a rule, the Data Controller does not process special categories of personal data (Art. 9 GDPR). Users are advised not to communicate such data unless strictly necessary.
​
4. Purposes, Legal Bases, and Retention Periods

Personal data is processed for the purposes and on the legal bases indicated below:

a) Responding to user requests

  • Purpose: Responding to requests for information and quotes received via the website (e.g., contact form).

  • Legal Basis: Art. 6.1.b (GDPR) – execution of pre-contractual measures requested by the data subject.

  • Retention Period: Time necessary to process the request; in the absence of a subsequent booking, no longer than 12 months.

b) Contract execution

  • Purpose: Conclusion and execution of the contract (booking, lease, ancillary services, check-in, stay assistance, and payment management).

  • Legal Basis: Art. 6.1.b (GDPR) – execution of a contract.

  • Retention Period: Duration of the relationship and, for administrative-accounting purposes, 10 years from its conclusion (Art. 2220 Italian Civil Code).

c) Legal obligations

  • Purpose: Compliance with legal obligations: communication of guest data to the Public Security Authority via the "Alloggiati Web" portal (Art. 109 T.U.L.P.S., R.D. 773/1931); statistical communications to regional tourism bodies; tax and accounting obligations.

  • Legal Basis: Art. 6.1.c (GDPR) – compliance with a legal obligation.

  • Retention Period: Terms required by individual regulations (generally 10 years for tax documentation).

d) Assistance and complaints

  • Purpose: Assistance and complaint management.

  • Legal Basis: Art. 6.1.b (execution of a contract) and/or Art. 6.1.f (legitimate interest in providing adequate support services).

  • Retention Period: Duration of the relationship and subsequent limitation periods.

e) Direct marketing

  • Purpose: Sending promotional communications and newsletters regarding the Data Controller's services (direct marketing).

  • Legal Basis: Art. 6.1.a (GDPR) – consent. For current customers only, and limited to services similar to those already provided, Art. 130, para. 4 of the Privacy Code ("soft opt-in") applies.

  • Retention Period: Until consent is withdrawn or opposition is made (opt-out), with periodic verification of updates.

f) Reviews and surveys

  • Purpose: Collection of reviews and customer satisfaction surveys.

  • Legal Basis: Art. 6.1.a (consent) or Art. 6.1.f (legitimate interest in improving services).

  • Retention Period: Until consent is withdrawn or opposition is made.

g) Defense of legal claims

  • Purpose: Establishment, exercise, or defense of legal claims.

  • Legal Basis: Art. 6.1.f (GDPR) – legitimate interest.

  • Retention Period: Duration of the dispute and related limitation and appeal periods.

h) Cookies and tracking tools

  • Purpose: Installation of cookies and tracking tools (see Cookie Policy).

  • Legal Basis: Technical cookies: Art. 6.1.f (legitimate interest); Non-technical cookies: Art. 6.1.a (consent, pursuant to Art. 122 Privacy Code).

  • Retention Period: As indicated in the Cookie Policy.

The legitimate interest underlying the processing referred to in letters d), f), and g) has been assessed by the Data Controller as prevailing and not detrimental to the rights and freedoms of the data subject; the right to object under Art. 21 of the GDPR remains applicable in all cases.

​
5. Nature of Data Provision
  • The provision of data for purposes a), b), c), and d) is mandatory: refusal to provide it makes it impossible to fulfill the request, conclude and execute the contract, or comply with legal obligations.
  • The provision of data for purposes e) and f) is optional: refusal or subsequent withdrawal does not in any way prejudice the ability to use our services. Consent for marketing is free, specific, and revocable at any time.
​
6. Processing Methods
Processing is carried out using IT and, where necessary, paper-based tools, adopting adequate technical and organizational measures to ensure a level of security appropriate to the risk (Art. 32 GDPR). This protects the confidentiality, integrity, and availability of data, preventing its loss, unauthorized access, and unlawful use. Data is processed exclusively by authorized and trained personnel.
​
7. Categories of Recipients
Personal data may be communicated, within the limits and for the purposes indicated above, to:
  • Authorized subjects (personnel and collaborators of the Data Controller, trained pursuant to Art. 29 GDPR);
  • Data Processors designated pursuant to Art. 28 GDPR, such as IT, hosting, and cloud service providers, booking software and channel manager operators, tourist intermediation platforms (OTAs), payment service providers, consultants (e.g., accountants), email marketing, and statistical analysis service providers;
  • Public bodies to which communication is required by law (in particular, the Public Security Authority, the Revenue Agency, and competent tourism authorities);
  • Judicial authorities, where necessary to establish or defend a legal claim.
The updated list of Data Processors is available upon request. The data is not disseminated nor sold to third parties for their own purposes.
​
8. Data Transfer to Third Countries
Data is generally processed within the European Union / European Economic Area. If certain suppliers (e.g., cloud, analytics, or email marketing services) involve a transfer to third countries, the Data Controller ensures that it occurs in compliance with Chapter V of the GDPR, namely:
  • In the presence of an adequacy decision by the European Commission (for certified US operators, the EU-US Data Privacy Framework, currently in force); or
  • On the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular the Standard Contractual Clauses set out in Implementing Decision (EU) 2021/914, supplemented, where necessary, by additional measures; or, failing that, within the limits of the derogations under Art. 49 GDPR.
The data subject may request a copy of the safeguards adopted by contacting the Data Controller.
​
9. Data Subject's Rights
The data subject has the right to:
  • Access their personal data (Art. 15);
  • Obtain its rectification (Art. 16);
  • Obtain its erasure ("right to be forgotten", Art. 17);
  • Obtain the restriction of processing (Art. 18);
  • Receive data in a structured, commonly used, and machine-readable format, and obtain its portability to another controller (Art. 20);
  • Object to the processing (Art. 21), at any time and without the need for justification when it comes to direct marketing;
  • Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7, para. 3);
  • Not be subject to a decision based solely on automated processing (Art. 22).
Requests can be sent to the address info@letstay.it. The Data Controller responds without undue delay and, in any case, within one month of the request, a deadline that can be extended by two months in case of particular complexity.
Complaint. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia n. 11, 00187 Rome – www.garanteprivacy.it), without prejudice to any other administrative or judicial remedy.
​
10. Automated Decision-Making and Profiling
The Data Controller does not carry out processing based solely on automated decision-making processes that produce legal effects concerning the data subject or similarly significantly affect them pursuant to Art. 22 GDPR.
​
11. Minors' Data
The services are not intended for minors under 14 years of age (Art. 8 GDPR and Art. 2-quinquies Privacy Code). The data of any minors is processed exclusively as part of a booking made by an adult, who assumes full responsibility for it.
​
12. Cookies and Tracking Tools
The website uses cookies and other tracking tools as described in the Cookie Policy, complying with the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority on June 10, 2021. Non-technical cookies are installed only with the user's prior consent, freely given and revocable at any time via the cookie banner and the preference panel.
 
13. Changes to this Privacy Policy
The Data Controller reserves the right to update this privacy policy to adapt it to regulatory or organizational changes. The updated version is published on this page indicating the date of the last update. Substantial changes are brought to the attention of data subjects by appropriate means; where the processing is based on consent, the introduction of new purposes will be preceded by the collection of specific, new consent.
bottom of page