top of page

Privacy Policy

​

PRIVACY POLICY

Website: www.livignostays.com Data Controller: Villa Dei Fiori S.R.L. Last updated: 3 September 2025

1. INTRODUCTION

Villa Dei Fiori S.R.L. ("Livigno Stays", "we", "us", "our") is committed to protecting the privacy and personal data of visitors to our website www.livignostays.com (the "Website"), our guests, property owners, and other individuals who interact with our services.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, how long we keep it, and what rights you have regarding your personal data. This Policy is issued in accordance with Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR") and applicable Italian data protection legislation (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018, the "Privacy Code").

By using the Website or our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Policy, please do not use the Website or provide us with your personal data.

2. DATA CONTROLLER

The Data Controller responsible for the processing of your personal data is:

For any question or request regarding the processing of your personal data, you may contact us using the details above.

3. WHAT PERSONAL DATA WE COLLECT

Depending on how you interact with us, we may collect the following categories of personal data:

3.1 Data you provide directly

  • Identity data: first name, last name, date of birth, gender, nationality;

  • Contact data: email address, phone number, postal/billing address;

  • Identification documents: passport or ID card details, where required by Italian law for tourist accommodation registration (Pubblica Sicurezza);

  • Booking data: check-in/check-out dates, number of guests, Property selected, special requests;

  • Payment data: billing details, payment card information (processed by our secure payment processor; we do not store full card numbers on our own servers);

  • Communication data: content of emails, messages, or phone calls exchanged with us, including complaints or feedback;

  • Account data: username and password, if you create an account on the Website;

  • Owner data (for Property Owners): fiscal code/VAT number, bank details for payouts, property ownership and registration documents, CIR/CIN codes.

3.2 Data collected automatically

  • Technical data: IP address, browser type and version, device type, operating system, time zone setting;

  • Usage data: pages visited, time spent on the Website, referral source, click patterns;

  • Cookies and similar technologies: as described in our separate Cookie Policy.

3.3 Data from third parties

  • Booking and payment data received from third-party platforms (e.g., Booking.com, Airbnb, Vrbo/Expedia) when you book through those channels;

  • Data received from payment processors confirming successful transactions;

  • Publicly available information, where relevant (e.g., for fraud prevention purposes).

We do not knowingly collect special categories of personal data (such as health data, religious beliefs, or racial/ethnic origin) unless voluntarily provided by you (for example, to communicate a dietary requirement, mobility need, or allergy relevant to your stay), in which case such data is processed only for the specific purpose you provided it for and with appropriate safeguards.

4. HOW AND WHY WE USE YOUR DATA (PURPOSES AND LEGAL BASIS)

PurposeLegal basis (GDPR Art. 6)

Processing and managing your Booking, including payment collection and confirmationPerformance of a contract (Art. 6(1)(b))

Registering guests with local authorities as required by Italian public security lawCompliance with a legal obligation (Art. 6(1)(c))

Calculating and remitting the local tourist tax ("imposta di soggiorno")Compliance with a legal obligation (Art. 6(1)(c))

Issuing invoices and complying with tax/accounting obligationsCompliance with a legal obligation (Art. 6(1)(c))

Communicating with you about your Booking (confirmations, check-in instructions, support)Performance of a contract (Art. 6(1)(b))

Managing the relationship with Property Owners, including payouts and reportingPerformance of a contract (Art. 6(1)(b))

Responding to inquiries, complaints, and customer support requestsLegitimate interest (Art. 6(1)(f)) / Performance of a contract

Sending marketing communications, newsletters, and promotional offersConsent (Art. 6(1)(a)), where required, or legitimate interest for existing customers regarding similar services

Improving and analyzing use of the Website (analytics)Consent (for non-essential cookies) or legitimate interest

Preventing fraud, misuse, and ensuring Website securityLegitimate interest (Art. 6(1)(f))

Enforcing these Terms and Conditions, handling disputes or damage claimsLegitimate interest (Art. 6(1)(f)) / Performance of a contract

Complying with requests from judicial, tax, or law enforcement authoritiesCompliance with a legal obligation (Art. 6(1)(c))

Where we rely on your consent (for example, for marketing emails or non-essential cookies), you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal, using the methods described in Section 9 below.

5. WHO WE SHARE YOUR DATA WITH

We do not sell your personal data. We may share your personal data with the following categories of recipients, only to the extent necessary for the purposes described above:

  • Property Owners: relevant Booking details necessary to prepare the Property and manage your stay;

  • Payment processors and banks: to process payments, refunds, and security deposits securely;

  • IT and hosting providers: companies that host the Website, our booking system, and our databases;

  • Booking platforms/OTAs: where your Booking originates from or is also listed on a third-party platform (e.g., Booking.com, Airbnb);

  • Cleaning, maintenance, and concierge service providers: where necessary to prepare the Property or fulfill requested services;

  • Professional advisors: accountants, auditors, and legal counsel, where necessary;

  • Public authorities: local police (Questura), municipal authorities, and tax authorities, where required by Italian law (e.g., guest registration, tourist tax reporting);

  • Marketing and analytics providers: where you have consented to marketing or analytics cookies;

  • Judicial or regulatory authorities: where required to comply with a legal obligation, court order, or to protect our rights, property, or safety, or that of others.

All third parties who process personal data on our behalf are required to do so under a data processing agreement, in accordance with Article 28 GDPR, and are contractually bound to implement appropriate technical and organizational security measures and to use the data only for the agreed purposes.

6. INTERNATIONAL DATA TRANSFERS

Your personal data is primarily processed within the European Economic Area ("EEA"). However, some of our service providers (for example, certain cloud hosting, analytics, or payment providers) may be located outside the EEA, including in the United States or other third countries.

Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place, such as:

  • An adequacy decision issued by the European Commission recognizing the destination country as providing an adequate level of data protection; or

  • Standard Contractual Clauses ("SCCs") approved by the European Commission, together with supplementary measures where necessary; or

  • Other legally recognized transfer mechanisms under Chapter V of the GDPR.

You may request further information about the safeguards applied to international transfers by contacting us at contact@livignostays.com.

7. DATA RETENTION

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. As a general guide:

Data categoryRetention period

Booking and guest registration data (incl. ID documents)Duration of the stay plus the period required by Italian public security and tax law (generally up to 10 years for accounting/fiscal records)

Invoices and accounting records10 years, in accordance with Italian civil and tax law

Payment dataRetained by our payment processor in accordance with PCI-DSS requirements; we do not retain full card data

Marketing consent and communication preferencesUntil you withdraw consent or unsubscribe, plus a reasonable period to record the withdrawal

Website analytics/cookie dataAs specified in our Cookie Policy (typically 6–26 months depending on the cookie)

Account dataUntil account deletion is requested, or after a period of inactivity, subject to legal retention obligations

Complaints, disputes, and damage claimsDuration of the matter plus the applicable statute of limitations under Italian law

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized.

8. DATA SECURITY

We implement appropriate technical and organizational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including:

  • Encryption of data in transit (e.g., HTTPS/TLS) and, where appropriate, at rest;

  • Use of PCI-DSS-compliant payment processors;

  • Access controls limiting personal data access to authorized personnel on a need-to-know basis;

  • Regular review of our security practices and provider agreements;

  • Staff training on data protection obligations.

While we take reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected individuals, in accordance with Articles 33 and 34 GDPR.

9. YOUR RIGHTS

Under the GDPR, you have the following rights in relation to your personal data:

  • Right of access (Art. 15): to obtain confirmation of whether we process your data, and a copy of that data;

  • Right to rectification (Art. 16): to request correction of inaccurate or incomplete data;

  • Right to erasure ("right to be forgotten") (Art. 17): to request deletion of your data, subject to certain legal exceptions (e.g., fiscal record-keeping obligations);

  • Right to restriction of processing (Art. 18): to request that we limit the processing of your data in certain circumstances;

  • Right to data portability (Art. 20): to receive your data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller, where technically feasible;

  • Right to object (Art. 21): to object to processing based on legitimate interest or for direct marketing purposes, at any time;

  • Right to withdraw consent (Art. 7(3)): where processing is based on consent, at any time, without affecting prior lawful processing;

  • Right to lodge a complaint: with the competent supervisory authority (see Section 12 below).

To exercise any of these rights, please contact us at contact@livignostays.com. We will respond to your request within one month, in accordance with Article 12 GDPR (this period may be extended by two further months for complex requests, in which case we will inform you of the reasons for the delay). We may need to verify your identity before processing your request.

10. COOKIES

The Website uses cookies and similar tracking technologies. Details on the types of cookies we use, their purpose, duration, and how you can manage your preferences (including via the cookie consent banner) are set out in our separate Cookie Policy, available on the Website.

11. CHILDREN'S PRIVACY

The Website and our services are not directed at individuals under the age of 18, and we do not knowingly collect personal data from minors without appropriate parental/guardian consent, except where such data is provided by a parent or legal guardian in connection with a family Booking (e.g., names and ages of minor guests for occupancy purposes). If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will take steps to delete such data.

12. SUPERVISORY AUTHORITY

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the Italian Data Protection Authority:

This is without prejudice to any other administrative or judicial remedy available to you.

13. AUTOMATED DECISION-MAKING AND PROFILING

We do not use your personal data for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, without your explicit consent or another applicable legal basis. Standard analytics and marketing tools we use for website personalization do not involve decisions with legal or similarly significant effects.

14. LINKS TO THIRD-PARTY WEBSITES

The Website may contain links to third-party websites (e.g., booking platforms, payment providers, social media). This Privacy Policy does not apply to those third-party websites, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party website you visit.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The updated version will be posted on this page with a revised "Last updated" date. Where changes are material, we will provide additional notice (e.g., via email or a prominent notice on the Website) where appropriate. We encourage you to review this Policy periodically.

16. CONTACT US

For any questions, requests, or concerns regarding this Privacy Policy or the processing of your personal data, please contact:

​

bottom of page