Boemondo House

The charm of stone vaults in the historic center of Lecce

CIN: IT075035C200130026
CIR: LE075035C200130026

+39 347 6517950

+39 347 6517950

Information on the processing of personal data

Pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) and the applicable Italian legislation on the protection of personal data, this information describes the methods by which the personal data of users who consult the website are processed. www.boemondohouse.it, require information or submit a booking request at Boemondo House.

Last update: 15 September 2026

1. Data controller

The data controller is:

Francesca Zippo – Boemondo House
Address: Vico Boemondo 16, 73100 Lecce – Italy
Email: amministrazione@boemondohouse.it

For any question regarding the processing of personal data or to exercise your rights, you can contact the controller using the e-mail address indicated above.

No Data Protection Officer (DPO) has been appointed, unless such appointment is mandatory in relation to the nature and size of the activity carried out.

2. Types of data processed

The following categories of personal data can be processed through the website.

Data provided through the booking or contact form

Depending on the fields filled in, the following can be collected:

  • name and surname;
  • email address;
  • phone number;
  • dates requested for the stay;
  • number and type of guests;
  • any requested services;
  • requests, preferences and information entered voluntarily in the field reserved for messages;
  • information necessary for administrative management and the payment of the reservation.

The user is asked not to enter unnecessary information in the free fields, data belonging to particular categories, health information or copies of identity documents.

Data related to guests

Following the booking, the necessary data may be requested:

  • to the identification of the guests;
  • to public security duties;
  • to communications provided for by the regulations on accommodation facilities;
  • to the management of the tourist tax;
  • to administrative, accounting and fiscal obligations.

Any copies of identity documents obtained solely to complete mandatory communications will not be kept beyond the time strictly necessary for compliance, unless such retention is required by a specific legal provision.

Navigation data

The computer systems that enable the functioning of the website may automatically collect certain technical data, including:

  • IP address;
  • type of browser and device;
  • operating system;
  • date and time of the request;
  • page requested;
  • server response codes;
  • technical information necessary for the security and proper functioning of the site.

These data are normally processed to allow navigation, ensure the security of the site, identify malfunctions, and prevent fraudulent or abusive activities.

Cookies and similar technologies

The site may use technical cookies necessary for its operation and, only where present and under the conditions provided by law, third-party cookies or tools.

Detailed information about the cookies used, their purposes, and how to modify your preferences can be found in Cookie Policy, reachable at the following address:

Cookie Policy

Cookies and non-essential tools are activated only when required by law and after the user has expressed their choice through the consent management banner.

3. Purposes and legal bases of the processing

Navigation and operation of the site

The technical data is processed for:

  • show the pages correctly;
  • allow the use of the website’s features;
  • to ensure stability and security;
  • prevent unauthorized access, spam, and fraudulent activity;
  • identify technical problems.

The legal basis is the execution of the services requested by the user and, for security purposes, the legitimate interest of the owner in protecting the site, the data and its own business.

Responses to requests for information

The data communicated by the user are processed in order to answer questions related to the structure, availability, services and conditions of the stay.

The legal basis is the execution of pre-contractual measures adopted at the request of the interested party.

Management of booking requests and the stay

The data are processed for:

  • check availability;
  • manage the booking request;
  • communicate with the guest;
  • confirm, modify or cancel the reservation;
  • organizing the check-in and check-out;
  • provide the stay and any agreed services;
  • manage payments, refunds and complaints.

The legal basis is the execution of pre-contractual measures and the contract of stay.

Providing the data marked as mandatory is necessary to manage the request. In the absence of such data, it may not be possible to respond or complete the reservation.

Legal, administrative and fiscal obligations

The data may be processed to comply with obligations stipulated by law, including those relating to:

  • registration and identification of guests;
  • communications to public security authorities;
  • statistical communications required by regulations;
  • city tax;
  • issuance and preservation of accounting and tax documents;
  • response to legitimate requests from the authorities.

The legal basis is the fulfillment of a legal obligation to which the holder is subject.

Prevention of abuse and protection of rights

The data may be used to the extent necessary to prevent fraud and abuse, ascertain responsibility, handle complaints, and protect the rights of the owner in extralegal or judicial proceedings.

The legal basis is the legitimate interest of the holder in ensuring safety and protecting their rights.

Promotional communications

The site does not use the data provided for booking to send newsletters or promotional communications, unless the user has given specific consent through a separate, optional and non-preselected box.

The consent may be withdrawn at any time, without prejudice to the legality of the processing carried out before the withdrawal.

4. Mode of treatment and safety measures

Personal data is processed primarily using computer-based tools and, when necessary, with paper-based tools.

The owner adopts technical and organizational measures appropriate to the risk, aimed at preventing the loss, destruction, alteration, unauthorized access, or improper disclosure of data. Such measures include, where applicable, protected connections, access control, personal credentials, system updates, backup copies, and limiting access to only authorized individuals.

The data are not publicly disclosed.

5. Recipients of the data

To the extent necessary for the purposes described, the data may be processed or communicated to:

  • providers of hosting and site maintenance services;
  • providers of the booking system;
  • email providers and services for the sending of communications;
  • tax advisors, accountants, lawyers or technical experts;
  • banks, payment institutions and providers of payment services, if used;
  • platform operators when the booking originates from or is synchronized through such platforms;
  • persons responsible for the management of the facility, duly authorized;
  • Municipality and other bodies competent for the tourist tax;
  • public security authorities and other public authorities, in the cases provided by law.

When required by law, the providers that process data on behalf of the owner are designated as data controllers pursuant to Article 28 of the GDPR. Some recipients, such as public authorities, booking platforms, or payment providers, may operate as independent data controllers according to their respective functions.

The main technical providers used by the site include:

  • Register.it, for hosting services, domain registration and email;
  • WordPress, as the site management system;
  • WPForms, Used for managing the contact form;
  • WP Booking System, Used for managing the calendar and booking requests;
  • Compliance, for managing consent and preferences regarding cookies;

6. Reservations made through external platforms

When the user makes a reservation directly through portals such as Booking.com or Airbnb, these platforms process the data in accordance with their privacy policies and act, for their respective activities, as autonomous data controllers.

Boemondo House will receive from the platforms the data necessary for managing the reservation and the stay. The treatment carried out subsequently by the property is governed by this policy.

The simple synchronization of calendars via iCal is used to update availability and avoid overlaps between bookings.

7. Transfer of data outside the European Economic Area

The processing takes place primarily within the European Economic Area.

If one of the providers used involves the transfer of data to countries outside the European Economic Area, the transfer will be carried out in compliance with Articles 44 and following of the GDPR, based on a decision of adequacy by the European Commission or through other appropriate safeguards, such as standard contractual clauses.

8. Retention periods

The data are kept only for the time necessary for the purposes for which they were collected. Specifically:

  • Requests for information that do not lead to a booking are kept for an estimated period of 12 months from the conclusion of the correspondence, unless further retention is required;
  • The data relating to bookings and stays are kept for the duration necessary to execute the relationship and, subsequently, for the period necessary to comply with legal obligations and protect rights;
  • Administrative, accounting and fiscal documents are kept for the period stipulated by the applicable regulations, which is normally 10 years;
  • The data necessary for public security compliance and mandatory communications are processed and kept within the terms established by law;
  • any copies of identity documents acquired to complete the formalities are destroyed after notification and the issuance of the corresponding receipt, except for a specific legal obligation to retain them further;
  • The data processed on the basis of consent are kept until revoked or until the end indicated in the relevant information;
  • The technical data and the safety records are kept for the time necessary to protect the site and to verify any anomalies or abuses;
  • The cookies are stored for the periods indicated in the Cookie Policy.

At the end of the applicable periods, the data is deleted, anonymized, or retained only when required by law or necessary for the protection of a right.

9. Rights of the data subject

In the cases provided for by the GDPR, the data subject may request the controller to:

  • confirmation that a processing of your data is taking place or not;
  • access to personal data;
  • the rectification of inaccurate data;
  • the integration of incomplete data;
  • the deletion of the data;
  • the limitation of the processing;
  • the portability of the data;
  • opposition to processing based on legitimate interest;
  • the withdrawal of consent, when the processing is based on consent;
  • information about the recipients to whom the data have been disclosed.

The withdrawal of consent does not affect the legality of the processing carried out before the withdrawal.

Requests can be sent to:

amministrazione@boemondohouse.it

The owner may request the information strictly necessary to verify the identity of the applicant and will respond within the terms provided by the regulations.

10. Complaint to the Guarantor

Any person who believes that the processing of their personal data is taking place in violation of the law may file a complaint with the Data Protection Authority.

Institutional website: https://www.garanteprivacy.it/

The possibility of turning to the competent judicial authority remains intact.

11. Minors

Booking requests must be made by persons of legal age.

The data of minors participating in the stay are processed exclusively to the extent necessary for the management of the reservation, the provision of the service and the fulfillment of legal obligations, through the parent, the guardian or the adult responsible for the reservation.

12. Automated decision-making processes

The data collected through the website is not used to make decisions based solely on automated processing that produce legal effects or significantly affect the data subject.

13. Changes to the information

This information may be updated following changes in regulations, techniques or organization, or the introduction of new services.