Privacy Policy

1. Data controller

The controller of the personal data collected through romestays.com, the RomeStays guest app, is:

The site was built by Aumatex srls (aumatex.it), which acts as technical data processor on behalf of the controller.

2. What this site does

romestays.com is the digital concierge for guests of the apartments managed by RomeStays: information about the properties, a guide and a map of Rome, services on request and, for those staying with us, the private content of their apartment (Wi-Fi, check-in, instructions).

The site has no accounts, no newsletter and no forms that send data to our servers, and you cannot book on it: bookings happen on the individual property websites or on the portals (Airbnb, Booking.com), each with its own privacy policy.

3. Data processed

• Browsing data: IP address, browser and device type, pages requested, date and time. They are logged by the hosting servers to run the site and protect it from abuse.
• Visit statistics: aggregate data only (page views, device type, country, referrer), collected with Cloudflare Web Analytics without cookies and without identifying the visitor.
• Personal stay link: if you stay in a RomeStays apartment you receive an access link containing your first and last name, the apartment, the dates of your stay, your language, the booking channel and the booking reference. When you open it, this data is stored on your device in the technical cookie rs_guest_session, signed (it cannot be altered) and not readable by page scripts, to show you the private content of the apartment and greet you by name. The site has no database: booking data stays in the RomeStays booking system, which issues the link.
• Tourist tax: for guests who booked through Booking.com, the site shows the amount of the Rome tourist tax due and lets them pay it. To do so it asks the RomeStays booking system for the status of your booking only; payment takes place on Stripe’s pages: you enter your card details there and they never pass through our site.
• Concierge requests: the service forms compose a message (service, apartment, name and the details you enter) and open WhatsApp or your email app. The site sends and stores nothing: we receive the data only if you choose to send the message.
• Location: only if you tap “Use my location” and allow it in your browser. It is used to sort places by distance, stays in your browser and is neither sent to us nor stored.
• Preferences: your chosen language and theme, stored on your device as described in the Cookie Policy.

4. Purposes and legal basis

5. Retention period

• Stay cookie: expires at the end of your stay; you can delete it earlier with “End guest access”.
• Concierge messages: for as long as needed to handle the request and the stay; if the request becomes an invoiced service, 10 years as required by law.
• Contract, tax and tourist tax data: 10 years from the last record (legal obligation).
• Browsing logs: for a limited period, according to the hosting provider’s policies.
• Visit statistics: aggregate data only, which does not identify the visitor.

After these periods the data is deleted or irreversibly anonymised.

6. Recipients

Personal data may be shared with:

• Vercel Inc. (hosting) — USA, certified under the EU-US Data Privacy Framework. vercel.com/legal/privacy-policy
• Cloudflare, Inc. (visit statistics and the domain’s DNS) — USA, certified under the EU-US Data Privacy Framework. The site’s traffic does not go through Cloudflare’s servers. cloudflare.com/privacypolicy
• Aumatex srls — technical processor, bound by a data processing agreement
• Stripe — online payment of the tourist tax, only for guests who pay it. stripe.com/privacy
• WhatsApp or your email provider — only for the messages you choose to send us

Data is never sold or passed on to third parties for marketing purposes.

7. External services and links

The map uses OpenFreeMap (openfreemap.org), with © OpenStreetMap data: to draw it, your browser downloads the map tiles directly from their servers, which therefore receive your IP address and the area displayed, as with any web resource. It sets no cookies.

Fonts are served from our own domain: no requests are made to Google Fonts.

Links to Google Maps, WhatsApp and the websites of the properties and recommended places open external services, which process data under their own privacy policies. The site does not embed them: they come into play only if you open the link.

8. International transfers

Hosting is provided by Vercel Inc. (USA) and visit statistics by Cloudflare, Inc. (USA). In line with the GDPR, both are certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, 10 July 2023). For the services you choose to use (Stripe, WhatsApp, Google Maps), the safeguards described in their own policies apply.

9. Your rights

You may exercise the following rights at any time:

• Access (Art. 15 GDPR): obtain confirmation and a copy of your data
• Rectification (Art. 16 GDPR): correct inaccurate or incomplete data
• Erasure (Art. 17 GDPR): the “right to be forgotten”
• Restriction (Art. 18 GDPR): restrict processing
• Portability (Art. 20 GDPR): receive your data in a structured format
• Objection (Art. 21 GDPR): object to processing based on legitimate interest
• Withdrawal of consent: at any time, without prejudice

To exercise your rights: romestays@pec.it or concierge@romestays.com. We will reply within 30 days.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

10. Data security

RomeStays srls takes appropriate technical and organisational measures to protect data from unauthorised access. The site uses HTTPS for all transmissions; stay links are signed and expire with the stay, and private content is never stored in the app’s offline cache.

11. Cookies

For details on cookies and the other data stored on your device, see the Cookie Policy.

12. Changes to this policy

RomeStays srls may update this policy. Any substantial change will be announced on the site.