Privacy Policy

1. Who processes the data

The data controller is Gioacchino Scagliola, sole proprietorship “Room in Bloom B&B di Scagliola Gioacchino”, Via San Francesco 32, 70038 Terlizzi (BA), Italy, VAT No. 09014100722.

For any question about personal data, and to exercise the rights described in section 7, the guest can write to info.roominbloom@gmail.com or, by certified email (PEC), to gioacchino.scagliola@pec.it.

2. What data, for what purpose and on what legal basis

For each purpose the legal basis is given, that is, the reason why the law allows the processing (Art. 6 GDPR).

2.1 Booking and payment on the website

• Data: first name, last name, email, phone, dates of stay, rooms, number of guests, breakfast yes or no, check-in time, language, any special requests. Card details are requested and processed only by Stripe, on its payment page: the website does not see them.
• Purpose: providing the service requested: reserving the room, collecting payment, recording the booking. While the guest is paying, name, email and dates are used to hold the room for a short time, until the payment page expires.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

By booking, the guest accepts the terms and conditions. This privacy policy is pointed out with a link next to the payment button: it does not need to be accepted, because booking data are processed to perform the contract, not on the basis of consent.

2.2 Booking emails

• Data: email, name, booking details.
• Purpose: sending the confirmation to the guest and the notification to the controller. Emails are sent from noreply@roominbloom.it; replies go to info.roominbloom@gmail.com.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.3 Requests from the contact form

• Data: name, phone, email, arrival and departure dates, number of guests, message.
• Purpose: answering a request before booking.
• Legal basis: pre-contractual steps requested by the person concerned (Art. 6(1)(b) GDPR).

2.4 The “My Data” page

• Data: the email address with which the guest identifies themselves, and the guest's data found with that address.
• Purpose: allowing the guest to receive their own data or to request their deletion (section 7).
• Legal basis: legal obligation: responding to those who exercise their rights (Articles 12 and 15–22 GDPR; Art. 6(1)(c)).

2.5 Security of the booking, the contact form and “My Data”

• Data: the IP address of anyone who books, writes through the contact form or uses “My Data”, to limit repeated requests from the same address; technical browser data read by Cloudflare Turnstile, the anti-bot check at the last step of the booking.
• Purpose: protecting the booking, the contact form and “My Data” from abuse.
• Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR): the security of the website, that is, protecting these forms from bots and repeated requests (Recital 49 GDPR). Only the IP address and a few technical details are used, only on these pages and for a short time. The assessment made by the controller can be requested at info.roominbloom@gmail.com.

2.6 Running the website

• Data: the IP address and technical data of each visit, recorded by Cloudflare, which hosts the website.
• Purpose: making the website work.
• Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR): showing the website to visitors and protecting it from attacks and malfunctions (Recital 49 GDPR). The assessment can be requested as in section 2.5.

2.7 Statistics, only with consent

• Data: pages viewed; events (the booking steps, sending the contact form, the language chosen, clicks on external links); page speed measurements; for a completed booking, the booking number, the amount, the rooms and the nights; Google Analytics cookies (see the Cookie Policy).
• Purpose: understanding how the website is doing.
• Legal basis: consent (Art. 6(1)(a) GDPR and Article 122 of the Italian Privacy Code), given through the cookie banner. Google Analytics loads only after a “yes”: without consent it does not start.
• Changing your mind: consent can be withdrawn at any time through the “Cookie preferences” link in the footer of the pages of the website.

2.8 The map

On the home page there is a Google Maps map. It loads only when the guest presses the “Show map” button: next to the button it says what happens. When the map loads, Google receives technical data from the browser (such as the IP address) and may use its cookies, also in the United States. Without the map, the address and the link to open Google Maps remain available.

Legal basis: consent (Art. 6(1)(a) GDPR and Article 122 of the Italian Privacy Code), given by pressing the button. The choice applies only while the tab stays open; it can be withdrawn with the “Hide map” button. Cookies already set by Google can be deleted in the browser settings.

2.9 Documents on arrival and reporting to the Questura

• Data: the details of the guests' identity documents.
• Purpose: informing the Questura (police headquarters) of who is staying at the property, through the Alloggiati Web service.
• Legal basis: legal obligation (Article 109 of the TULPS, the Italian public security law; Art. 6(1)(c) GDPR). Providing the document on arrival is required by law.
• How they are collected: the controller always checks in person that the document matches the guest, and enters its details in the Alloggiati Web portal of the Italian State Police. To organise the arrival, for example with self check-in, the controller may ask for the documents beforehand, explaining how to send them; in this case, shortly after arrival, the controller still comes to the property to check in person that they match the guests.
• Copies: the controller does not keep copies of documents: any copies received are deleted as soon as the portal issues the receipt. The same applies to any notes on paper. Only the Alloggiati Web receipt is kept, for 5 years (Decree of the Italian Ministry of the Interior of 7 January 2013, Art. 4-bis(2)). The State Police also keep the data reported for 5 years.

2.10 Tourism statistics

Every month the controller reports to the Puglia Region (Pugliapromozione agency, SPOT system) the arrivals and departures of the previous month, for official tourism statistics. For each guest, only data without a name are entered: place of origin, sex, age group, arrival and departure dates. Legal basis: legal obligation (Puglia Regional Law no. 49/2017; Art. 6(1)(c) GDPR).

2.11 Invoices

• Data: the guest's name and tax details (tax code; for companies, VAT number and PEC or Recipient Code), amount and date.
• Purpose: issuing the electronic invoice, which is always issued, and meeting the other tax obligations.
• Legal basis: legal obligation (Art. 6(1)(c) GDPR). Invoices are prepared with the online service FlexTax and sent to the Italian Revenue Agency (Agenzia delle Entrate).

2.12 Direct messages, phone and WhatsApp

Anyone who writes or calls directly (email, phone, WhatsApp, SMS) provides their number or address, their name and the content of the messages. These are used to reply and, for those who have booked, to manage the stay. Legal basis: pre-contractual steps or performance of a contract (Art. 6(1)(b) GDPR).

Emails arrive in the info.roominbloom@gmail.com mailbox, which also receives contact form messages, booking notifications and requests made through “My Data”; the mailbox is a Google service. The controller may save the guest's name and number in the phone's contacts, which, together with the chats, may have a backup copy with Google.

2.13 Access codes

To enter the property, the guest receives a personal code, valid only for their stay, which the controller sends by WhatsApp or SMS to the number provided; the controller always checks the guest's identity in person in any case (section 2.9). Legal basis: performance of a contract (Art. 6(1)(b) GDPR). The lock does not record entries.

2.14 Video surveillance

• Where: the front entrance door. The cameras do not film the rooms or the interior spaces, and the street only as much as is unavoidable. A sign points them out before the filmed area.
• Purpose: protecting the property, the guests and their belongings from theft, intrusion and damage, and having evidence if something happens.
• Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR): the security of the property and of those staying there. The assessment made by the controller can be requested at info.roominbloom@gmail.com.
• Who sees the footage: only the controller, and only if something happens. It is handed to the police or a judge only if they request it, or together with a criminal complaint. The footage is recorded on the camera's memory card; the controller views it with the manufacturer's app, Imou, and while it is viewed from the phone it may pass through Imou's servers.
• How long: 72 hours, then it is deleted automatically. Longer only for a specific incident, at the request of the police or a judge.
• Rights: as in section 7, including the right to object.

2.15 Bookings from Booking.com and Airbnb

Those who book on Booking.com or Airbnb receive the platform's privacy policy; the platform processes their data as an independent controller. The data the controller uses for the Questura and for invoices follow sections 2.9 and 2.11.

2.16 Payments outside the website

If the guest pays outside the website (for example in cash or by bank transfer), the controller processes the data needed for the payment: name of the payer, amount, date and, for bank transfers, the bank details shown in the incoming payment. They are used to collect payment and keep the accounts. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and accounting obligations (Art. 6(1)(c)). The bank and other payment providers process them as independent controllers.

2.17 The list of stays

The controller keeps a list of stays on their own computer: name, dates, room, number of guests, phone and email, amounts and payments. It is used to organise bookings and keep the accounts. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and accounting obligations (Art. 6(1)(c)). The list is kept only on the controller's computer, with no copies online, and contains no identity document data.

2.18 Reviews

If the guest leaves a review on Google, Booking.com, Airbnb or other platforms, the controller reads it and may reply on the same platform, using at most the name the guest signed with. Legal basis: legitimate interest of the controller in replying to what is written about their business (Art. 6(1)(f) GDPR). The platforms are independent controllers and process the review according to their own privacy policies.

3. Is providing the data mandatory?

• Booking: first name, last name, email and phone are mandatory: without them it is not possible to book. Check-in time and special requests are optional.
• Document: yes, it is a legal obligation (section 2.9); if the controller asks for it before arrival, sending it is also a condition of the booking (terms and conditions, section 5).
• Contact form, email, WhatsApp: using them is the guest's choice; without contact details it is not possible to reply.
• Statistics and map: no, they start only if the guest accepts them or opens the map.

4. Who receives the data

The data are processed by the controller and by these providers: on the controller's behalf (processors, Art. 28 GDPR) or, where stated, also for their own purposes (independent controllers, with their own privacy policies).

• Supabase: database and website functions (bookings, contact form, “My Data”, limits per IP address, record of cookie choices). Processor.
• Stripe: card payment. Processor for carrying out the payment on behalf of the controller; independent controller for its own purposes (fraud prevention, anti-money-laundering obligations, relations with banks and payment networks, improving its services), according to its privacy policy.
• Cloudflare: hosts the website and provides the Turnstile anti-bot check. Processor; independent controller for improving its services and Turnstile, according to its privacy policy.
• Resend: emails for bookings, the contact form and “My Data”. Processor.
• Google: statistics (only with consent), map (only if opened), email mailbox and backup copies of the controller's phone. For Google Analytics, processor. For the map, the website and Google jointly decide only the loading (joint controllers, Fashion ID judgment of the Court of Justice of the EU); for Google's later use of the data, Google is an independent controller, according to its privacy policy. Google provides the email mailbox and the backup copies under its own terms and privacy policy, as an independent controller.
• WhatsApp (WhatsApp Ireland, Meta group): messages and access codes, if the guest uses WhatsApp. Independent controller, according to its privacy policy. Messages are end-to-end encrypted: WhatsApp does not read them.
• Vodafone, telephone operator: calls and SMS, including access codes. Independent controller of the data needed for the service (numbers, times).
• Imou, camera manufacturer: the app with which the controller views the footage from the entrance camera. Processor.
• FlexTax: electronic invoices. Processor.

The following also receive data, as required by law: the Questura (Alloggiati Web, section 2.9), the Italian Revenue Agency (invoices, section 2.11) and the Puglia Region (Pugliapromozione: only statistical data without names, section 2.10). Booking.com and Airbnb (section 2.15), the bank and other payment providers (section 2.16) and review platforms (section 2.18) are also independent controllers.

5. Data outside the European Union

The website's database is in the European Union, in Frankfurt (Germany). Some providers also process data outside the European Union, with these safeguards (Articles 45 and 46 GDPR):

• Data Privacy Framework, the European Commission's adequacy decision for certified US companies (Decision 2023/1795): Cloudflare, Google, Stripe, Resend and WhatsApp/Meta are certified in the official list (dataprivacyframework.gov, checked on 20 October 2026).
• Standard contractual clauses approved by the European Commission: Supabase, for any access from outside the European Union; Stripe and Resend use them in addition to the Data Privacy Framework.

Imou and FlexTax process the data as processors, according to their privacy policies: for FlexTax the FlexTax privacy policy, for Imou the privacy policy in the Imou Life app. If they transfer data outside the European Union, they do so with the safeguards provided by the GDPR (Art. 46, for example the Commission's standard contractual clauses).

6. How long the data are kept

• Temporary hold of the room during payment: until the payment page expires. If the payment is not completed, the data entered in the booking form remain on Stripe until 12 months after the planned departure, then they are deleted. The following remain on Stripe, for the periods decided by Stripe according to its privacy policy: the name, which appears in the room line on the payment page, the email, if the guest entered it on that page, and a copy in Stripe's technical logs.
• Bookings: 10 years from the arrival date, because they document the payment received (Article 2220 of the Italian Civil Code); then an automatic procedure of the website anonymises them. Phone, special requests and check-in time are deleted earlier, 12 months after departure, from Stripe too. The name and email remain on Stripe together with the payment data, as does a copy in Stripe's technical logs, for the periods decided by Stripe according to its privacy policy.
• Invoices, payments and other accounting records, including the list of stays (section 2.17): 10 years (Article 2220 of the Italian Civil Code); longer only if a tax audit of that year is under way at that time.
• Identity documents: the controller does not keep copies; those received and any notes are deleted as soon as the Alloggiati Web receipt arrives.
• Alloggiati Web receipts: 5 years.
• Messages (contact form, email, WhatsApp, SMS): 13 months at most. Every year, in January, the messages of the previous year are deleted, except those needed for an invoice or for a dispute that is still open.
• Guests' phone numbers and email addresses in the list of stays and in the phone's contacts: 13 months at most after departure, with the same January clean-up.
• Emails sent with Resend: 30 days.
• Requests to exercise rights (from “My Data” or by email) and the replies: 5 years from the reply, to be able to prove that a reply was given.
• IP addresses for request limits: 2 days at most.
• Turnstile technical data and Cloudflare visit logs: as long as Cloudflare needs them to provide the service, and in any case no longer than the end of the contract; for Cloudflare's own use, its privacy policy applies.
• Google Analytics statistics: 2 months.
• Map and reviews: decided by Google and the platforms.
• Technical booking synchronisation logs: 12 months, then deleted automatically.
• Camera footage: 72 hours, then deleted automatically; longer only at the request of the police or a judge.
• Proof of the choice made in the cookie banner: in the browser 6 months, then the banner appears again; in the record of choices on the server 12 months from the choice, then deleted automatically.

7. The guest's rights

The guest may at any time ask to:

• access their data and receive a copy;
• correct them (rectification);
• delete them;
• restrict their processing;
• receive them in a machine-readable format to take them elsewhere (portability);
• object to the processing;
• withdraw any consent given, at any time: for statistics through the “Cookie preferences” link in the footer of the pages of the website, for the map with the “Hide map” button. Withdrawal takes effect from that moment: it does not make unlawful what was done before.

Right to object. For processing based on legitimate interest (sections 2.5, 2.6, 2.14 and 2.18), the guest may object at any time, on grounds relating to their particular situation, by writing to info.roominbloom@gmail.com. The controller stops, unless there are compelling legitimate grounds that override the guest's rights, or for the defence of legal claims (Art. 21 GDPR).

How: through the “My Data” page, which sends one's own data by email or records a deletion request, or by writing to info.roominbloom@gmail.com. The reply arrives within one month, free of charge; in complex cases the deadline may be extended by two further months, with notice to the guest.

One limit: deletion cannot cover data that the law requires to be kept, such as invoices and Alloggiati Web receipts.

Complaint: the guest may lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

8. Automated decisions

Room in Bloom does not make automated decisions about guests and does not carry out profiling.

9. Cookies

Which tools the website uses in the browser and how to choose: Cookie Policy.