Privacy notice
How we process the personal data of people who visit the website, contact us or book a stay.
Last updated: 21 October 2026
This notice is provided under Article 13 of Regulation (EU) 2016/679 (“GDPR”) to anyone who visits www.romacentralguesthouse.com, contacts us through the contact form, email or WhatsApp, or books a stay. Our use of cookies and similar technologies is described in the Cookie notice.
1. Data controller
B&B Roma Central S.r.l.s.
Via Genova 24, 00184 Rome (RM), Italy
VAT number: IT13824451002
Email: info@romacentralguesthouse.com
Phone / WhatsApp: +39 366 3531527
2. Data we process
- Browsing data: IP address, date and time of the request, page requested, response code, browser and operating system, referring page. These are recorded automatically in the logs of the server hosting the website.
- Contact form data: first and last name, email address, phone number (optional), message text, plus the date, time and IP address of the submission. The form does not store data on the website: it sends it as an email to the controller’s mailbox.
- Direct contact data: the data you give us when you email us, message us on WhatsApp or phone us.
- Booking data: stay dates and number of guests entered in the availability search form; the data the booking engine asks for to complete the booking (e.g. first and last name, email, phone, payment details); the data we are required by law to collect during the stay.
- Cookies and similar technologies: your chosen language and consent preferences; only with your consent, website usage data (Google Analytics) and data sent to Google to display the map (Google Maps). Details in the Cookie notice.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Operating the website, security and abuse prevention (server logs) | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
| Answering requests sent through the form, by email, phone or WhatsApp | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) |
| Managing your booking and stay | Performance of a contract (Art. 6(1)(b) GDPR) |
| Complying with legal obligations: tax and accounting, reporting guests to the public security authority (Art. 109 TULPS), Rome tourist tax | Legal obligation (Art. 6(1)(c) GDPR) |
| Website usage statistics (Google Analytics) | Consent (Art. 6(1)(a) GDPR and Art. 122 Italian Legislative Decree 196/2003), which you can withdraw at any time |
| Displaying the embedded map (Google Maps) | Consent (Art. 6(1)(a) GDPR and Art. 122 Italian Legislative Decree 196/2003), which you can withdraw at any time |
| Establishing, exercising or defending legal claims | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
We do not carry out marketing, do not send newsletters and do not make decisions based solely on automated processing, including profiling.
4. Whether providing data is required
- Browsing data: needed to deliver the web pages.
- Contact form: name, email and message (fields marked *) are needed to answer you; without them we cannot follow up on your request. The phone number is optional.
- Booking: the data requested is needed to conclude the contract and meet legal obligations; without it the booking and stay are not possible.
- Statistics and map: consent is optional. If you do not give it you can still use the website normally; our location remains available through the “Open in Google Maps” link.
5. Recipients
Data is processed by the controller’s authorised staff and may be disclosed to the following parties:
| Party | Service | Role |
|---|---|---|
| Hetzner Online GmbH (Gunzenhausen, Germany) | Website hosting and server logs | Processor (Art. 28 GDPR) |
| Aruba S.p.A. (Ponte San Pietro – BG, Italy) | Email, including receipt of contact form messages | Processor (Art. 28 GDPR) |
| Octorate S.r.l. (Italy) | Availability search form and online booking engine | Processor (Art. 28 GDPR) |
| unpkg.com, public software library distribution service (CDN) delivered through Cloudflare, Inc. and Fly.io, Inc. (USA) | Supplies the Octorate availability search form with the libraries it needs to work; receives your IP address and technical browser data, no other data | Third-party provider used by the Octorate widget |
| Google Ireland Limited (Dublin, Ireland) | Google Analytics, only with your consent | Processor (Art. 28 GDPR) |
| Google Ireland Limited (Dublin, Ireland) | Google Maps, only with your consent | Independent controller |
| WhatsApp Ireland Limited (Dublin, Ireland) | Messaging, only if you choose to message us on WhatsApp | Independent controller |
| Tax and accounting advisers, banks and payment providers | Administration and payments relating to the stay | Processors or independent controllers, depending on the service |
| Public authorities (e.g. Police Headquarters, Rome City Council, Italian Revenue Agency) | Obligations required by law | Independent controllers |
Data is not published or sold to third parties for commercial purposes.
6. Transfers outside the European Economic Area
Hosting (Hetzner, Germany), email (Aruba, Italy) and the booking engine (Octorate, Italy) process data within the European Union.
The Octorate availability search form loads some libraries from the unpkg.com service, delivered through the networks of Cloudflare, Inc. and Fly.io, Inc. (USA). To deliver the files these providers receive your IP address and technical browser data, which may pass through servers located outside the European Economic Area, including the United States. Cloudflare, Inc. participates in the EU-U.S. Data Privacy Framework.
In addition, only if you consent to Google Analytics or Google Maps, or if you message us on WhatsApp, data may be transferred to the United States to Google LLC or Meta Platforms, Inc. These transfers rely on the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, in which both companies participate, and on the standard contractual clauses approved by the European Commission.
7. Retention periods
| Data | Retention |
|---|---|
| Server logs (browsing data) | 14 days, then deleted by automatic log rotation; longer only if needed to investigate an offence |
| Requests via form, email or WhatsApp not followed by a booking | 24 months from the last message exchanged |
| Booking data and tax and accounting records | 10 years, as required by Art. 2220 of the Italian Civil Code |
| Google Analytics data linked to visitor identifiers | 2 months (Google Analytics 4 default setting); aggregated statistical reports contain no personal data |
| Consent preferences (rc_consent) | 6 months, after which you are asked again |
| Chosen language (PHPSESSID cookie) | Until you close your browser |
8. How data is processed
Data is processed electronically, over an encrypted (HTTPS) connection, with access restricted to authorised staff and with appropriate technical and organisational measures to prevent loss, unlawful use or unauthorised access.
9. Your rights
You may exercise the rights set out in Articles 15–22 GDPR at any time:
- access to your data (Art. 15);
- rectification (Art. 16) and erasure (Art. 17);
- restriction of processing (Art. 18);
- portability of the data you provided to us (Art. 20);
- objection to processing based on legitimate interest (Art. 21);
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)). For statistics and the map you can do this through the “Cookie preferences” link at the bottom of every page.
To exercise your rights, write to info@romacentralguesthouse.com. We reply within one month of your request (Art. 12(3) GDPR). You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali — www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you live or work.
10. Changes
Any changes to this notice will be published on this page together with the date of the update.