PRIVACY POLICY – ALPINE STAY APARTMENTS

Information on the Processing of Personal Data Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Last updated: October 19, 2026

1. Data Controller

The Data Controller responsible for the processing of personal data is:

Alpine Stay Apartments S.r.l.

• Registered office: [FULL ADDRESS]

• VAT Number: [VAT NUMBER]

• Email: [COMPANY EMAIL ADDRESS FOR PRIVACY REQUESTS]

• Website: https://www.alpinestayapartments.com

The Data Controller is committed to protecting the confidentiality and security of the personal data of website users, customers, and guests, in accordance with Regulation (EU) 2016/679 and applicable Italian legislation.

2. Categories of Personal Data Collected

When browsing the website, requesting information, or making and managing reservations, the following categories of personal data may be processed:

• Identification data: first name, last name, date and place of birth, nationality, and identity document information, where required by law.

• Contact details: email address, telephone number, and residential address.

• Booking information: dates of stay, selected apartment, number of guests, amounts, requests, and preferences communicated.

• Administrative and payment data: information necessary for managing payments, invoicing, and accounting obligations.

• Browsing data: IP address, device characteristics, technical browser information, and data potentially collected through cookies or similar technologies.

• Communications: messages sent via email, WhatsApp, contact forms, or booking platforms.

Special categories of personal data under Article 9 of the GDPR are not requested unless strictly necessary and supported by an appropriate legal basis.

3. Purposes and Legal Bases for Processing

Personal data is processed for the following purposes:

A. Managing Enquiries and Quotations

Responding to requests for availability, information, and quotations submitted by users.

Legal basis: taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).

B. Managing Reservations and Stays

Managing reservations, pre-arrival communications, check-in procedures, payments, guest assistance, and services related to the stay.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

C. Compliance with Legal Obligations

Complying with tax, accounting, statistical, and public security obligations, including the communication of guest information to the competent authorities.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

D. Security and Protection of Rights

Ensuring the security of IT systems, preventing misuse, and protecting the Data Controller's rights, including in legal proceedings.

Legal basis: legitimate interests of the Data Controller (Article 6(1)(f) GDPR), while respecting the rights and freedoms of data subjects.

E. Marketing Communications

Any newsletters, special offers, or commercial communications are sent on the basis of the data subject's consent, where required by applicable legislation.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

4. Methods of Data Processing

Personal data is processed using electronic, digital, and, where necessary, paper-based systems, with appropriate technical and organisational measures to prevent unauthorised access, loss, disclosure, or unlawful use.

Access to personal data is restricted to authorised individuals and service providers who require such information to perform their respective activities.

5. Booking Systems and Data Recipients

To manage reservations and operational activities, Alpine Stay Apartments also uses external platforms and service providers, including:

• KrossBooking: property management and booking system.

• Booking.com and Airbnb: accommodation distribution and booking platforms.

• WhatsApp and email services: communications with customers and guests.

• Payment service providers: processing of financial transactions.

• Administrative, tax, and legal advisors: compliance with obligations related to business activities.

• Public authorities: where required by applicable legislation.

Personal data is disclosed only when necessary for the purposes described above.

Depending on their respective roles, service providers may act as data processors pursuant to Article 28 GDPR or as independent data controllers.

6. Guest Identification and Public Security Obligations

To comply with Italian legal requirements, Alpine Stay Apartments collects the information necessary to identify guests and transmit their details through the Italian State Police's Alloggiati Web system.

Identity document information is processed exclusively to the extent necessary to fulfil the applicable legal obligations.

Any copies of identity documents collected solely for this purpose are not retained after confirmation that the relevant information has been successfully transmitted to the competent authorities, in accordance with applicable regulations.

7. Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected.

In particular:

• Enquiries that do not result in a booking are retained for the period necessary to handle the request and any related legal protection requirements.

• Contractual, administrative, and accounting data is retained for the periods required by applicable legislation, generally up to 10 years for documentation subject to the relevant retention obligations.

• Data processed to comply with public security obligations is retained according to the specific periods established by applicable regulations.

• Data used for marketing purposes, where applicable, is retained according to the criteria communicated when consent is collected.

• Technical data and information collected through cookies are retained for the periods specified in the Cookie Policy.

Once the applicable retention periods have expired, personal data is deleted or anonymised unless further legal obligations require its retention.

8. Transfers of Personal Data Outside the European Economic Area

The use of technology providers and digital platforms may involve transfers of personal data to countries outside the European Economic Area (EEA).

Where such transfers occur, the Data Controller implements or verifies the existence of the safeguards required under Articles 44 et seq. of the GDPR, such as adequacy decisions adopted by the European Commission or Standard Contractual Clauses, where applicable.

9. Data Subject Rights

Under Articles 15–22 of the GDPR, data subjects may, where provided for by applicable legislation:

• Request access to their personal data.

• Request correction of inaccurate personal data.

• Request deletion of their personal data.

• Request restriction of processing.

• Object to processing in the cases permitted by law.

• Request data portability, where applicable.

• Withdraw previously given consent.

Requests may be submitted using the Data Controller's contact details provided in Section 1.

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), whose website is available at https://www.garanteprivacy.it.

10. Cookies and Tracking Technologies

The website may use technical cookies necessary for its operation and, where actually enabled, additional tools for statistical, analytical, or promotional purposes.

Non-essential cookies are used in accordance with applicable legislation and, where required, only after obtaining the user's consent.

Specific information about the technologies used, providers, retention periods, and methods for managing preferences is provided in the website's Cookie Policy.

11. Links to External Websites and Services

The website may contain links to external platforms, including booking portals, payment systems, and third-party services.

Any personal data processing carried out independently by these third parties is governed by their respective privacy policies.

12. Automated Decision-Making

Reservation management activities may involve automated tools for calculating availability and accommodation rates.

Unless specific processing activities are otherwise communicated to data subjects, no decisions are made solely on the basis of automated processing that produce legal effects or similarly significantly affect individuals within the meaning of Article 22 GDPR.

13. Nature of Data Provision

Providing the personal data required to prepare quotations, enter into contracts, manage stays, and comply with legal obligations is necessary for the performance of the relevant activities.

Failure to provide such information may prevent the requested services from being provided.

Providing data for optional purposes, such as marketing communications based on consent, is entirely voluntary.

14. Changes to This Privacy Policy

Alpine Stay Apartments reserves the right to update this Privacy Policy in response to regulatory, organisational, or technological changes.

The updated version will be made available on the website, together with the date of the latest revision.