Privacy policy

What we collect and why

Booking data (name, email, phone, country, dates, guests, notes) to manage your reservation and stay: legal basis is the contract. Identity documents of all guests at check-in, transmitted to the State Police portal (Alloggiati Web) and used for tourist-tax reporting to Roma Capitale: legal basis is a legal obligation (art. 109 TULPS).

Payments are processed by PayPal (Europe) S.à r.l. et Cie, S.C.A. or, for card payments, by Stripe Payments Europe Ltd; we never see full card numbers.

Contact-form messages and WhatsApp chats, to answer you: legitimate interest. Your email address, if you ask for our Rome guide or a price alert for your dates: to send them, on the basis of your consent confirmed through a link we email you (double opt-in); occasional offers only if you tick the separate box. Every email contains a one-click unsubscribe link.

Anonymous visit counts via Umami (no cookies, no personal data): legitimate interest. Google Analytics 4, only if you accept cookies: consent. The maps on the site load tiles from OpenStreetMap, which receives your IP address like any web server: legitimate interest in showing where the apartments are.

Is providing the data required?

Booking data is needed to conclude the contract, and identity documents are required by law: without them we cannot accept the booking or the stay. Everything else (messages, guide, price alerts, analytics) is optional.

Retention

Booking and invoicing records are kept for 10 years as required by Italian tax law. Identity documents and police registrations are kept for the periods required by law for Alloggiati Web and tourist-tax reporting. Contact messages are kept for 24 months. Guide and price-alert sign-ups are kept until you unsubscribe, and at most 24 months after the last email we sent you. Analytics data is retained 14 months.

Recipients

Our hosts and cleaning staff, bound by confidentiality; PayPal and Stripe (payments); Hostinger International Ltd (hosting of this site and email); Telegram, which we use for internal notifications of new bookings and messages; Meta Platforms Ireland (WhatsApp), if you write to us there; the OpenStreetMap Foundation (map tiles); Google Ireland Ltd (analytics, only with consent); the State Police and Roma Capitale as required by law; our accountant for tax purposes.

Some of these providers (Stripe, PayPal, Google, Meta, Telegram) may process data outside the EU: they do so under the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

Your rights

You may access, rectify, erase, restrict or port your data, object to processing and withdraw consent at any time by writing to info@midaaccommodation.com. You may lodge a complaint with the Garante per la protezione dei dati personali (garanteprivacy.it).