Privacy policy

This policy explains how we process the personal data of people who visit this site, ask for information, book or stay in our apartments, under Regulation (EU) 2016/679 (the "GDPR").

Who the controller is

RIAL S.R.L., trading as Rial Estate
Viale Fulvio Testi 7, 20159 Milan, Italy
VAT no. IT12430320965 · REA MI-2661317
Email: info@rialestate.it

What data we process and why

When you visit the site

The provider hosting the site automatically logs some technical data for each request: IP address, browser type, page requested, date and time. This is needed to run the site and protect it from abuse.

Legal basis: our legitimate interest in the security and proper operation of the service (Art. 6(1)(f) GDPR).

The Milan weather shown on the map is fetched by our server from the public service of the Norwegian Meteorological Institute (MET Norway): your browser does not contact it and none of your data reaches MET Norway.

The site does not use analytics, profiling or advertising tools. For cookies, see the cookie policy.

When you book

Bookings are made through the Smoobu form built into each apartment page. We ask for your first name, last name, email, phone number, address, expected arrival time and, if you wish, a message. The system also records dates, number of guests and amount.

Legal basis: performance of the accommodation contract or of the pre-contractual steps you request (Art. 6(1)(b) GDPR).

When you pay

If you choose to pay by card, your card details are entered and processed directly by Stripe: they never reach us. We only receive the outcome of the payment.

To protect payments and the form from fraud and abuse, Stripe and Smoobu may use automated checks, such as hCaptcha, which analyse technical data about your device and browsing. If you choose to pay on arrival, we do not ask for any payment details online.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

When you write to us

If you contact us through the form on the Contact page, by email or on WhatsApp, we process the data you send in order to reply and, if you book, for service messages related to your stay.

The form asks for your name, email and message; phone, apartment, dates and number of guests are optional. Your request goes through the forms service of our hosting provider (Netlify), which stores it and forwards it to us by email.

Legal basis: your request and performance of the contract (Art. 6(1)(b) GDPR).

Reviews shown on the site

On some pages we show reviews that guests have left publicly on Airbnb. We only show the first name, the month and the text of the review, with no surnames, photos or other data. If you wrote a review and would rather it did not appear here, write to us and we will remove it.

Legal basis: our legitimate interest in showing the experience of people who have already stayed with us (Art. 6(1)(f) GDPR).

During your stay: legal obligations

• Identity documents. Italian law requires hosts to report each guest's details to the police (Questura) within twenty-four hours of arrival (Art. 109 of the Consolidated Public Security Act). This is why we ask for a valid document for every guest.
• Tourist tax. We collect the tax on behalf of the City of Milan and send it the data required by municipal regulations.
• Tax and accounting obligations related to the payment.

Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR).

Who we share data with

We process data through authorised staff and through providers acting as processors, or as independent controllers for their own part:

• Smoobu GmbH (Berlin, Germany) — property management system and booking form. Smoobu privacy policy
• Stripe Payments Europe, Limited (Dublin, Ireland) — card payment processing. Stripe privacy policy
• Netlify, Inc. (United States) — website hosting. Netlify privacy policy
• WhatsApp Business (Meta Platforms Ireland Ltd., Dublin, Ireland), if you message us on WhatsApp, and n8n GmbH (Berlin, Germany), the service that forwards incoming messages to our staff. WhatsApp privacy policy · n8n privacy policy
• Public authorities (police, City of Milan, tax administration) for the obligations described above.
• Tax and accounting advisers, bound by confidentiality.

If you book through Airbnb or Booking.com, those platforms process your data as independent controllers under their own policies.

We do not sell data and do not pass it to third parties for marketing.

Transfers outside the European Union

Some providers may process data in the United States. In those cases the transfer relies on the EU-U.S. Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

How long we keep data

• Bookings and tax records: for the period required by tax and civil law, as a rule ten years (Art. 2220 of the Italian Civil Code).
• Enquiries that do not become a booking: for as long as needed to reply.
• Technical browsing data: for the short periods set by the hosting provider.

Your rights

You can ask at any time to access your data, correct it, erase it, restrict its processing, receive it in a portable format, or object to processing based on legitimate interest (Arts. 15–22 GDPR). Some data must still be kept where the law requires it.

Write to info@rialestate.it: we reply within one month.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

Minors

Bookings are reserved for adults. Data of minors staying with their parents is processed only for the legal obligations described above.

Changes

We may update this policy when our services or the law change. The date of the latest change is shown at the top of the page.