Privacy policy

Last updated: 26 October 2026

This page explains what personal data we process when you visit casap17.it, write to us or book, why we do it and what your rights are under the EU General Data Protection Regulation 2016/679 (GDPR).

Data controller

Federico Fiorelli, Casa P17, Via Nino Bixio 55, 21100 Varese, Italy, VAT IT04070350121. Email: mail.casap@gmail.com, WhatsApp +39 348 262 8518.

Visiting the site

The site is hosted by Cloudflare, which logs technical data such as IP address and browser type for security and operation. We use Cloudflare Web Analytics, which counts visits in aggregate without cookies and without identifying visitors.

We also count clicks on the Book, WhatsApp, phone and email buttons, storing only month, language and page, no data about you.

Fonts are served from our own site: your visit sends no data to Google Fonts.

Map

The Google Maps map loads only if you press the button to open it. From then on Google receives data such as your IP address, under its own privacy policy.

Contact by WhatsApp and email

The contact form sends no data to our site: it opens WhatsApp with the message already written. If you write to us on WhatsApp or by email, we use your name, contact details and message only to reply. WhatsApp is a Meta service with its own privacy policy.

Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR). We keep messages for as long as needed to handle the request and any stay.

Bookings

Bookings are made on our booking engine (book.casap17.it), run by Smartness as our processor, or on Airbnb and Booking.com, which have their own privacy policies.

To manage your stay we process name, contact details, dates, number of guests and payment data (payment is handled by the booking engine provider; we do not see full card details). Legal basis: performance of the contract (Art. 6(1)(b)).

Italian law requires us to report guests' identity document details to the police through the Alloggiati Web portal (Art. 109 TULPS), pay the tourist tax to the City of Varese and keep tax records for 10 years. Legal basis: legal obligation (Art. 6(1)(c)).

Who receives the data

Only the providers needed for the service (Cloudflare for the site, Smartness for bookings and property management, our accountant) and the authorities required by law. We do not sell data or use it for advertising.

Some providers, such as Cloudflare, Google and Meta, may process data outside the EU with the safeguards required by the GDPR (EU-US adequacy decision or standard contractual clauses).

Your rights

You can ask to access, correct or delete your data, restrict or object to its processing, or receive it in a portable format (Arts. 15-22 GDPR) by writing to mail.casap@gmail.com. You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).