Privacy Notice
This notice explains how personal data is processed for visitors of lexiesuites.com and for guests who book a stay at Lexie Suites Guesthouse, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Data controller
Gecal SRLS, Via dei Mille 7/B, 00185 Rome (RM), Italy, VAT no. IT16888891005.
Phone: +39 327 8458125
Email: [email protected]
No Data Protection Officer (DPO) has been appointed. For any privacy request, contact us at the details above.
2. What data we process, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Managing your booking and stay | Name, contact details, address, nationality, stay dates, special requests | Performance of a contract or pre-contractual steps (Art. 6(1)(b)) | Until the end of the stay and related formalities |
| Legal obligations: reporting guests to the Italian State Police (Alloggiati Web), tourist tax, tax and accounting duties | Personal and identity document data, stay data, invoicing data | Legal obligation (Art. 6(1)(c)) | For the periods required by law (for example 10 years for accounting records) |
| Payments | Payment data, processed by payment service providers and booking platforms; we do not store full card numbers | Performance of a contract (Art. 6(1)(b)) | According to the service provider's rules |
| Support via chat and communications (email, phone, messages) | Name, contact details, message content, technical chat data | Pre-contractual steps and legitimate interest in answering requests (Art. 6(1)(b) and 6(1)(f)) | For the time needed to answer and handle the request |
| Website security and operation | IP address, technical browsing data (logs) | Legitimate interest in website security (Art. 6(1)(f)) | For the technical periods set by the hosting provider |
| Showing guest reviews (Elfsight widget) | Technical data and widget cookies | Consent (Art. 6(1)(a)) | Until consent is withdrawn or the cookies expire |
| Establishing, exercising or defending legal claims | Data needed for the defence | Legitimate interest (Art. 6(1)(f)) | For the time needed to protect the right |
We do not send newsletters and we do not carry out profiling or automated decision-making.
3. Providing your data
Providing identity and identity document data is required by law for anyone staying at the property: without it we cannot host you. The other data requested for the booking is needed to carry it out. Consent to non-essential cookies is optional and can be withdrawn at any time, with no effect on the rest of the service.
4. Who we share data with
Data may be shared with:
- the Italian State Police, through the Alloggiati Web service, and other public bodies, including Roma Capitale for the tourist tax, where required by law;
- Beddy (property management and direct booking engine) and booking platforms such as Booking.com and Expedia, for bookings received through them;
- payment service providers;
- tax, accounting and legal advisers;
- website technology providers: Cloudflare (hosting and security), Tawk.to (chat), Google (embedded map), Elfsight (reviews widget).
These providers act as processors or independent controllers, according to their own notices.
5. Transfers outside the EU
Some of the providers listed above are based or operate infrastructure outside the European Union, in particular in the United States. Transfers take place on the basis of an adequacy decision (for example the EU-US Data Privacy Framework) or the standard contractual clauses approved by the European Commission.
6. How we protect data
Data is processed electronically and, where necessary, on paper, with appropriate technical and organisational measures (Art. 32 GDPR). Access is limited to authorised persons.
7. Your rights
You may ask us at any time for access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Some rights may be limited where data must be kept by law.
To exercise them, write to [email protected]: we will reply within 30 days and may ask you to verify your identity.
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of your country of residence.
8. Cookies
For details on the cookies and similar technologies used on this site, see the Cookie Policy.
9. Updates
We may update this notice when the website, the services we use or the law change. The date of the latest update is shown at the top.