ENIT
Immobili Luxury
Book now

Privacy notice

Privacy

Last updated: 30 October 2026

This English version is provided for convenience; the Italian version prevails in case of discrepancies.

This notice explains how IMMOBILI LUXURY S.R.L. processes the personal data of people who visit this website, contact us, book and stay in our apartments, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and Italian Legislative Decree 196/2003 (the Italian Privacy Code).

1. Data controller

IMMOBILI LUXURY S.R.L., Via Luigi Bertelli Vamba 8, 50135 Florence (FI), Italy · VAT number (P. IVA) 07505830484. For any question about your data, or to exercise your rights, write to info@immobililuxury.com or call +39 393 001 1522.

2. What data we process, why, and on what legal basis

a) Browsing the website

  • Data: technical connection data (IP address, browser and device type, page requested, date and time).
  • Why: to run the website, display it correctly and protect it from misuse and cyber attacks.
  • Legal basis: our legitimate interest in the operation and security of the website (Art. 6(1)(f) GDPR).
  • How long: we keep no visit logs and create no profiles; technical data is processed by the providers listed in section 4 only for as long as needed to provide the service and keep it secure.

The website has no forms, requires no registration and uses no cookies or analytics, advertising or profiling tools: see our cookie policy for details.

b) Enquiries (WhatsApp, phone, email)

  • Data: name, phone number, email address and whatever you write to us (for example dates, number of guests, special requests).
  • Why: to answer your enquiry and, if you ask, to give you availability, prices and information about your stay.
  • Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in replying to people who contact us (Art. 6(1)(f) GDPR).
  • How long: as long as needed to handle your enquiry; if no booking follows, no longer than 24 months after our last contact.

c) Bookings and stays

  • Data: first name and surname, contact details, dates of stay, number of guests, requests for your stay, payment and invoicing details; for each guest, the identity document details required by law for guest registration.
  • Why: to manage your booking, online check-in and stay (access to the apartment, assistance), to collect payment and issue tax documents; and to meet our legal obligations: reporting guests' details to the police headquarters (Questura) through the Alloggiati Web service (Art. 109 of the Consolidated Public Security Act, Royal Decree 773/1931), the City of Florence tourist tax (imposta di soggiorno), statistical reporting where required, and accounting and tax obligations.
  • Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).
  • Is it mandatory? yes: without this data it is not possible to book or stay, because guest registration is required by law.
  • How long: accounting and tax records for 10 years (Art. 2220 of the Italian Civil Code); data for the police and the tourist tax only for the period set by the relevant rules; other booking data for as long as needed to manage the stay and any disputes, and in any case no longer than 10 years.

Booking, payment and online check-in take place on our booking portal, immobililuxury.kross.travel, built with Kross Booking software, which processes data on our behalf (see section 4).

d) Bookings through online platforms (for example Airbnb or Booking.com)

  • How it works: if you book through a platform, that platform is an independent controller of the data it collects and provides its own privacy notice; we receive from the platform the data needed to manage your stay and process it as described in point c).

e) Job applications (Careers)

  • Data: the details in your CV and whatever you write to us.
  • Why: to assess your application and contact you for a possible interview.
  • Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for unsolicited CVs no consent is required (Art. 111-bis of the Italian Privacy Code).
  • How long: up to 12 months from receipt, unless you ask us to delete them sooner.
  • Please: do not send health data or other special categories of data unless strictly necessary.

f) Reviews shown on the website

  • What we publish: some reviews that guests have posted publicly on Airbnb, with only the first name as shown by Airbnb and, where available, the country and month of the stay.
  • Legal basis: our legitimate interest in sharing our guests' opinions (Art. 6(1)(f) GDPR).
  • If you recognise yourself: you can ask us to remove it at any time by writing to info@immobililuxury.com.

3. How we process data

Data is processed electronically and, where needed, on paper, by authorised and trained people, with appropriate security measures. We do not make decisions based solely on automated processing and we do not carry out profiling.

4. Who receives the data

  • Providers processing data on our behalf, appointed as processors (Art. 28 GDPR): Kross Booking (booking software, booking and online check-in portal, booking box on the website) and the payment providers connected to it; Cloudflare, Inc. (website hosting, protection against attacks and delivery of a technical library); Google Ireland Limited (email); our accounting and tax advisers.
  • Group companies and partners who prepare and look after your stay (housekeeping, linen, assistance), only for the data strictly needed (for example dates and number of guests) and under a duty of confidentiality.
  • Authorities and bodies we are legally required to inform: the police headquarters (Questura, via Alloggiati Web), the City of Florence (tourist tax), statistical bodies, the tax authorities and, if requested, the judicial authorities.
  • WhatsApp: if you message us on WhatsApp, the service is provided by WhatsApp Ireland Limited (Meta group), which processes the data as an independent controller under its own privacy notice.

Your data is never published or sold.

5. Transfers outside the European Union

Some providers (Cloudflare, Google, WhatsApp/Meta) may also process data in the United States. Such transfers rely on the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, to which these providers adhere, and on the standard contractual clauses approved by the Commission (Art. 46 GDPR).

6. Your rights

At any time you can ask us (Articles 15-22 GDPR) for:

  • access to your data and a copy of it;
  • correction of inaccurate or incomplete data;
  • erasure, where we are not legally required to keep the data;
  • restriction of processing;
  • portability of the data you have given us, in a structured, commonly used and machine-readable format;
  • an end to processing based on our legitimate interest (objection), unless there are overriding legitimate grounds.

To exercise these rights, write to info@immobililuxury.com: we reply within one month (extendable by two months for complex requests, as provided by Art. 12 GDPR). You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the country where you live or work.

7. Cookies

The website does not use cookies. Full details are in our cookie policy.

8. Changes

We may update this notice when our services or the law change: the date of the latest update is shown at the top of the page.