Privacy Policy

1. Data Controller

Lotto 235 Garbatella
Via Circonvallazione Ostiense 235, 00154 Roma RM, Italy
Email: lotto235roma@gmail.com
Phone: +39 328 452 1227

2. Data We Collect

We collect only data necessary for your booking and legal obligations:

• Identity: Name, email, phone number
• Booking details: Dates, guests, special requests
• Payment: Processed by Stripe; we do not store full card details
• Technical: IP address, browser type, referral source (for analytics)
• Reviews: Name, location, rating, content (if you submit a testimonial)

3. Legal Basis for Processing

• Contract performance: Processing booking, payments, communications
• Legal obligation: Italian tax law requires guest registration (Questura)
• Legitimate interest: Improving our service, fraud prevention, analytics
• Consent: Marketing emails (optional, opt-in)

4. Data Sharing

We do not sell your data. We share only with:

• Stripe: Payment processing (PCI-DSS compliant)
• Brevo (Sendinblue): Transactional emails via HTTPS API
• Italian authorities: Questura guest registration (legal requirement)
• Accountant: Tax compliance (data processing agreement in place)

5. Data Retention

• Booking records: 10 years (Italian tax law)
• Guest registration data: 3 years (Questura requirement)
• Email correspondence: 5 years
• Reviews: Until you request deletion
• Analytics data: 26 months (Google Analytics)

6. Your Rights (GDPR)

You have the right to:

• Access your data
• Rectify inaccurate data
• Erasure ("right to be forgotten") - where not legally required to retain
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent (for marketing)
• Lodge complaint with Italian Data Protection Authority (Garante)

To exercise rights, email: lotto235roma@gmail.com

7. Cookies & Analytics

• Essential: Session, CSRF, language preference
• Analytics (Google Analytics 4): Anonymized IP, 26-month retention. Opt-out: Google Opt-out
• No advertising/tracking cookies

8. Security

• HTTPS everywhere (TLS 1.2+)
• Stripe handles all card data (PCI-DSS Level 1)
• Database encrypted at rest
• API keys stored in environment variables (Railway secrets)
• Regular dependency updates & security monitoring

9. International Transfers

Your data may be processed outside EU/EEA by our processors:

• Stripe (USA) - EU Standard Contractual Clauses
• Google Analytics (USA) - EU SCCs + UK adequacy
• Brevo/France - EU

10. Children's Privacy

Our services are not directed to children under 16. We do not knowingly collect children's data. Bookings must be made by adults (18+).

11. Changes to This Policy

We may update this policy. Changes posted here with updated date. Material changes notified via email.

12. Contact