Privacy Policy

Data controller

The data controller is Albergo Sonia s.n.c., Via Dino del Garbo 2, 50134 Firenze (FI), VAT 05148200487.

For any request about your data: email info@albergosonia.com, certified email (PEC) albergosonia@pec.it, phone +39 055 4360 241.

Which data we process

• Booking: first and last name, email, phone, dates of stay, rooms chosen, any requests and the agreement or coupon code, if you use one.
• Customer account, if you create one: email and password (stored encrypted), your booking history.
• Messages: what you write with the contact form, by email, on WhatsApp or tell us by phone.
• On arrival: the identity document details of every guest, which the law requires us to collect.
• Payments: at the hotel we record the amount paid; online you pay on PayPal and we only receive the payment confirmation, never your card details.
• Technical data: like every website, the server logs the IP address and the pages requested, for security and to fix errors. On forms that send email, an automatic Cloudflare check confirms a person is filling them in.

Purposes and legal bases

• Managing your booking and stay, your account and the discounts for returning guests: necessary for the contract you make with us (art. 6.1.b GDPR).
• Answering your questions before booking: pre-contractual steps you request (art. 6.1.b GDPR).
• Legal obligations (art. 6.1.c GDPR): reporting guests to the Police through the Alloggiati Web portal (art. 109 TULPS), tourism statistics (ISTAT and Tuscany Region), the Florence tourist tax, invoicing and accounting.
• Website security and abuse prevention: our legitimate interest (art. 6.1.f GDPR).

We do not use your data for advertising, newsletters or profiling, and we make no automated decisions about you.

No health data

Many of our guests are close to someone in hospital nearby. The agreement code (Careggi, Meyer, CTO, Villa Ulivella, Faculty of Medicine) is used only to apply the discount: we do not ask for or check any information about anyone's hospital stay or health.

Please do not include it in messages or booking requests. If you share it anyway, we use it only to reply to you and keep it no longer than necessary.

If you do not give us your data

Booking details are needed to confirm the booking. Identity document details are required by law: without them we cannot host you. Everything else is optional.

Recipients

Only our authorised staff see your data. They are also received, each for its own part, by:

• Register.it (Italy), which hosts the website and email, as data processor on servers in the European Union;
• PayPal, if you pay online, as independent controller under its own privacy policy;
• WhatsApp (Meta), only if you choose to write to us there, as independent controller under its own privacy policy;
• SMSTools (Xtreme Internet Solutions BV, Belgium), as data processor in the European Union: it sends the SMS messages about your booking status and the reminder the day before arrival, and receives only your phone number and the message text. The SMS messages never contain information about the reason for your stay;
• Cloudflare, for the anti-spam check on forms (Turnstile): it receives your IP address and technical browser data, not what you type in the fields. It acts as data processor and, to improve bot detection, as independent controller;
• our tax advisor, for accounting;
• the authorities required by law: Police, City of Florence, ISTAT and Tuscany Region, Revenue Agency.

We do not sell or pass your data to anyone else.

Transfers outside the EU

We store data in the European Union. PayPal, WhatsApp and Cloudflare may transfer it outside the EU with the safeguards required by the GDPR (adequacy decisions or standard contractual clauses), as explained in their privacy policies.

How long we keep data

• Bookings, invoices and accounting records: 10 years, as required by law (art. 2220 Italian Civil Code).
• Guest data for the Police: sent within the legal deadlines; we only keep the sending receipts for the period set by law.
• Customer account: until you ask us to delete it.
• Messages: as long as needed to handle your request.
• SMS reminder log (first name, initial of the surname, booking code, date and outcome of the sending): 90 days, then it is deleted automatically.
• Server technical data: for the limited period set by the hosting provider.

What you can ask us

At any time you can ask us to access your data, correct it, delete it (account included), restrict its use, object to processing based on legitimate interest and receive it in a readable format (portability), under articles 15-22 GDPR. Data the law requires us to keep are excluded.

Just write to info@albergosonia.com or to the PEC albergosonia@pec.it. If you believe your data are not handled correctly, you can lodge a complaint with the Italian Data Protection Authority (Garante).

Minors, cookies and changes

Online booking is reserved for adults; we process the data of minors staying with their family only for legal obligations.

The site uses only technical cookies: all details are in the Cookie Policy. Booking rules are in the Conditions.

If we change this policy, we update the date at the bottom of the page.