Information on the processing of personal data pursuant to Articles 13-14 of Regulation (EU) 2016/679 (GDPR)
1. Data controller
N&M S.r.l. – VAT no. 14412880966 – Via Santa Maria 32/22, 20061 Carugate (MI), Italy
Email: [email protected] – Certified email (PEC): [email protected]
2. Personal data we process
- Identity and contact details: first and last name, email, phone number, address, country of residence.
- Booking data: stay dates, apartment, number and details of guests, special requests.
- Guests' identity data and documents, collected through the online check-in as required by law.
- Payment data: card payments are processed by Stripe; the Controller does not store full card details. For bank transfers we process the data needed to reconcile the payment.
- Browsing data and technical and analytics cookies (see section 9).
- The content of communications you exchange with us (emails, messages, reviews).
3. Purposes and legal bases
- Handling booking requests, the stay contract, payments and customer support: performance of a contract (Art. 6.1.b GDPR).
- Reporting guests' details to the public security authority through the Alloggiati Web portal (Art. 109 of the Italian Public Security Law), sending statistical data (ISTAT/Region), managing and declaring tourist tax, complying with tax and accounting obligations: legal obligation (Art. 6.1.c).
- Preventing fraud, protecting the properties and defending our rights, including in court: legitimate interest (Art. 6.1.f).
- Anonymous or aggregated statistics on site usage: for non-technical cookies, consent (Art. 6.1.a), which you may withdraw at any time.
4. Mandatory nature of data
Providing the data marked as mandatory in the booking form and online check-in is necessary to conclude the contract and comply with legal obligations. Without it we cannot confirm your stay or hand over the apartment.
5. Recipients
Data may be shared with: Krossbooking (booking and check-in software provider, appointed as data processor); Stripe (payments); the Questura / Italian State Police (Alloggiati Web); ISTAT and regional bodies; the municipalities of Milan, Bergamo, Busto Arsizio, Olgiate Olona and Gallarate for tourist tax; tax, legal and accounting advisers; technical, guest-communication and operational service providers (cleaning, access), only as needed. Data is never sold or disclosed to the public.
6. Transfers outside the EU
Some providers (e.g. Stripe) may process data outside the European Economic Area. Any such transfer is based on adequacy decisions or on standard contractual clauses approved by the European Commission.
7. Retention
- Contractual, accounting and tax data: 10 years.
- Identity documents: only as long as necessary for public-security formalities, then deleted.
- Contact data for enquiries that did not lead to a booking: up to 12 months.
- Cookies: for the duration stated in the cookie policy.
8. Your rights
You may at any time exercise your rights of access, rectification, erasure, restriction, portability and objection (Arts. 15-22 GDPR) and withdraw consent by writing to [email protected] or to the PEC [email protected]. You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
9. Cookies
This site uses technical cookies, necessary for the booking engine to work, and analytics cookies. On your first visit you can accept or reject them through the banner, and you can change your choice at any time in your browser settings. Analytics cookies are not installed before you consent.
10. Changes
This notice may be updated; the version published on this site is the one in force. Last updated: 28/09/2026.