Privacy notice

Last updated: 11 October 2026

Who processes your data

The data controller is Leonardo Antonelli, owner of Residenza Girasole Vatican, national identification code IT058091C2AUPLHSK7.

You can reach him on +39 335 538 3923 or at the email address shown at the bottom of this page.

What we collect

When you book: name, email address, telephone number, dates of stay, number of guests and number of children under ten, which is used only to estimate the city tax.

When you pay: card details never pass through our systems. They are collected directly by Stripe, which acts as an independent controller for security and fraud prevention. We keep only the transaction reference and the amount.

When you visit: the hosting server records IP address, date, time and page requested, as any web server does. These logs serve security purposes and are kept by the hosting provider.

The site uses no cookies, has no analytics and loads nothing from third-party servers. The cookie page explains this in detail.

Why we process it and on what basis

To manage your booking and stay: the legal basis is performance of the contract. Without this data we cannot accept the booking.

To comply with legal obligations: reporting guests to the police within twenty-four hours of arrival, regional statistical reporting, collection of the city tax, and retention of accounting and tax records.

For site security and abuse prevention: legitimate interest of the controller, limited to server logs.

Who we share it with

Stripe, to collect the deposit. The hosting provider, which hosts the site and the mail. The authorities we are required to report to: police headquarters, Lazio Region, City of Rome, Italian Revenue Agency.

We do not sell your data, we do not pass it on for commercial purposes and we do not use it to profile you.

Transfers outside the European Union

Stripe may process some data outside the European Economic Area, on the basis of the standard contractual clauses approved by the European Commission. No other transfer takes place.

How long we keep it

Personal booking data: twenty-four months from the departure date, then anonymised.

Accounting and tax records: for the period required by law, currently ten years.

Server logs: according to the hosting provider's retention policy.

Your rights

You can request access to your data, its correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interest.

Some requests may be limited by legal obligations: for example we cannot erase data we are required to keep for tax reasons.

If you believe the processing breaches the European regulation you can lodge a complaint with the Italian data protection authority, www.garanteprivacy.it.

Automated decisions

We do not take decisions based solely on automated processing and we do not carry out profiling.