Via dei Cappuccini, 38, Empoli · 5 minutes' walk from the stationVia dei Cappuccini, 38 · 5 min from the stationENIT
Check availability Book
+39 331 168 2664 Via dei Cappuccini, 38, Empoli

Privacy

Privacy notice

What data we process when you visit the website, write to us or stay with us, why, for how long, and how to exercise your rights.

Last updated: 24 October 2026

This notice explains how we handle the data of people who visit this website, write to us, book and stay with us, including when the booking comes from a booking platform or is made by someone else. It also applies to our booking engine at empoli-rooms.amenitiz.io. It is a translation of the Italian notice: if the two differ, the Italian text prevails.

Data controller

HOME TRAVEL SOLUTION S.r.l. a socio unico (a single-member limited company), Via Donizetti 21/2, 50053 Empoli (FI), Italy, tax code and VAT no. 07367870487, certified email (PEC) hometravelsolution@pec.it. It runs Empoli Rooms, Via dei Cappuccini 38, Empoli.

For any question about your data: empolirooms@gmail.com, phone +39 331 168 2664. We have not appointed a data protection officer (DPO): for a business like ours the law does not require one (Article 37 of Regulation (EU) 2016/679, the “GDPR”).

What data we process

  • Browsing. The website is hosted by Netlify, which logs the IP address, browser, requested page, referring page and time of each visit. The website uses no cookies and no analytics or profiling tools.
  • Prices and availability. When you open the calendar or choose dates and guests in the booking bar or on the Book page, your browser sends them to our booking engine, run by Amenitiz, together with your IP address. No name, no cookies. From a phone, the request also carries the code for the prices reserved for bookings made from a phone.
  • Form for companies and long stays. Company, contact person, email, phone, type of request, number of people, dates and notes. Netlify, which receives the form, also logs the IP address, browser, page of submission and date, and checks every submission with the Akismet spam filter. The request stays in the Netlify dashboard and reaches us by email. In the notes, write only what the request needs: we do not need any health information.
  • Email, WhatsApp and phone. What you write or tell us, and the contact details you use.
  • Direct booking. Name, contact details, dates, room, number of guests, requests, amounts and payment details, collected by our booking engine.
  • Booking through a platform or made by someone else. If you booked on Booking.com, Airbnb or Expedia, or your company or another guest booked for you, the data reaches us from them: your name, the contact details they pass on, dates and room, number of guests, price, requests and, where applicable, payment or invoicing details.
  • Stay. The identity document details of every guest and, if you check in online, a photo of the document and a photo of your face, which we use only to check that the document is yours; invoicing and receipt details; for stays over thirty nights, the details in the rental contract; if you ask for an exemption from the tourist tax on health grounds, the declaration required by the Municipality of Empoli’s regulations.
  • Reviews. What you write in the “Leave a review” form: the text, your first and last name, when you stayed and, if you give them, your booking number, where you’re from, the purpose of the trip and your email. We use your name, dates and booking number to find the booking, and your email only if we can’t find it. If you consent, the website shows the text, your first name without surname, the month of your stay and, if you gave them, where you’re from and the purpose of the trip. As with the other form, Netlify also logs the IP address, browser, page of submission and date and checks the submission with the spam filter; the review stays in the Netlify dashboard and reaches us by email.

Why we process it and on what legal basis

  • Answering requests and showing you prices and availability: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). Your consent is not needed for this.
  • Managing bookings, stays, payments and contracts: performance of the contract (Article 6(1)(b)).
  • Identifying guests, reports to the police (Questura), official statistics, tourist tax, invoices, accounting and registration of rental contracts: legal obligations (Article 6(1)(c)). For health information in an exemption request: reasons of substantial public interest laid down by law (Article 9(2)(g) GDPR).
  • Protecting the website and the forms from attacks, abuse and spam (technical logs, spam filter): our legitimate interest in the security of the website (Article 6(1)(f)).
  • Establishing, exercising or defending our rights in a dispute: our legitimate interest (Article 6(1)(f)).
  • Publishing your review: your consent (Article 6(1)(a)), which you can withdraw at any time.
  • Checking, before publishing it, that whoever writes a review has stayed with us, and keeping a record of the check: our legitimate interest in publishing only genuine reviews and being able to prove it, as required by Italian Law 34/2026 and the Consumer Code (Article 6(1)(f)).

Identity documents and mandatory reports

  • Police (Questura). We can only accommodate people with a valid identity document. Within 24 hours of arrival, or within 6 hours for stays of up to 24 hours, we report to the Questura, through the State Police’s Alloggiati Web portal, the surname, first name, sex, date and place of birth and citizenship of every guest; for guests travelling alone and for the head of a family or group, also the type, number and place of issue of the document (Article 109 of the Italian Consolidated Law on Public Security).
  • Online check-in. After booking you receive by email a link to Vikey’s online check-in, the service we use to collect documents: there you upload a photo of the document and a photo of your face. We check that the details and the photos match and confirm the check-in; the photos are then deleted. The document details are used for the report to the Questura.
  • Documents sent another way. If you send us a photo or a copy of your document by email or WhatsApp, we use it only for check-in and for the report to the Questura, and delete it as soon as the portal issues the receipt.
  • Statistics. We report arrivals and overnight stays, without names, to the Metropolitan City of Florence, which collects the data for ISTAT (the Italian national statistics institute) and the Region of Tuscany.
  • Tourist tax. We collect it on behalf of the Municipality of Empoli and report to it the number of guests, nights and exemptions, without names. Exemption declarations are kept available for the Municipality’s checks.

How long we keep it

  • Requests, emails and messages that do not lead to a booking: up to 24 months from the last contact. Then we delete them, including from the Netlify dashboard and our mailbox.
  • Messages relating to a stay: up to 24 months after departure.
  • Booking data, invoices, receipts, payments and contracts: 10 years, for accounting and tax obligations and to establish or defend rights arising from the contract (Articles 2220 and 2946 of the Italian Civil Code).
  • Receipts of the reports to the Questura: 5 years. We delete the data sent and the copies of documents as soon as the portal issues the receipt (Decree of the Ministry of the Interior of 7 January 2013, Article 4-bis).
  • Photos uploaded for online check-in: deleted as soon as we confirm the check-in.
  • Tourist tax exemption declarations: as long as the Municipality can carry out checks, that is until 31 December of the fifth year after the year of the annual return (Law 296/2006, Article 1(161)).
  • Published reviews: two years, or less if you withdraw your consent first: in that case we take the review off the website as soon as we receive your request. The form it came with stays in the Netlify dashboard for the same time, as proof of consent and of the check.
  • Reviews we do not publish (for example because we cannot find the stay, or because they arrive more than 30 days after departure): deleted within three months of submission, including from the Netlify dashboard and our mailbox.
  • Netlify and Amenitiz technical logs: for the short period the two providers set for the security of the service.

Who receives the data

Only people who work with us, authorised and instructed, handle it. On our behalf, as processors (Article 28 GDPR), it is processed by:

  • Netlify, Inc. (San Francisco, United States): website hosting and receipt of the forms;
  • Amenitiz Solutions S.L. (Barcelona, Spain): booking engine, property management system and connection with the booking platforms;
  • Vikey (Rome, Italy): online check-in, collection and verification of documents and preparation of the mandatory reports;
  • our accountant, for invoicing and bookkeeping.

It is also received, each for its own purposes and under its own rules, by:

  • Google: our mailbox is a Gmail account, so emails and form submissions are stored on Google’s servers (Google’s privacy policy);
  • WhatsApp (WhatsApp Ireland Limited, Meta group), if you choose to write to us there;
  • the booking platforms your booking comes from, and the company that booked for you;
  • banks and payment service providers, for payments and refunds;
  • public authorities, where the law requires it: the Questura, the Metropolitan City of Florence, the Municipality of Empoli and the Italian Revenue Agency (also for electronic invoices, through the Exchange System, SdI).

We do not sell your data or pass it on to others for advertising.

Data outside the European Union

Netlify processes technical logs and form data in the United States. Netlify, Inc. participates in the EU-U.S. Data Privacy Framework: the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Article 45 GDPR). Our contract with Netlify also includes the standard contractual clauses approved by the Commission (Article 46 GDPR), which apply if the Data Privacy Framework could no longer be used.

Amenitiz processes data in the European Economic Area; some of its providers (hosting, payments, message delivery, images, technical monitoring) are in the United States and receive data under the Data Privacy Framework or standard contractual clauses. The same applies to Vikey: if one of its providers processes data outside the European Union, the transfer must be based on the Data Privacy Framework or standard contractual clauses. Google LLC and WhatsApp LLC, which participate in the Data Privacy Framework, also process data in the United States, according to their own privacy policies.

You can check participation at dataprivacyframework.gov and ask us for a copy of the standard contractual clauses by writing to empolirooms@gmail.com.

Your rights

At any time you can ask us to:

  • tell you whether we process your data and give you a copy (Article 15 GDPR);
  • correct or complete it (Article 16);
  • delete it, unless we must keep it by law or to defend a right (Article 17);
  • restrict its use, for example while we check a complaint of yours (Article 18);
  • give it to you in a machine-readable format, or send it to another controller, if you gave it to us for a contract or with your consent (Article 20);
  • withdraw a consent: this takes effect from that moment and does not make what was done before unlawful (Article 7(3)).

Write to empolirooms@gmail.com or to our certified email hometravelsolution@pec.it. We reply within one month; if the request is complex we may extend this by two further months, letting you know within the first month (Article 12(3)). If we are not sure the request comes from you, we will ask you to confirm your identity.

Right to object

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest: the security of the website and the forms, the checking of reviews and the defence of our rights. In that case we stop, unless there are compelling legitimate grounds or we need to establish, exercise or defend a legal claim (Article 21 GDPR).

Complaints

If you believe the processing breaks the law, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the EU country where you live or work (Article 77 GDPR).

Do you have to give us your data?

  • Form for companies: company, contact person and email (the fields marked with an asterisk) are needed to reply to you; without them we cannot. The other fields are optional.
  • Booking: the details the booking engine asks for are needed to conclude the contract; without them we cannot accept the booking.
  • Identity document: required by law; without it we cannot accommodate you.
  • Review: this is your choice; if you decline, nothing else changes. In the review form, your first and last name and the dates of your stay are needed to find the booking: without them we cannot publish the review.

Automated decisions

We do not take decisions based solely on automated processing, including profiling (Article 22 GDPR).

Changes

If we change this notice, we update the date at the top of the page.