EN
Book

Information notice pursuant to EU Regulation 2016/679

Privacy policy

Last updated: 6 November 2026

This notice explains how we process the personal data of people who visit the website, contact us or stay with us at Duccio Nacci Rooms (Via S. Stefano 6) and La Rocca Romantica apartment (Via della Rocca 6), San Gimignano.

Data controller

Duccio Nacci, sole proprietorship, VAT IT00943570523, tax code NCCDCC67S07H875E, registered office Piazza Duomo 13, 53037 San Gimignano (SI). Privacy contact: info@duccionaccirooms.it.

What data we process

  • Contact data that you send us via the form, email, phone or WhatsApp: name, email, phone and content of the message.
  • Booking data: name, contact details, dates of stay, number of guests, any requests and payment data (handled by the booking system and the payment networks).
  • Guest data required by law: personal details and identity document details of each guest.
  • Browsing data: technical data collected automatically by the website platform (for example IP address and browser type). See also the Cookie policy.

Why we process it and on what legal basis

  • To answer your requests and manage the booking and the stay: performance of a contract or pre-contractual measures (Art. 6.1.b GDPR).
  • To report guests' details to the police through the Alloggiati Web portal, manage the tourist tax and tourism statistics, keep accounts and invoices: legal obligations (Art. 6.1.c GDPR).
  • Security and technical operation of the website: legitimate interest (Art. 6.1.f GDPR).

Providing the data needed for the booking and required by law is mandatory: without it we cannot confirm the stay.

Who it may be shared with

The data is processed by the controller and by family members who help run the business. It may be shared, only for the purposes stated, with:

  • Xenion (Tobu Group), booking system and channel manager;
  • the booking sites you may book through (for example Booking.com, Airbnb, Expedia), which are themselves controllers of the data they collect;
  • our accountant, for tax obligations;
  • public authorities where required by law: Police (Alloggiati Web), Municipality of San Gimignano (tourist tax), Tuscany Region and ISTAT (statistics);
  • the technical providers of the website and email: WordPress.com (Automattic), Zoho for email, Google for the map.

Some of these providers may process data outside the European Union. In these cases the transfer takes place with the safeguards provided by the GDPR, such as standard contractual clauses or the EU-US Data Privacy Framework.

How long we keep it

  • Information requests without a booking: for the time needed to reply and in any case no longer than 12 months.
  • Booking data and tax documents: for the period required by tax law (usually 10 years).
  • Data sent to the police: we do not keep it longer than required by law.

Your rights

You can at any time request access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest, by writing to info@duccionaccirooms.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

We do not use your data for automated decisions or profiling.