Privacy policy
Last updated: 16 October 2026
This policy explains how we process the personal data of people who visit domusduca.com, contact us or stay in our apartments, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003.
1. Data controller
Papone Claudio Marcello, sole proprietorship trading as Domus Duca
Registered office: Via Sergio Forti 23, 00144 Roma, Italy · VAT no. IT16650431006 · REA RM-1754654
Email: domusduca@gmail.com · Certified email (PEC): paponeclaudiomarcello@pecimprese.it · Phone +39 349 1120168
No Data Protection Officer has been appointed, as this is not required for our activity.
2. What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Running and securing the website | Technical browsing data (IP address, browser, pages requested) recorded in server logs by the hosting provider | Legitimate interest in website security (Art. 6(1)(f)) | According to the hosting provider's policy, normally no longer than 30 days |
| Answering enquiries by email, phone or WhatsApp | Name, contact details, content of your message | Pre-contractual steps at your request (Art. 6(1)(b)) | As long as needed to handle the request, up to 24 months |
| Booking and managing your stay | Identity and contact details, dates, number of guests, preferences, messages | Performance of the contract (Art. 6(1)(b)) | For the duration of the relationship and then as required by law |
| Registration of guests with the Italian police (Alloggiati Web, Art. 109 TULPS) | Identity and ID document details of every guest | Legal obligation (Art. 6(1)(c)) | Data are transmitted to the police; we do not keep copies of documents longer than necessary |
| Official statistics (ISTAT/Lazio Region) and Rome tourist tax | Number of guests, nationality/residence, age, dates of stay | Legal obligation (Art. 6(1)(c)) | As required by the applicable rules |
| Invoicing, accounting and tax obligations | Billing and payment data | Legal obligation (Art. 6(1)(c)) | 10 years (Art. 2220 Italian Civil Code) |
| Email offers about similar stays to former guests | Name, email, language | Art. 130(4) Legislative Decree 196/2003 (“soft opt-in”) and legitimate interest | Until you object, and no longer than 24 months after your last stay |
| Offers by WhatsApp, text message or newsletter | Name, phone number or email | Only with your consent (Art. 6(1)(a)) | Until you withdraw consent |
| Defending our rights in case of disputes | Data relating to the stay and communications | Legitimate interest (Art. 6(1)(f)) | For the duration of any dispute |
Providing the data required for the booking and by law is necessary: without it we cannot conclude the contract or host you. You can object to promotional messages at any time, free of charge, using the link in every email or by replying “STOP”.
3. Cookies and website tools
This website does not use profiling cookies, analytics or tracking tools and does not embed social-network content. Fonts are hosted on our own server, with no calls to external services. The only thing stored in your browser (localStorage) is the technical note “banner closed”, if you close the offers banner; you can delete it at any time in your browser settings. For this reason no cookie consent banner is needed.
When you press “Check availability” or “Book” you are taken to the Kross Booking booking engine (domusduca.kross.travel), which may use its own technical cookies and, with your consent, analytics cookies: the privacy notice published on the booking engine then applies. Links to Airbnb and WhatsApp lead to third-party services governed by their own policies.
4. Who we share data with
Data are processed by us and by authorised, instructed people (e.g. staff for check-in and cleaning). They may be shared with:
- suppliers acting as data processors under Art. 28 GDPR: property-management and booking software (Kross Booking), website hosting provider, email services, payment service providers, our accountant;
- public authorities where required by law (police, ISTAT/Lazio Region, Roma Capitale, Italian Revenue Agency);
- booking platforms (Airbnb, Booking.com) when you book through them: they act as independent controllers under their own policies;
- the owner of the apartment, limited to the data needed to report on the stay.
We never sell or hand over your data to third parties for their marketing.
5. Transfers outside the European Union
Some suppliers (for example email or messaging services such as Google and WhatsApp/Meta) may process data in the United States. Such transfers rely on the EU-US adequacy decision (Data Privacy Framework) or on the European Commission's standard contractual clauses.
6. Your rights
You may at any time request access to your data, rectification, erasure, restriction of processing and portability, and you may object to processing based on legitimate interest and to marketing (Arts. 15–22 GDPR). Where processing is based on consent, you may withdraw it at any time without affecting earlier processing. To exercise your rights, write to domusduca@gmail.com: we reply within 30 days.
You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your EU country of residence.
7. Security
We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or destruction. The website is served only over an encrypted connection (HTTPS) and does not collect data through forms of its own.
8. Changes
We may update this policy; the current version is always published on this page with its last-updated date.