Privacy Policy

Last Updated: July 15, 2026

1. Data Controller Identity and Contact Details

The Data Controller is:

1.1 Data Protection Officer (DPO)

You can contact our Data Protection Officer for any matter related to the processing of your personal data:

DPO Email: info@twinsrealestate.it

2. Types of Data Collected

We collect different categories of personal data depending on how you use our platform:

2.1 Registration and Profile Data

• Identification data: first name, last name, date of birth
• Contact data: email address, phone number, postal address
• Login credentials: username, password (encrypted)
• Profile photo: voluntarily uploaded image
• Preferences: language, preferred contact method, communication preferences

2.2 Booking Data (Guests)

When you make a booking, we collect:

• Stay details: check-in/check-out dates, number of guests (adults, children, infants)
• Travel information: flight information, arrival/departure times, transportation method
• Identity documents: passport number, nationality (legally required)
• Emergency contact: name and phone number of person to contact in case of emergency
• Special needs: dietary restrictions, accessibility requirements, special requests
• Billing data: billing address, tax ID/VAT number (if invoice requested)

2.3 Payment Data

• Payment information: credit/debit card data (processed via Stripe - we don't store complete card details)
• Transactions: amounts, currency, transaction history, Stripe transaction ID
• Bank details (hosts only): IBAN, SWIFT/BIC to receive payments

2.4 Navigation and Technical Data

• Cookies and similar technologies: unique identifiers, cookie preferences
• Log data: IP address, browser type, operating system, device type
• Usage data: pages visited, time spent, links clicked
• Geolocation data: approximate city and country (from IP address)
• UTM parameters: traffic source, marketing campaign, referrer URL

2.5 Communications

• Emails and messages: content of communications with us and with hosts/guests
• Reviews and feedback: ratings and comments left on properties
• Support requests: customer support tickets and related conversations

2.6 Third-Party Data (Social Login)

If you register via social accounts (Google, Facebook, Apple), we receive:

• First and last name
• Email address
• Profile photo
• Social provider user ID
• Access tokens (to maintain connection)

3. Purposes and Legal Bases for Processing

We process your personal data for the following purposes, with respective legal bases under Art. 6 GDPR:

3.1 Performance of Contract (Art. 6(1)(b) GDPR)

Purpose: Manage bookings, payments, and provide requested services

• Create and manage your user account
• Process bookings and confirmations
• Process payments and refunds
• Facilitate communication between guests and hosts
• Send confirmations, reminders, and check-in instructions
• Provide customer support

Retention: For the duration of the contractual relationship and 10 years thereafter (tax and accounting obligations)

3.2 Legal Obligation (Art. 6(1)(c) GDPR)

Purpose: Comply with legal obligations

• Italian tax regulations: retention of billing data for 10 years
• Anti-money laundering: customer identity verification (Legislative Decree 231/2007)
• Guest reporting to authorities: compliance with art. 109 T.U.L.P.S. (guest data reporting to Police)
• National Identification Code (CIN): compliance with 2025 short-term rental regulations
• Anti-terrorism regulations: identity document verification

Retention: For the period required by law (generally 10 years for tax data)

3.3 Legitimate Interest (Art. 6(1)(f) GDPR)

Purpose: Improve services, prevent fraud, and ensure security

• Fraud prevention and security: detect and prevent fraudulent activities, platform abuse
• Analysis and improvement: analytics to improve user experience and functionality
• Personalized support: provide effective support based on history
• Legal disputes management: legal defense and complaint handling

Balancing of interests: We have assessed that these legitimate interests do not override your fundamental rights and freedoms. You can object to this processing at any time.

Retention: 2 years from last interaction, unless legal requirements apply

3.4 Consent (Art. 6(1)(a) GDPR)

Purpose: Activities requiring your explicit consent

• Marketing and newsletters: sending promotional offers, newsletters, updates on new properties
• Non-essential cookies: analytics, marketing, and functional cookies (see Cookie Policy)
• Profiling: preference analysis for personalized suggestions
• Promotional communications via SMS/WhatsApp: offers and promotions

Right to withdraw: You can withdraw consent at any time via unsubscribe links in emails, in profile settings, or by contacting info@twinsrealestate.it. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

Retention: Until consent withdrawal or 2 years of inactivity

4. Recipients of Personal Data

Your data may be shared with the following categories of recipients:

4.1 Within Our Organization

• Authorized personnel (administrators, booking team, customer service)
• System administrators (for technical maintenance)

4.2 Hosts and Guests

• To Hosts: First name, last name, email, phone, number of guests, booking dates, special requests
• To Guests (if you're a host): Property name, address, check-in instructions, contacts

4.3 Service Providers (Data Processors)

We rely on third-party service providers who process data on our behalf:

• Stripe Inc. (USA): payment processing - Privacy Policy
• Google Analytics: website traffic analysis - Privacy Policy
• Google Maps/Places: geolocation services - Privacy Policy
• Email provider (e.g., Gmail/G Suite): sending communications
• OpenAI/Anthropic: AI chatbot for customer support - Privacy Policy OpenAI, Anthropic
• Hosting provider: server and database infrastructure
• Cloud backup services: secure data backups

All providers are carefully selected and bound by contractual agreements (Data Processing Agreements) that ensure adequate data protection levels.

4.4 Authorities and Public Bodies

Upon request from competent authorities, we may share your data with:

• Police (guest reporting under T.U.L.P.S.)
• Revenue Agency (Agenzia delle Entrate)
• Financial Police (Guardia di Finanza)
• Judicial Authority
• Data Protection Authority (Garante)

5. International Data Transfers

Some of our service providers are located outside the European Union, particularly in the United States (Stripe, Google, OpenAI/Anthropic).

Adequate safeguards:

• Adequacy decisions: Some transfers are to countries recognized by the EU Commission as having adequate protection levels
• Standard Contractual Clauses (SCC): We use Standard Contractual Clauses approved by the EU Commission to ensure GDPR-equivalent protection
• Privacy Shield: Some providers adhere to the EU-US Privacy Shield framework (where applicable)
• Certifications: We verify that providers have ISO 27001, SOC 2, etc. certifications

More information on international transfers is available by contacting info@twinsrealestate.it

6. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected:

Data Category	Retention Period	Legal Basis
Account registration data	Until account deletion + 1 year	Legitimate interest (legal disputes)
Booking data	10 years from booking	Legal tax obligation (Art. 2220 Civil Code)
Billing and payment data	10 years	Legal tax obligation
Identity documents	According to T.U.L.P.S. regulations	Legal obligation
Marketing data (with consent)	Until consent withdrawal or 2 years of inactivity	Consent
Analytics/marketing cookies	According to Cookie Policy (max 13 months)	Consent
System logs	6 months	Legitimate interest (security)
Email/chat communications	2 years from last communication	Legitimate interest

Upon expiration of retention periods, data is securely deleted or irreversibly anonymized.

7. Your Rights (Art. 15-22 GDPR)

Under GDPR, you have the following rights:

7.1 Right of Access (Art. 15 GDPR)

You can obtain confirmation whether personal data concerning you is being processed and, if so, obtain a copy of the data and information about the processing.

How to exercise: Request data export or email info@twinsrealestate.it

7.2 Right to Rectification (Art. 16 GDPR)

You can obtain rectification of inaccurate personal data concerning you and completion of incomplete data.

How to exercise: In Profile Settings or contact info@twinsrealestate.it

7.3 Right to Erasure ("Right to be Forgotten") (Art. 17 GDPR)

You can obtain deletion of your personal data in the following cases:

• The data is no longer necessary for the purposes for which it was collected
• You have withdrawn consent and there is no other legal ground
• You have objected to processing based on legitimate interest
• The data has been unlawfully processed
• The data must be deleted to comply with a legal obligation

Limitations: We cannot delete data necessary to:

• Comply with legal obligations (e.g., 10-year retention of tax data)
• Establish, exercise, or defend legal claims

How to exercise: Request account deletion

7.4 Right to Restriction of Processing (Art. 18 GDPR)

You can obtain restriction of processing when:

• You contest the accuracy of the data (for the period necessary for verification)
• Processing is unlawful but you oppose deletion
• You need the data for legal defense
• You have objected to processing (pending verification)

How to exercise: Email info@twinsrealestate.it

7.5 Right to Data Portability (Art. 20 GDPR)

You can receive the data concerning you in a structured, commonly used, and machine-readable format, and transmit it to another controller.

How to exercise: Request data export (JSON format)

7.6 Right to Object (Art. 21 GDPR)

You can object at any time to processing of your data for:

• Marketing purposes: Click "Unsubscribe" in emails or Manage email preferences
• Processing based on legitimate interest: Email info@twinsrealestate.it

7.7 Right to Withdraw Consent

For consent-based processing, you can withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

How to exercise: Manage consent preferences

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority:

Response Times

We will respond to your requests within 30 days of receipt. In complex cases, we may extend the deadline by an additional 60 days, informing you of the reasons for the delay.

8. Data Security

We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

8.1 Technical Measures

• Encryption: HTTPS/TLS connections for all communications, database encryption for sensitive data
• Pseudonymization: IP address anonymization for analytics
• Firewall and DDoS protection: Advanced perimeter protection
• Automatic backups: Daily encrypted backups with geographically distributed storage
• Strong authentication: Robust password policies, 2FA availability
• Logging and monitoring: Access and anomaly monitoring
• Vulnerability scanning: Regular security scans

8.2 Organizational Measures

• Limited access: "Need to know" principle, role-based access
• Staff training: Periodic GDPR and data security training
• Confidentiality agreements: All employees sign NDAs
• Data Protection Impact Assessment (DPIA): For high-risk processing
• Data Breach procedures: Response plan within 72 hours as per Art. 33 GDPR

8.3 In Case of Data Breach

In case of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you within 72 hours of discovering the breach, describing:

• Nature of the breach
• Categories and approximate number of data subjects concerned
• Likely consequences
• Measures adopted or to be adopted to address it

9. Automated Decision-Making and Profiling

We use automated decision-making processes to a limited extent:

9.1 AI Chatbot

Our chatbot uses artificial intelligence (OpenAI GPT/Anthropic Claude) to:

• Answer frequently asked questions
• Assist in property search
• Support during the booking process

Limitations: The chatbot does not make decisions producing legal effects or significantly affecting you. A human operator always supervises important conversations.

9.2 Anti-Fraud System

We use algorithms to detect suspicious behavior and prevent fraud (e.g., fraudulent bookings, stolen cards).

Rights: You have the right to:

• Obtain human intervention
• Express your opinion
• Contest the decision

9.3 Profiling (with consent only)

With your explicit consent, we may analyze your preferences to:

• Suggest properties that might interest you
• Personalize offers and promotions
• Send themed newsletters

You can object to profiling at any time in Consent Preferences.

10. Cookies and Tracking Technologies

We use cookies and similar technologies. For detailed information, see our Cookie Policy.

Manage cookies: Cookie Preferences

11. Changes to This Policy

We may update this policy periodically to reflect changes in our practices or for other operational, legal, or regulatory reasons.

Change notification:

• Material changes will be highlighted at the top of the page
• Registered users will receive an email notification
• The "Last Updated" date will always be updated

We encourage you to review this page regularly.

12. Minors

Our services are not intended for persons under 18 years of age. If a parent or guardian becomes aware that their child has provided us with data without consent, they must contact us immediately at info@twinsrealestate.it and we will proceed with deletion.

For bookings including minors, it is the responsibility of the adult making the booking to provide necessary data in compliance with minors' privacy regulations.

13. Links to Third-Party Sites

Our site may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to read the privacy policies of every site you visit.

14. Applicable Law and Jurisdiction

This policy is governed by Italian law. For any dispute relating to the interpretation or execution of this policy, the Court of Milan shall have jurisdiction, except for different mandatory jurisdiction provided by law.

15. Contact

For any questions, requests, or exercise of your rights, you can contact us:

Related Documents

• Terms and Conditions
• Cookie Policy
• Manage Consent Preferences
• Export Your Data
• Request Account Deletion