Privacy notice

This notice explains what personal data we collect, why, and what rights you have. It is written under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

Who is responsible

casbenat — short-term holiday rental (locazione turistica)
Via Giuseppe Cesare Abba 6, 21100 Varese (VA), Italy
CIN IT012133C2UIHK6LFS · CIR 012133-LNI-00076

For anything about your data, write to privacy@casbenat.com. We reply within one month.

Browsing this website

This website sets no cookies and uses no analytics or tracking. There is no Google Analytics, no advertising pixel and no social media tracker, and fonts are served from our own server rather than from third parties. Nothing you do here is profiled or shared.

Our hosting provider, Aruba S.p.A. (Italy), keeps standard server logs that may include your IP address, for the technical operation and security of the site. Legal basis: our legitimate interest in keeping the service running and secure (Art. 6(1)(f) GDPR).

Your identity document

Italian law requires us to check the identity of every guest and to report it to the State Police within 24 hours of arrival. To do that we need to see your document and take down the details printed on it.

We do not keep copies. As soon as the police portal confirms that the report has gone through, the images are deleted and the document numbers are removed from our records. What we keep is the receipt issued by the portal — our proof that we complied, not your document.

How we read your document. To save you typing, the images you upload are read automatically and the details printed on them are filled into the form for you. Nothing is submitted on your behalf: you check every field and confirm it before anything is sent to the authorities.

This reading happens outside the EU. The images are transmitted to Anthropic PBC (United States), which processes them on our instructions under a data processing agreement and does not use them to train its models. Anthropic keeps the images for up to 30 days and then deletes them; we keep none at all. The transfer is covered by the European Commission’s Standard Contractual Clauses. If you would rather your document was not read this way, tell us at privacy@casbenat.com or simply show us the document on arrival — we will take the details down by hand, and it changes nothing else.

Please do not send photographs of documents over WhatsApp or other messaging apps: those copies stay on servers neither of us controls. Use the secure upload link we send you before arrival, or simply show us the document when you get here.

Legal basis: legal obligation (Art. 6(1)(c) GDPR; Art. 109 of the Italian Consolidated Public Security Act).

What we must report

Italian law requires us to report:

• your identification details to the Alloggiati Web portal of the State Police, within 24 hours of your arrival;
• the number of arrivals and nights and your area of origin to the regional tourist statistics system (ROSS1000), which passes aggregated figures to the national statistics institute — this report does not carry your name;
• the information needed for the tourist tax to the local authority.

Legal basis for all three: legal obligation (Art. 6(1)(c) GDPR).

Access to the property

Guests receive access to our smart lock system, BravoKey, and to the heating controls, BravoTemp.

What we collect

• your email address, used as your login and to send you your access credentials
• a personal access PIN, stored in encrypted form — we cannot read it
• access logs: date, time, which door was opened, the outcome, your IP address and browser
• your stay dates, which determine when your credentials work

Why we collect it. To let you into the property and control the heating (performance of our accommodation contract, Art. 6(1)(b) GDPR), and to keep the property and our guests secure — for example by detecting attempts to force the locks (legitimate interest, Art. 6(1)(f) GDPR).

Being clear about the access logs. The log records when each door is opened, so it shows when you came and went during your stay. We consider this sensitive and treat it accordingly: it is visible only to us as owners, it is never shared, and it is used only to operate and secure the property — for instance to check an access dispute or to detect an intrusion attempt.

How long we keep it. Your guest account and credentials stop working at the end of your stay and are deleted within 30 days. Access logs are kept for 90 days and then deleted: long enough to settle a dispute about an access or to look into an intrusion attempt, and no longer.

Video surveillance

External cameras cover the outdoor common areas only, never the interior of the apartments, and they are positioned so as not to film the public street or neighbouring property. The video door entry system at the entrance also shows and records callers.

Signage is displayed on site before the filmed areas, as required. Recordings are kept for 48 hours and then automatically overwritten. We do not keep them as a record of your check-in, and we do not run face recognition on them.

Legal basis: our legitimate interest in the security of the property and of our guests (Art. 6(1)(f) GDPR).

Booking and payment records

The details of your booking — name, contact details, dates and amounts — are kept for 10 years, as Italian tax and accounting law requires. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

Who else sees your data

We do not sell your data and we do not share it for marketing. It is processed by the following, strictly to provide the service:

• Aruba S.p.A. (Italy, EU) — hosting of this website and its database
• Allterco Robotics (Shelly) — the cloud service that operates the locks and the heating
• Anthropic PBC (United States) — automated reading of the identity documents you upload, under Standard Contractual Clauses; images deleted within 30 days
• Airbnb, if you booked through the platform, under its own privacy policy

Your rights

You may ask us to access, correct, delete or export your data, and to restrict or object to its processing. Write to privacy@casbenat.com and we will reply within one month.

You may also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).

Changes

If we change how we handle your data we will update this page and change the date at the top.