Nautilux Homes · Information about your data

Privacy notice

How we process the data of people who visit this website, request information or stay in Nautilux Homes accommodation, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Last updated: 26 October 2026

1. Who is the data controller

Christelle Gertosio, the proprietor, is responsible for managing the data. Service providers and local agencies or partners appointed to welcome guests may assist solely with their assigned activities, as described in this notice.

2. What data we process

• Website browsing: IP address and technical data about the browser, device, access and server requests, necessary for operation and security.
• Information requests: name, email, telephone number, message contents, preferred dates and number of guests, if provided by email, telephone, WhatsApp or other contact channels.
• Bookings and stays: identification and contact details of the person booking and the guests, dates, selected accommodation, information needed to organise their welcome, administrative and billing data, document details and other information required by applicable obligations.
• Website statistics: information about pages viewed, interactions and traffic sources, collected through Google Analytics 4 where consent to statistical cookies has been given.

Data are collected directly from the individual, from the person booking on behalf of other guests or, where used, from booking platforms and services. Anyone providing another person’s data must be entitled to do so and inform them about the processing. Please do not send health information or other unnecessary special category data in general enquiries.

3. Why we use the data

• Answering enquiries and preparing a stay: pre-contractual steps requested by the individual, under Article 6(1)(b) GDPR.
• Managing bookings, stays, assistance and guest welcome: performance of the contract, under Article 6(1)(b) GDPR.
• Meeting administrative, accounting, tax, public security and statistical obligations: compliance with legal obligations, under Article 6(1)(c) GDPR.
• Ensuring services operate securely, preventing misuse and protecting rights: the controller’s legitimate interests, under Article 6(1)(f) GDPR, with due regard for individuals’ rights and freedoms.
• Analysing visits using non-essential statistical tools: consent, under Article 6(1)(a) GDPR. Consent may be refused or withdrawn without preventing access to the website’s information.

Data are not used for further purposes incompatible with those for which they were collected. Any promotional communications require a separate legal basis and the relevant information; an enquiry or booking does not, by itself, constitute consent to advertising.

4. Alloggiati Web and regional statistics

For public security requirements, guest data required by law are communicated to the Italian State Police through Alloggiati Web. Processing is based on a legal obligation and does not require the guest’s consent.

For mandatory tourism statistics, the required data are sent to the Autonomous Region of Sardinia through SIRED/ROSS1000 for regional and ISTAT statistical purposes. Disclosures are limited to the data required for each obligation.

The receiving authorities and bodies process data within their respective responsibilities and under their own privacy notices. Refusing to provide mandatory data may prevent the stay from being provided if identification and reporting obligations cannot be met.

5. Who may receive or process the data

In addition to the proprietor, the following may process data to the extent necessary for their activities:

• IT and technical providers: website hosting and infrastructure supplied by Aruba, email and communication services, maintenance and technical support where appointed.
• Booking and stay services: KrossBooking and any platforms or payment services used in the particular procedure. Their screens may contain additional privacy information from the service concerned.
• Local agencies and partners appointed to welcome guests: to organise arrivals, contacts, key handover, check-in and assistance. They receive only information necessary for their assignment and, where required by the assigned activity, for identifying guests.
• Administrative, tax or legal advisers: where appointed and to the extent needed for compliance or protecting rights.
• Providers of services chosen by the user: for example WhatsApp for communications, Google for Analytics and maps, and Facebook and Instagram when links to those services are opened.
• Competent authorities and bodies: in particular the Italian State Police and the Sardinia Region/ISTAT, and other recipients required by law.

Parties acting on the controller’s behalf must be appointed and instructed according to their actual role, including through the agreements required by Article 28 GDPR when acting as processors. Other recipients may act as independent controllers for activities within their responsibility. Information about the providers actually involved and their roles can be requested from info@nautiluxhomes.com.

Enquiry, booking and identity document data are neither published on the website nor sold.

6. Software, automation and artificial intelligence

Software tools, including artificial intelligence tools such as OpenAI’s ChatGPT, may be used for organisation, drafting and translating content and operational support.

Any future use of these tools with guests’ identifying data to assist with Alloggiati Web or ROSS1000 submissions is subject to prior verification of the service, contractual terms, privacy roles, retention periods and any international transfers. Only data necessary for the particular task will be used; this notice will be updated before that processing is activated.

Assistance with completing submissions does not replace the proprietor’s responsibility to check the data and communications to be made. AI tools are not entrusted with solely automated decisions that produce legal or similarly significant effects on guests.

7. How long we retain data

• Enquiries that do not result in a booking: up to 12 months after the last contact, unless further retention is necessary for a dispute or legal obligation.
• Stay management and assistance: for as long as needed to manage the booking, stay and subsequent requests for assistance. Correspondence no longer needed and not subject to a different obligation is deleted according to the 12-month period from the last contact.
• Contractual, accounting and tax documents subject to retention: for the applicable statutory periods; accounting documents are ordinarily kept for 10 years from the last entry, unless longer periods are required by inspections or applicable rules. This period does not entail retaining all data or identity document copies indiscriminately.
• Identity documents and files prepared solely for public security: any temporary document copies and data collected solely for that purpose are erased or destroyed after the receipt confirming submission to Alloggiati Web has been issued. The receipt is retained for 5 years.
• Statistical submissions through ROSS1000: data and any working files are kept for the time needed to perform and verify the obligation and any further periods required by applicable rules; data received by the Region and ISTAT follow those bodies’ rules.
• Google Analytics 4: the settings currently verified provide 2 months for event data and 14 months for user data. Reset on new user activity is enabled. These controls do not delete standard aggregated statistical reports, which follow the service’s rules.
• Technical logs and security: according to the hosting service’s technical rotation and retention cycles and the time needed to diagnose faults, manage incidents or investigate misuse. In an incident or dispute, only the relevant records may be retained separately until it is resolved.
• Cookies and preferences: according to each tool’s function, the service settings and the information in the Cookie Policy.

At the end of the applicable periods, data are erased or anonymised, subject to legal obligations and a documented need to establish, exercise or defend a legal claim. Technical backups follow the relevant services’ overwrite cycles and must not be used to restore data beyond permitted purposes and periods.

8. Cookies, Analytics, maps and external services

The website uses tools necessary for operation and managing preferences. Google Analytics 4 is loaded after consent to the “Statistics” category. Any maps or other external content requiring consent are managed according to the preferences expressed.

You can change or withdraw consent through Cookie preferences. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. For further details see the Cookie Policy and Google’s information about data from sites using its services.

When you open an external service such as WhatsApp, Facebook or Instagram, the relevant provider’s information and terms also apply. You may also contact us by email or telephone.

9. Processing outside the European Economic Area

Some international digital service providers may also process data outside the European Economic Area. Transfers requiring safeguards must use those provided for in Chapter V GDPR, such as applicable adequacy decisions or standard contractual clauses, together with any necessary additional measures. Information about transfers and safeguards for the services actually used can be requested from the controller.

10. Processing methods and providing data

Data are processed using IT tools and, where necessary, on paper, restricting access to the activities to be performed and adopting appropriate technical and organisational measures. Providing data for a simple enquiry is optional, but without the necessary contact details or information we may be unable to respond. Data needed for booking and legal obligations must be provided in order to deliver the service concerned.

11. Your rights and how to contact us

In the cases and within the limits provided by GDPR, you may request access, rectification, erasure, restriction of processing and portability; you may also object to processing based on legitimate interests and withdraw consent where processing requires it.

To exercise your rights, email info@nautiluxhomes.com. Requests will be examined within the statutory periods, ordinarily one month; any justified extension will be communicated. Erasure does not cover data that must be retained for legal obligations or to protect a legal right where permitted.

You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the competent supervisory authority.

12. Updates to this notice

This notice may be updated when services or processing methods change. The current version and update date are published on this page; the necessary information will be provided before data are used for further purposes.