Privacy Policy

1. Introduction

Ricasoli Group S.r.l. ("we", "us", "our"), with registered office at Via Senato 29, 20121 Milano (MI), Italy, VAT no. IT08638750961, operating under the brand Ricasoli Stays, is the data controller responsible for processing your personal data collected through the forms on our website.

This Privacy Policy explains how we collect, use, store and protect your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Italian data protection laws.

2. Data We Collect

We collect personal data when you submit one of the forms on our website. The specific data collected depends on the form you use:

a) Find Your Stay (Guest Inquiry)

• Preferred destination
• Check-in and check-out dates
• Number of adults and children
• Full name
• Email address
• Phone number (including country code)
• Trip purpose (optional)
• Concierge services preferences (optional)
• Special requests (optional)

b) List Your Property (Owner Lead)

• City and property address
• Property type
• Number of guests accommodated, bedrooms and bathrooms
• Key amenities (optional)
• Link to property photos (optional)
• Full name
• Email address
• Phone number (including country code)
• Preferred contact method
• Additional message (optional)

3. Purpose and Legal Basis

We process your personal data for the following purposes:

• To process your guest inquiry and help you find the ideal stay, or to evaluate your property listing proposal (legal basis: your explicit consent, Art. 6(1)(a) GDPR)
• To send you a confirmation email acknowledging receipt of your submission (legal basis: legitimate interest, Art. 6(1)(f) GDPR)
• To notify our team so that we can follow up on your request — guest inquiries are sent to our reservations team, owner leads to our property management team (legal basis: legitimate interest, Art. 6(1)(f) GDPR)

4. Data Recipients and Processors

Your personal data may be shared with the following third-party service providers who act as data processors on our behalf:

• Supabase Inc. — Database hosting and storage. Your data is stored on Supabase's infrastructure. Supabase is SOC 2 Type II certified and compliant with GDPR. For more information, visit supabase.com/privacy.
• Resend Inc. — Transactional email delivery. Used to send confirmation emails to you and notification emails to our team. For more information, visit resend.com/legal/privacy-policy.
• Vercel Inc. — Website hosting and deployment. Vercel processes data as part of serving our website. For more information, visit vercel.com/legal/privacy-policy.

All processors are bound by appropriate data processing agreements and are required to implement adequate security measures.

5. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy, and in any case no longer than 24 months from the date of collection, unless a longer retention period is required by law.

6. Your Rights

Under the GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure of your data ("right to be forgotten")
• Restrict processing of your data
• Data portability
• Object to processing
• Withdraw your consent at any time

To exercise any of these rights, please contact us at info@ricasolistays.com.

7. Cookies

Our website uses only strictly necessary technical cookies required for the website to function. We do not use any tracking, analytics or advertising cookies.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.

10. Contact Us

For any questions regarding this Privacy Policy or the processing of your personal data, please contact: