CefalHome

Privacy notice

Last updated: 16 October 2026

This notice, provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), covers visitors to cefalhome.com, people requesting information and guests staying in properties managed by CefalHome.

1. Controller and contact details

CefalHome SRLS, Viale Parioli 25, 00197 Rome, Italy. VAT number: IT17545961009. REA registration: RM-1725270. Email: [email protected]. Certified email (PEC): [email protected]. You may also use these contacts to exercise your data protection rights.

2. Data and sources

We process identity and contact details, language and country, booking, stay and guest information, requests and correspondence, check-in data, identity document details and tax codes where necessary, tax information, payment amounts and references, and security guarantee information. Full card details are entered into payment providers’ systems. We may also process IP addresses, browser and device information, technical logs, and cookie and marketing preferences.

Data comes from you, the person booking for your group, agencies or booking platforms. Anyone providing other guests’ information should share this notice with them. Please avoid entering health or other special category data in free-text fields; any needs requiring such processing must be arranged separately.

3. Purposes and legal bases

  • Enquiries, quotations, bookings, stays and assistance: pre-contractual steps and performance of a contract, Article 6(1)(b) GDPR.
  • Public security, tax, accounting, statistical and tourist tax obligations: legal obligation, Article 6(1)(c).
  • Payments, refunds and guarantees: contract and relevant legal obligations.
  • System security, abuse prevention and protection of rights: legitimate interests, Article 6(1)(f), subject to necessity and balancing against your rights.
  • Newsletters and promotions: optional, specific and separate consent, Article 6(1)(a). Booking does not automatically subscribe you. Each promotional message provides an unsubscribe option.
  • Online analytics and advertising requiring consent: your choice, as explained in the cookie policy.

Refusing or withdrawing marketing consent does not affect your booking. Operational stay messages are separate from advertising. Withdrawal does not affect the lawfulness of earlier processing.

4. Check-in and images

We use Chekin for online check-in and the activated guest compliance functions. The process requests a photograph of your identity document and your face to verify identity. According to the configuration reported by CefalHome, these images are deleted three days after guest registration data is sent to the Police. Other data follows the retention periods applicable to its purposes. This statement does not mean the photographs are sent to the Police.

The information provided in the verification process must explain any biometric comparison, its legal grounds, parties involved, retention and available alternatives. Reading or accepting this notice does not constitute biometric consent. Contact CefalHome before submitting images if you need clarification. See also Chekin’s notice: https://chekin.com/en/privacy-policy/. Do not send documents through ordinary contact forms or chats.

5. Recipients and assistance

As necessary, data may be processed by authorised staff and collaborators, professional advisers, administrative, accounting and IT providers, and competent authorities. Services used include Lodgify for the website and bookings, Stripe for payments, Chekin for check-in, Rentevo AI for messaging and assistance, SmartxStay for the guest guide, and Brevo for communications and newsletters when activated.

Providers act as processors or independent controllers according to their activities and applicable agreements. Updated information is available on request. Personal data is not intended for public dissemination. Messaging may include AI-assisted answers to basic questions; you may request human assistance.

6. External services and transfers

The website includes YouTube videos, Elfsight reviews and links to WhatsApp, Instagram and other services. Embedded content may disclose technical information to its provider, including IP address, browser and page visited. External links differ from embedded content. See the cookie policy for storage technologies and available choices.

Some providers may process data outside the European Economic Area. Transfers are subject to Chapter V GDPR, such as applicable adequacy decisions or standard contractual clauses and supplementary measures where necessary. You may request information about the safeguards applied.

7. Retention

  • Tax and accounting records: generally ten years, subject to longer periods required by obligations or disputes.
  • Enquiries without a booking: up to twelve months after closure, unless further dealings or documented needs justify otherwise.
  • Contracts and documents needed to protect rights: for the periods applicable to the relevant claims; unnecessary data is deleted earlier.
  • Newsletters: until withdrawal and no longer than twenty-four months after subscription or renewal of consent. Evidence of choices and suppression lists may be retained separately as necessary to document compliance and respect objections.
  • Document and face photographs through Chekin: three days after data is sent to the Police, according to the configuration reported by CefalHome; other data follows the periods for each obligation.
  • Cookies, preferences and technical logs: the relevant durations and criteria described in the cookie policy.

Data is deleted or anonymised when no longer needed. A ten-year retention period does not apply to all guest data.

8. Providing data

Data necessary for bookings, payments and legal obligations is required to provide the corresponding services; failure to supply it may prevent us from concluding or managing them. Optional data, such as newsletter consent, may be refused without affecting your stay.

9. Rights and complaints

Where and to the extent provided by the GDPR, you may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent. You may object to direct marketing at any time. Contact the controller using the details above: we normally respond within one month; any permitted extension will be explained and notified. Erasure does not cover data still needed for legal obligations or protection of rights.

You may complain to the Italian Data Protection Authority, Garante per la protezione dei dati personali (https://www.garanteprivacy.it/), or the competent supervisory authority under Article 77 GDPR.

10. Updates

This notice is updated when processing changes; the current version and date appear on this page. Please also consult the cookie policy for cookies and similar technologies.