Privacy policy
How we handle your data
Last updated: 18 October 2026
This policy explains what personal data we process when you visit staynavigli.com, book a stay or stay with us, why we do it and what rights you have. It is written under Articles 13 and 14 of EU Regulation 2016/679 (GDPR).
Who the data controller is
Stay Navigli, run by a private host
Via Giuseppe Meda 6, 20136 Milano
Privacy email: privacy@staynavigli.com
CIN IT015146C2MXR3LFF6
We have not appointed a Data Protection Officer (DPO): it is not required for an operation of our size. For any question, write to the address above.
What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Running and protecting the website | IP address, browser type, pages visited, date and time (technical logs) | Legitimate interest in security (Art. 6(1)(f)) | Up to 30 days, unless investigating abuse |
| Visit statistics, only if you accept them | Aggregated browsing data via Google Analytics | Consent (Art. 6(1)(a)), which you can withdraw at any time | 14 months |
| Managing your booking and payment | First name, surname, email, phone, dates of stay, number of guests, amounts | Performance of a contract (Art. 6(1)(b)) | For the duration of the relationship; tax records for 10 years |
| Registering guests with the police (Questura) | Personal details and identity document data of each guest | Legal obligation (Art. 6(1)(c); Art. 109 of the Italian public security law, TULPS) | As long as needed to submit them on the Alloggiati Web portal |
| Mandatory tourism statistics | Guests' age, sex, nationality and residence, dates of stay | Legal obligation (Art. 6(1)(c)) | As long as needed to submit them to the regional platform |
| Tourist tax and tax obligations | Booking data and data of the guests subject to the tax | Legal obligation (Art. 6(1)(c)) | 10 years, as required by tax law |
| Replying to people who write to us | Name, contact details and message content | Pre-contractual measures or legitimate interest (Art. 6(1)(b) and (f)) | As long as needed to handle the request, then up to 12 months |
During your stay you also use our guest app (self check-in, door code, any document check). It has its own privacy policy: app.staynavigli.com/privacy.
Payments
You pay on the secure page of the provider you choose: credit and debit cards, Apple Pay, Google Pay, PayPal, Satispay, Revolut Pay, Amazon Pay or instant bank transfer. Card or account details are processed by the payment provider as an independent controller: we never see or store them. We only receive the outcome and the amount.
Who we share data with
We do not sell your data or use it for advertising. We only share it with:
- Lodgify, the platform we use for our calendar, bookings and checkout, as data processor;
- the payment providers listed above, as independent controllers;
- Google, for visit statistics, only if you accept them;
- the website hosting provider and the technical services that protect it;
- public authorities, where the law requires it: the State Police via Alloggiati Web, the regional tourism statistics platform, the City of Milan for the tourist tax, the Italian Revenue Agency;
- our tax adviser, for accounting.
Data outside the European Union
Some providers, such as Google and some payment services, may process data in the United States. In that case the transfer is based on the EU-U.S. Data Privacy Framework or on the standard contractual clauses approved by the European Commission.
Do you have to give us your data?
Booking data and the data required by law are necessary: without them we cannot confirm your stay or welcome you. Consent to statistics is optional: if you refuse, the site works just the same.
We do not take decisions based solely on automated processing and we do not do profiling.
Your rights
At any time you can ask us to:
- tell you what data we hold about you and give you a copy;
- correct or complete it;
- erase it, except where the law requires us to keep it;
- restrict its use, or object to processing based on legitimate interest;
- give it to you in a machine-readable format (portability);
- withdraw your consent to statistics, using the "Cookie preferences" link at the bottom of the page.
Write to privacy@staynavigli.com: we reply within one month. If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).
Cookies
For the cookies and similar technologies used on the site, see the cookie policy.
Changes
If we change this policy we update the date at the top of the page. If the changes are significant, we flag them on the site.