Privacy notice
Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Last updated: 8 November 2026. The Italian version prevails.
The service
Garanzia lets hotels and other businesses (the "Businesses") ask their customers for a card as a guarantee for a booking. It is provided by Webdesign.bo – Formazione I.T. e Soluzioni Web, dr. Sergio Marrani Poli, Via Umberto Giordano 14, 40141 Bologna (BO), VAT no. 01919831204.
Who is the controller
- Data of the Businesses' customers: the controller is the Business that sent the request; its contact details are on the guarantee page and in the emails. dr. Sergio Marrani Poli processes these data on its behalf as processor (Art. 28 GDPR).
- Data of Business staff using the service and browsing data: the controller is dr. Sergio Marrani Poli, Via Umberto Giordano 14, 40141 Bologna (BO).
What we process
- Customers: email address; booking reference entered by the Business; guarantee amount; text of the accepted terms with date, time, IP address and browser at acceptance; card brand and last four digits only; any penalty charged.
- The payment card is collected and stored by Stripe, on the Business's Stripe account. Neither we nor the Business see the full card number.
- Business staff: email, name, password (stored hashed), two-step verification key, log of actions.
- Browsing: IP address and technical request data in server logs.
Why and on what basis
- To handle the guarantee and any penalty under the accepted terms: performance of the contracts (Art. 6(1)(b) GDPR).
- To keep evidence of the acceptance and protect rights in a dispute: legitimate interest (Art. 6(1)(f) GDPR).
- Security and fraud prevention: legitimate interest (Art. 6(1)(f) GDPR).
Data are not used for advertising, profiling or automated decisions, and are never sold.
Who else handles them
- Stripe Payments Europe Ltd. (Ireland): card storage, 3D Secure and charges for the Business; Stripe may process data outside the EU under the safeguards of Art. 44 ff. GDPR.
- Hetzner Online GmbH (Germany): servers.
- Transactional email provider (Brevo, France).
How long
- The card is removed from Stripe when the Business closes the guarantee or automatically after the period set by the Business (usually 60 days).
- Guarantee and acceptance records are kept as long as needed to protect the parties' rights, at most 10 years.
- Technical server logs are kept for a limited time and then overwritten.
Your rights
You can ask for access, rectification, erasure, restriction, portability and object to processing (Arts. 15–22 GDPR). For data about a guarantee contact the Business; if you write to us we forward the request. You may lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
Contact
dr. Sergio Marrani Poli – Webdesign.bo – Formazione I.T. e Soluzioni Web, Via Umberto Giordano 14, 40141 Bologna (BO), phone 051 0828091, info@webdesign.bo.it.
Cookies: see the cookie policy.