Privacy and cookie notice
Last updated: 21 October 2026
This notice explains, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), how we process the personal data of people who visit the website, book a stay or use the guest area.
1. Data controller
Hostify Palermo di Riva Salvatore
via Emerico Amari 58
VAT / Tax ID 07402590827
Email: info@hostifypalermo.com
No Data Protection Officer (DPO) has been appointed, as it is not required for our activity.
2. What data we process, why and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Handling your booking request and stay (confirmation, communications, check-in, support) | First and last name, email, phone, country, dates and number of guests, special requests | Performance of a contract or pre-contractual steps (Art. 6(1)(b)) |
| Collecting payment and refunds | Amount, outcome and ID of the transaction. Card data never passes through our site: Stripe and PayPal handle it | Performance of a contract (Art. 6(1)(b)) |
| Guest area: account, login, change or cancellation requests | Email, password (stored only in hashed form, never in clear), bookings, requests sent | Performance of a contract (Art. 6(1)(b)) |
| Tax, accounting and legal obligations (invoicing, tourist tax, communications to public-security authorities where required) | Identity and booking data, amounts | Legal obligation (Art. 6(1)(c)) |
| Site security and abuse prevention (limit on login attempts, activity log) | IP address, date and time, email entered in failed attempts | Legitimate interest (Art. 6(1)(f)) |
| Anonymous usage statistics (Google Analytics) | Pages visited, duration, device and browser type, approximate origin; truncated (anonymised) IP address and a random identifier in the cookie | Consent (Art. 6(1)(a)), given via the cookie banner |
| Showing the Google Maps map | IP address and technical data processed by Google, only if you load the map | Consent (Art. 6(1)(a)), given by clicking "Load the map" |
Providing booking data is necessary to enter into the contract: without it we cannot accept the booking. We do not profile, send newsletters or promotional messages, or sell your data.
3. Who we share data with
- Hosting and email provider (Aruba S.p.A., Italy), which hosts the site and sends service emails.
- Stripe and PayPal, to process payments, each acting as an independent controller for payment data.
- Google (Google Analytics, if you accept statistics cookies; Google Maps, if you load the map). Google may process data outside the European Economic Area, relying on GDPR safeguards (adequacy decision / standard contractual clauses). For Analytics, Google acts as our data processor.
- Accountants and advisers, and public and public-security authorities where required by law.
Staff handling bookings are authorised to process data. Data is not disseminated.
4. How long we keep data
- Bookings and accounting data: 10 years after the end of the stay, for tax and accounting obligations. After you delete your account, contact details are anonymised and only data needed for accounting remains.
- Guest account: until you delete it from the guest area or ask us to.
- Login and email-verification links: expire after minutes or hours and can no longer be used.
- Google Analytics data: 2 months, then deleted automatically.
- Failed login attempts (IP, email): deleted after 24 hours.
5. Your rights
You may at any time ask for access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest; you may withdraw consent you have given (withdrawal does not affect earlier processing).
On your own, from the guest area, you can edit your details, download a copy in JSON format (portability) and delete your account. For anything else write to info@hostifypalermo.com: we reply within one month.
If you believe the processing breaches the law you can lodge a complaint with the Italian Data Protection Authority (Garante) (www.garanteprivacy.it).
6. Cookies and similar technologies
We use no profiling or advertising cookies. We use technical tools necessary for the site to work (no consent needed) and, only if you accept via the banner, Google Analytics statistics cookies. You can change your choice at any time from “Manage cookies” at the bottom of every page.
| Name | Purpose | Duration |
|---|---|---|
HOSTIFY_GUEST (cookie) | Keeps your session in the guest area after login and protects forms (CSRF) | Browser session |
HOSTIFY_ADM (cookie) | Management panel session, staff only | Browser session |
hp_consent (local storage) | Remembers your cookie choice (technical) | Until cleared |
_ga, _ga_FYK3C5ESFT (Google Analytics cookies, only with consent) | Tell visitors apart and measure anonymously how the site is used | Up to 2 years (collected data is kept for 2 months) |
lang (browser local storage) | Remembers your language choice (IT/EN) | Until cleared |
hp_map_ok (local storage) | Remembers that you chose to load the map, so we don't ask every time | Until cleared |
hp_new_account (session storage) | Shows a note after your account is created during booking | Until the tab is closed |
Third-party content. Google Analytics only starts after your consent and with an anonymised IP address; advertising features and Google Signals are disabled. The site's fonts are hosted on our own server (no calls to Google Fonts). The Google Maps map is blocked until you click "Load the map": only then does Google receive your IP and may set its own cookies, under its own policy. To withdraw your choice on the map, clear the site's data in your browser; for statistics cookies use “Manage cookies”. Card and PayPal payments take place on Stripe and PayPal pages, which process data under their own policies.
You can block or delete cookies from your browser settings; technical cookies are however needed to log in to the guest area.
7. Changes
We may update this notice; the date at the top shows the latest version.
← Back to the site