Guest privacy notice

Roles and stay controller

For guest identification, stay organisation, and compliance purposes determined by the accommodation operator, the actual Host is the controller. SardiniaKey acts as a processor under Article 28 GDPR only for assigned operations and documented instructions. Any independent SardiniaKey purposes must be identified and communicated separately.

This general page does not identify the Host for a particular stay. Before using the form, the Host and contact details must be presented to the guest together with stay-specific information. This page alone does not demonstrate compliance with Article 13 GDPR.

Data and purposes

The Guest flow reviewed collects identification and stay data. The interface/code provides for front/back document images for the lead guest and guest information; actual fields and any processing of minors must be checked for each configuration.

OCR and manual Host review are present in application code. The OCR provider, processing location, data sent, and access arrangements remain to be established. No operational face-to-face video flow has been verified, so this notice does not claim one is active.

Possible purposes, to be specified for each stay, include identification/reporting to authorities when required (including Article 109 TULPS), statistics or local taxes where applicable, and stay/contract management. The Host must specify the legal basis for each purpose: legal obligation, contract, or another applicable basis; blanket consent is not presumed.

Recipients, access, and transfers

Recipients may include the Host and staff authorised by the Host, and competent authorities where required by law. Actual recipients and authorities depend on applicable obligations.

Providers and subprocessors handling Guest documents or data, their locations, and any transfers outside the EEA have not been established; the Host and SardiniaKey must identify them before processing. No certification or specific technical measure is claimed without evidence.

Documents and retention

The code provides for handling document images and retention fields, but actual duration, deletion, backup handling, or separation of image, extracted data, and receipts has not been verified. It is therefore not possible to promise that images are not retained or automatically deleted within a stated period.

The Italian DPA has clarified that the duty to communicate data through Alloggiati WEB does not by itself justify general retention of document copies after transmission; receipts and data subject to other obligations require separate assessment. Retention must be verified and, if misaligned, corrected through a separate intervention before this notice is published.

Provision, rights, and contact

Data necessary for identification duties or stay management may be required; the Host must explain the consequences of not providing it for the specific case. Data must not be used for marketing without a separate purpose and legal basis.

Requests about the Host’s processing should be directed to the Host, who must be identified for the stay. For technical issues with the form, contact privacy@sardiniakey.com. Rights, complaints to the supervisory authority, and their handling must be coordinated with the Host’s specific notice.

Acknowledgement

Acknowledging a privacy notice is not consent to every processing activity.