Privacy | Molo Angioino Suites

1. Data controller

The data controller is:

OMAIT S.R.L.
Via Mulo 10
80073 Capri (NA), Italy
P.IVA / C.F. 09674701215
REA NA - 1049257
Legal representative: Cristina Borselli
Certified email (PEC): omaitsrl@pec.it
Email: info@moloangioinosuites.com

The accommodation operated by the controller is Molo Angioino Suites.

2. Data we process

Data collected through the website

Browsing data: IP address, browser and device type, pages visited, date and time of access, processed in aggregate form for statistical and security purposes.
Data entered in any contact or availability form: name, email address, phone number, stay dates and the content of your message.

Data collected through the WhatsApp Business Platform

The controller uses the WhatsApp Business Platform (Cloud API) provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. When you write to us on WhatsApp we process:

the sender’s phone number;
the WhatsApp profile name;
the content of the messages exchanged (text, images, documents, audio);
message metadata: send and delivery times, read status, technical identifiers of the message and of the business phone number.

3. Purposes and legal bases

Replying to guest enquiries and managing the booking — performance of a contract or pre-contractual measures (Art. 6.1.b GDPR).
Sending service messages about check-in, the stay and check-out — performance of the contract (Art. 6.1.b GDPR).
Legal obligations for accommodation providers (public security reporting, tax and statistical duties) — legal obligation (Art. 6.1.c GDPR).
Any promotional communications — consent (Art. 6.1.a GDPR), which can be withdrawn at any time.

4. How the WhatsApp channel works

The messages you send travel through Meta’s messaging infrastructure and are received by a management system owned by the controller, which stores them in order to handle the booking and the stay.

The same conversations also remain visible in the WhatsApp Business application used by the property staff.

5. Recipients and data processors

Data may be disclosed to the following providers, appointed as data processors under Art. 28 GDPR:

Meta Platforms Ireland Limited — WhatsApp Business Platform messaging infrastructure;
Supabase — application database, servers located in Ireland (European Union);
Vercel — application hosting for the website and the management system;
Amenitiz — booking engine used to manage online reservations.

Data is also disclosed to public security authorities and tax authorities in the cases required by the law applicable to accommodation providers.

6. Transfers outside the EU

Some providers may process data outside the European Economic Area. In that case the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission or another adequate safeguard under Chapter V of the GDPR.

7. Retention period

WhatsApp conversations and related metadata: 24 months from the end of the stay, or from the last contact if no booking followed.
Contact data collected through the website: 24 months from the last contact.
Data required by tax, accounting or public security obligations: for the periods set by law.
Data processed on the basis of consent: until consent is withdrawn.

8. Your rights

As a data subject you may exercise at any time the rights granted by Articles 15-22 of the GDPR:

access to your personal data;
rectification of inaccurate data;
erasure of data (right to be forgotten);
restriction of processing;
data portability;
objection to processing;
withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights you can write at any time to: info@moloangioinosuites.com

You also have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it).

9. Security

Data is protected by encryption in transit, access limited to authorised staff only and access credentials kept in a protected environment. Systems are subject to technical and organisational measures appropriate to the risk, under Art. 32 GDPR.

10. Minors

The service is not addressed to children under 16 without the consent of the holder of parental responsibility. If we become aware that we have collected a minor’s data without such consent, we delete it.

11. Changes

This privacy notice may be updated to reflect changes in the law or in the services we use. The date of the latest update is shown at the bottom of this page.