This page explains what happens to your data when you visit uflat.it and when you write to us to ask about availability or information. It's written to be read: if something doesn't add up, email us at info@uflat.it or on WhatsApp and we'll explain.
Who processes your data
The data controller is Aurelio Alizzio, who runs Uflat • comfy apt, Via Umberto 67, 95129 Catania — tourist accommodation with CIN IT087015C2PZ7XIFUM.
For anything concerning your data — including the requests in the last paragraph — email info@uflat.it: it's the controller's direct contact. For a quick question you can also message us on WhatsApp.
When you visit the site
The site is made of static pages. It doesn't ask you anything, doesn't recognise you and doesn't store anything on your device: no cookies, no local storage, no third-party scripts. Fonts and images come from the site's own domain, so browsing it doesn't contact any other server. The detail is in the cookie page.
Like any site, the server that hosts it logs the requests it receives: IP address, date and time, page requested, browser type. These are the normal technical logs, used to keep the service running and secure — not to recognise you, and not cross-referenced with anything else.
Legal basis and retention
The logs rest on the legitimate interest in keeping the site secure and functioning (art. 6.1.f GDPR) and are kept for the technical time needed for that purpose. The site is hosted on Vercel, which acts as data processor.
When you send an availability request
The request page has a form that collects your first and last name, phone, email, city and country, an optional message, and the dates and guest count you've already chosen on the page. Those are the only fields the form asks for — there's no further step that collects anything else.
When you press "check dates", that data is sent by email, not stored in a database: it reaches the controller, who replies within 24 hours, and you automatically receive a confirmation receipt at the email address you wrote, with the quote summary. Delivery goes through Resend, the service that actually sends the emails: it processes your data as a data processor, for the sole purpose of getting them to their destination.
The legal basis is the performance of pre-contractual measures at your request (art. 6.1.b GDPR): you write to us first, to ask whether the dates are free. If the request turns into a booking, we use the same data to organise the stay — bank transfer details and the short-term rental contract also arrive by email — on the same basis, which at that point is the performance of the contract. We keep the data for as long as it takes to reply or manage the stay, and beyond that only for the documents that tax and civil law require us to retain.
When you write to us on WhatsApp
The "message us on WhatsApp" buttons open a conversation with the message already written, for a quick question before or after the request. The "check dates" commands don't open anything external — they lead to the request page, where the quote is calculated in your browser and stays there until you send it. In that conversation we handle your number, the name you've set on WhatsApp and whatever you write to us. The same legal basis above applies (art. 6.1.b GDPR), and retention follows the same criteria.
WhatsApp is a Meta service, which handles data under its own rules: what happens on the app doesn't depend on us. If you'd rather not use it, you don't have to — the form request works on its own, without going through it.
Data transferred outside the European Union
Vercel and Resend, the two providers named above, are based in the United States: when your data passes through them, it leaves the European Economic Area. The law requires that transfer to happen under a safeguard equivalent to European protection (art. 13.1.f GDPR): both providers adhere to the EU-U.S. Data Privacy Framework, the framework approved by the European Commission for this purpose, and in addition apply the European Commission's Standard Contractual Clauses as a contractual safeguard.
At check-in
Check-in happens in person: on arrival, the law requires us to identify guests from their ID and report their data to public-security authorities, alongside the tax and statistical obligations tied to tourist rentals. This isn't data we collect from the site — the request form doesn't ask for ID — but an obligation that applies in person, when you arrive. That processing rests on a legal obligation (art. 6.1.c GDPR) and the data only goes where the law says.
What we don't do
- No statistics, no analytics, no advertising pixel.
- No profiling and no automated decision-making.
- No newsletter and no unsolicited commercial mailing.
- No selling or transferring your data: outside legal obligations, it doesn't leave here.
Links to other sites
Some pages lead outward: Google Maps for the addresses in the tips section, Instagram, and the channels where the apartment can also be booked (Airbnb, Booking.com, VRBO). Nothing happens until you tap them. When you do open them, though, you're on their site and their rules apply, not these.
Your rights
You can ask us at any time to access your data, correct it, delete it, restrict its processing, object to it, or receive it in a machine-readable format (arts. 15-22 GDPR). We reply within one month.
If you think something isn't right, you can contact the Italian Data Protection Authority.
If this page changes
The date at the top says when we last revised it. If something substantial changes in how we handle data, we'll write it here.