Orion Stays
iten

Privacy Policy

Personal Data Protection Notice

Notice pursuant to Articles 13-14 of Regulation (EU) 2016/679 ("GDPR") for users of this website and guests of Orion Stays properties.

Data controller / Operator: ORION X GROUP S.R.L. (trading as "Orion Stays"), Italian VAT no. 17819521000, registered office at Via Latina 57, 00179 Rome (RM), Italy. Contact: info.orionxgroup@gmail.com, WhatsApp +39 320 802 2581.

1. Data we process

  • Booking data: first and last name, email, phone, country, number and type of guests, stay dates, optional notes.
  • Payment data: handled exclusively by Stripe Payments Europe Ltd; the controller never receives or stores card numbers, only the outcome and amount of the deposit.
  • Mandatory stay data: identity documents of all guests, collected on arrival to comply with Italian public security law (Art. 109 T.U.L.P.S. — reporting to the police via the Alloggiati Web portal) and municipal tourist tax rules.
  • Technical data and visit statistics: security and infrastructure logs; visit statistics collected without cookies and in pseudonymous form (page visited, referring domain, device type, country derived from the IP address and a daily code produced by hashing the IP address and browser), used only in aggregate: the IP address itself is not stored.
  • Advertising data (only with your consent): if you choose "Accept" on the cookie banner, the Google Ads tag collects the pages of this site you visit and a few interaction events (WhatsApp contact, checkout start, confirmed booking — the latter with the amount, currency and booking code), together with the advertising cookie identifiers. We do not send Google your name, email, phone number or identity-document data. If you choose "Reject", or make no choice at all, the tag is not loaded and none of this data is collected. The cookies, their durations and how to withdraw consent are listed in the Cookie Policy (orion-stays.com/en/cookie).

2. Purposes and legal bases

  • Managing booking requests, the accommodation contract and guest support (Art. 6.1.b GDPR — contract);
  • Legal obligations: public-security reporting, tourist tax, tax and accounting duties (Art. 6.1.c GDPR);
  • Abuse prevention and site security, including the anti-bot check on the booking form (Art. 6.1.f GDPR — legitimate interest);
  • Conversion measurement and optimisation of our Google Ads campaigns, through the advertising cookies described in the Cookie Policy (Art. 6.1.a GDPR — consent). Consent is optional, has no bearing whatsoever on your booking and can be withdrawn at any time by reopening the panel from orion-stays.com/en/cookie; withdrawal does not affect the lawfulness of processing carried out beforehand.

Providing booking data and identity documents is necessary: without them the contract cannot be concluded or performed. Consent to advertising cookies, by contrast, is entirely optional and refusing it has no consequences.

3. Recipients

Data are processed by the controller and by processors/independent controllers: Stripe (payments), Vercel Inc. (hosting), Supabase (database and storage), the SMTP provider configured by the controller to send transactional email, Cloudflare (Turnstile anti-bot check), Google Ireland Limited (advertising conversion measurement), and public authorities where required by law.

  • Cloudflare — Turnstile: when the anti-bot check is active, the booking form sends Cloudflare a technical token and the IP address of the request, to tell people apart from automated programs and protect the checkout from abuse and card-testing fraud. This is the security processing set out in section 2 (Art. 6.1.f GDPR — legitimate interest); it involves no profiling and no advertising purpose.
  • Google Ireland Limited — Google Ads: receives the advertising data described in section 1 only if you give consent on the banner (Art. 6.1.a GDPR) and until you withdraw it. Google also processes that data as an independent controller for its own purposes, under its own notice (policies.google.com/privacy). The cookie categories involved and how to withdraw consent are described in the Cookie Policy (orion-stays.com/en/cookie).

WhatsApp support happens only at the user's initiative and is subject to WhatsApp/Meta's own notice.

4. Transfers outside the EU

Some providers (e.g. Vercel, Stripe, Cloudflare and, where you consent to advertising cookies, Google) may process data outside the EU under Standard Contractual Clauses or adequacy decisions (e.g. the EU-US Data Privacy Framework).

5. Retention

Booking and fiscal records: 10 years (Italian Civil Code Art. 2220 and tax law); public-security data: statutory terms; technical logs: only as long as needed for security; visit statistics (collected without cookies): 90 days, after which the raw data is deleted automatically; your cookie choice: 180 days, after which the banner asks again. Data collected by Google where you consent is retained by Google under its own notice. We do not profile individual guests on our systems and use no automated decision-making; ad optimisation and personalisation happen on Google's systems and only if you consent (sections 1 and 3).

6. Your rights

Under Articles 15-22 GDPR you may request access, rectification, erasure, restriction, portability, or object, by writing to info.orionxgroup@gmail.com. You may also lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

7. Updates

This notice may be updated; the version published on this page is the one in force.

*Last updated: August 2026.*