Orion Stays
iten

Privacy Policy

Personal Data Protection Notice

Notice pursuant to Articles 13-14 of Regulation (EU) 2016/679 ("GDPR") for users of this website and guests of Orion Stays properties.

Data controller / Operator: ORION X GROUP S.R.L. (trading as "Orion Stays"), Italian VAT no. 17819521000, registered office at Via Latina 57, 00179 Rome (RM), Italy. Contact: info.orionxgroup@gmail.com, WhatsApp +39 320 802 2581.

1. Data we process

  • Booking data: first and last name, email, phone, country, number and type of guests, stay dates, optional notes.
  • Payment data: handled exclusively by Stripe Payments Europe Ltd; the controller never receives or stores card numbers, only the outcome and amount of the deposit.
  • Mandatory stay data: identity documents of all guests, collected on arrival to comply with Italian public security law (Art. 109 T.U.L.P.S. — reporting to the police via the Alloggiati Web portal) and municipal tourist tax rules.
  • Technical data: security and infrastructure logs.

2. Purposes and legal bases

  • Managing booking requests, the accommodation contract and guest support (Art. 6.1.b GDPR — contract);
  • Legal obligations: public-security reporting, tourist tax, tax and accounting duties (Art. 6.1.c GDPR);
  • Abuse prevention and site security (Art. 6.1.f GDPR — legitimate interest).

Providing booking data and identity documents is necessary: without them the contract cannot be concluded or performed.

3. Recipients

Data are processed by the controller and by processors/independent controllers: Stripe (payments), Vercel Inc. (hosting), Supabase (database and storage), the transactional email provider, and public authorities where required by law. WhatsApp support happens only at the user's initiative and is subject to WhatsApp/Meta's own notice.

4. Transfers outside the EU

Some providers (e.g. Vercel, Stripe) may process data outside the EU under Standard Contractual Clauses or adequacy decisions (e.g. the EU-US Data Privacy Framework).

5. Retention

Booking and fiscal records: 10 years (Italian Civil Code Art. 2220 and tax law); public-security data: statutory terms; technical logs: only as long as needed for security. We do no marketing or profiling; no automated decision-making.

6. Your rights

Under Articles 15-22 GDPR you may request access, rectification, erasure, restriction, portability, or object, by writing to info.orionxgroup@gmail.com. You may also lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

7. Updates

This notice may be updated; the version published on this page is the one in force.

*Last updated: July 2026.*