Privacy & cookies.

Last updated: 15 September 2026

This notice explains what happens to your data when you visit Qui Ospite, try Casa Levante or email an enquiry. We do not use personalised advertising, marketing pixels or tools to track your visits for commercial purposes.

Who is responsible

The data controller and contact for the Qui Ospite project is Daniele Gattuso.

This notice is provided under Article 13 of Regulation (EU) 2016/679 (GDPR). It covers quiospite.it, demo.quiospite.it and their versions at quiospite.pages.dev and guida-ospiti-demo.pages.dev. Casa Levante, its host and its property details are fictional examples. Qui Ospite is the project name.

Data and purposes

Browsing and security

Connecting to the websites involves processing technical data: IP address, date and time, requested URL, browser and device information, any referring page and security events. These are used to deliver the pages, keep them available and prevent abuse and attacks. The legal basis is our legitimate interest in operating and protecting the service (Article 6(1)(f) GDPR). Technical connection data is necessary to communicate with the website.

Email enquiries

If you write to contatti@quiospite.it, we process your email address, your name if supplied, the message, and any contact details or attachments you choose to send. We use this information to answer and, if requested, prepare a proposal. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b)). For general correspondence and demo feedback, the basis is our legitimate interest in handling incoming messages (Article 6(1)(f)).

Contacting us is optional. Without a return address and essential details about your enquiry, we cannot give a useful reply. We do not need identity documents, payment details, guest records or sensitive information. Contacting us does not subscribe you to newsletters or promotional campaigns.

The contact button opens your email application with an editable message. The website neither sends that message nor collects its content. Sending only occurs when you choose to send it in your email application.

The optional property details and the number of properties entered on the homepage are used only in your browser to prepare the email draft. The website does not transmit or store these fields. The copy buttons place the email address or draft text on your device’s clipboard only when you select them.

Demo features

The demo remembers your chosen language and whether you dismissed the installation suggestion on your device. Any host panel settings (link and Wi-Fi details) stay in this browser and are not sent to Qui Ospite. Please use example data. Text placed in a page URL, such as the “casa” parameter, is part of the web request and may appear in technical logs: do not put personal data in it.

Host contact actions are simulated. Maps and websites for recommended places only open when you select their links. The external website’s notice then applies. No external maps, videos or weather services load automatically.

Who can process the data

The controller handles enquiries directly. These providers support the service:

• Cloudflare, Inc.: page hosting, content delivery, DNS and traffic protection. It may process technical browsing data; there is no website form sending email content to Cloudflare. Processing on our behalf is governed by the Cloudflare Data Processing Addendum. Its own privacy policy applies where it acts as an independent controller.
• OVHcloud (OVH S.r.l. and providers listed in its agreement): the Zimbra mailbox and email infrastructure. It processes messages, attachments and technical data needed for email delivery. The OVHcloud data processing agreement governs processing on our behalf.

Data is not published or sold. It may be disclosed to competent authorities where required by law. Your own email provider and external websites you choose to visit process data under their respective services and notices.

Processing outside the European Economic Area

Cloudflare operates international infrastructure and may process data in the United States or other countries. Its DPA provides for the Data Privacy Framework where applicable and, for transfers requiring contractual safeguards, European Commission standard contractual clauses and the additional safeguards set out in the agreement. OVHcloud email uses European infrastructure; any subprocessors and transfers are governed by its DPA. You can ask the controller for more information and a copy of the relevant safeguards.

How long data is kept

• Enquiries with no further outcome and demo feedback: deleted within 6 months of the last exchange. If you ask to continue the conversation, this period starts from the last relevant exchange.
• Data required for a subsequent customer relationship: retained to manage that relationship and meet applicable legal obligations, which will be described in its documentation. In a dispute, only necessary data may be retained to establish, exercise or defend a legal claim until the dispute and applicable time limits have ended.
• Technical data: we do not maintain our own log archive or continuous log exports. The provider processes it for as long as needed to deliver and protect the service under the applicable agreement. Cloudflare’s DPA sets the limit as the end of the agreement or, if earlier, when processing is no longer necessary, subject to legal retention obligations. The 6-month email period does not apply to technical logs.
• Preferences and offline copies: remain in your browser until you or the browser remove them. Offline demo copies are replaced when the website is updated.

Cookies and browser storage

We do not install advertising or profiling cookies or use visit analysis tools for marketing. Cloudflare Web Analytics is not enabled for the Qui Ospite websites. Fonts and images are served by the website itself.

The tools listed below serve technical purposes. Consent through a banner is not required for this use, within the conditions described in the Italian data protection authority’s cookie guidelines.

Demo preferences · local storage

guest_guide_lang remembers your language; guest_guide_install_dismissed remembers that you dismissed the installation suggestion. They remain on your device until site data is deleted.

Demo host panel · local storage

guest_guide_host_url, guest_guide_host_ssid and guest_guide_host_pwd hold settings entered in the panel, if used. They remain on your device until site data is deleted.

Offline guide · browser cache

The quiospite-demo-* cache stores guide pages and resources for offline use. It contains no identifier for tracking you on other websites. You can remove it by clearing the demo’s site data in your browser settings.

Possible security checks · Cloudflare

If Cloudflare requests a security check, it may use cf_clearance to remember a successful check and technical cf_chl_* cookies to operate the check. Challenge validity is configured to 30 minutes, with any technical extensions documented by the provider. These are not advertising cookies. See Cloudflare’s cookie documentation.

You can block or delete cookies and local storage in your browser’s site data settings for quiospite.it and demo.quiospite.it, or the pages.dev version you used. The demo will lose saved preferences and offline availability. Blocking security cookies may prevent you from completing a security check. If we introduce tools requiring consent, we will update this notice and keep them disabled until you make your choice.

Your rights

Where the GDPR provides, you may request access, correction, deletion, restriction and portability of your data. You may object to processing based on legitimate interests on grounds relating to your particular situation. We do not carry out profiling or automated decisions producing legal or similarly significant effects on individuals.

Send requests to the controller by email or at the postal address above. We normally respond within one month; any extension permitted by the GDPR will be communicated with its reasons. You may also lodge a complaint with the Italian data protection authority or your competent supervisory authority and seek a judicial remedy.