Information on the processing of personal data pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR)
Website: https://bedandbest.it
Last updated: 5 November 2026
The Data Controller responsible for the processing of personal data is:
Bed and Best S.r.l.s.
VAT number: 17597001001
Registered office: Via Cola di Rienzo 190, 00192 Rome, Italy
Email: info@bedandbest.it
For information regarding the processing of personal data or to exercise the rights provided for by applicable law, data subjects may contact the Data Controller at the email address indicated above.
When browsing and using the services provided by the website, the following categories of personal data may be processed:
Browsing data: IP address, information about the browser and device used, date and time of access, pages visited, technical identifiers and data relating to the operation of the website.
Data provided voluntarily: first name, last name, email address, telephone number and information contained in communications sent through the contact form, email, telephone or WhatsApp.
Booking data: identification and contact information, dates of stay, number of guests, preferences and other information required to manage requests and bookings.
Payment data: information required to process transactions through the booking system and the relevant payment providers. The methods used to collect, transmit and store payment card data depend on the configuration of the services used.
Statistical and tracking data: information relating to the use of the website, interactions and conversions, collected through the analytics and advertising tools described in this policy, in accordance with the applicable consent requirements.
Personal data may be processed for the following purposes:
a) Management of contact requests
To respond to requests for information submitted by users via the contact form, email, telephone or WhatsApp.
Legal basis: taking steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR) or, for non-contractual communications, the legitimate interest of the Data Controller in managing requests (Art. 6(1)(f) GDPR).
b) Management of bookings and stays
To manage availability, bookings, confirmations, changes, cancellations, communications with guests and services related to their stay.
Legal basis: performance of a contract or taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).
c) Management of payments and administrative obligations
To manage payments, invoicing, accounting and tax obligations.
Legal basis: performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR).
d) Website security and operation
To prevent unauthorized access, spam, fraudulent use and technical issues, as well as to ensure the proper functioning of the website.
Legal basis: the legitimate interest of the Data Controller in ensuring the security of its systems (Art. 6(1)(f) GDPR), within the applicable limits.
e) Statistical analysis
To analyze website traffic and usage in order to improve its content, performance and browsing experience.
Legal basis: user consent (Art. 6(1)(a) GDPR), where required. Any statistical processing configured to meet the legal requirements for exemption from consent will be governed in accordance with applicable law.
f) Advertising measurement and conversions
To measure interactions with advertising campaigns and, where the tools are configured for this purpose, to carry out remarketing or advertising personalization activities.
Legal basis: the user's prior consent, where required.
No newsletters or direct promotional communications are sent through mailing list subscriptions.
The website uses Octorate, an external platform for managing bookings and services related to accommodation facilities.
When users use the booking system, the data required to request, confirm and manage their stay may be processed through this platform.
The processing may include identification data, contact details, information about the stay and data required to manage payments.
The privacy roles of the parties involved, any additional payment providers and the methods used to store data must be verified on the basis of the contracts and the configuration actually in use.
Data submitted through the contact form is used to respond to requests received and to manage any subsequent communications.
Providing the data required to receive a response is optional; however, failure to provide essential information may prevent the Data Controller from responding.
Messages sent via WhatsApp also involve the processing of data by the relevant service provider, in accordance with the terms and privacy policies applicable to the service.
The website uses the following services, according to their respective configurations:
Google Analytics: a service for the statistical analysis of website traffic and user interactions.
Google Maps: a service for displaying maps and geographical information relating to the property.
Google reCAPTCHA: a service used to protect forms and website features against spam and automated use.
Google Fonts: a service for displaying fonts, where these are loaded directly from Google's servers.
The use of these services may involve the disclosure of technical data, online identifiers and browsing information to Google, depending on how the services are integrated.
Services requiring consent must only be activated after valid consent has been obtained, where required by law.
Further information is available in Google's privacy policies: https://policies.google.com/privacy
The website uses advertising tracking tools, including Meta Pixel and any Google advertising tools that are actually configured.
These tools may make it possible to measure conversions, analyze interactions with the website and, where enabled, create audiences for personalized advertising campaigns.
Their use for purposes that are not strictly technical is subject to the user's prior consent, in accordance with applicable law.
Information regarding processing carried out by Meta is available at https://www.facebook.com/privacy/policy/
The website may use technical cookies, statistical cookies and third-party tracking technologies.
Cookies that are strictly necessary for the operation of the website do not require prior consent, without prejudice to the requirement to provide adequate information.
Statistical and advertising cookies that do not meet the requirements for exemption from consent must only be activated after the user has made an affirmative choice.
Users must be able to refuse non-essential processing and subsequently change their preferences.
The actual list of cookies, their providers, purposes and retention periods will be included in the website's Cookie Policy following technical verification.
Personal data is processed using IT systems and, where necessary, through organizational and administrative procedures appropriate to the purposes indicated.
The Data Controller is required to adopt appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure or unlawful use.
Access to data must be limited to authorized persons and service providers who require it to perform their respective activities.
Within the limits of the purposes described above, personal data may be disclosed to the following categories of recipients:
Hosting and IT infrastructure providers.
Booking service providers, including Octorate.
Payment service providers.
Communication and customer support service providers.
Analytics and advertising service providers.
Professionals responsible for administrative, tax or legal obligations.
Public authorities, where required by law.
The parties involved operate according to their applicable privacy roles, such as data processors or independent data controllers.
Personal data is not publicly disclosed by the Data Controller, except where required by law or pursuant to specific authorized requests.
The use of services provided by international operators may involve the transfer of personal data to countries outside the European Economic Area.
The actual existence of such transfers, the destination countries and the applicable safeguards must be verified on the basis of the services and contracts in place.
Where international transfers are carried out, the Data Controller is required to comply with the conditions set out in Chapter V of the GDPR, including, where applicable, adequacy decisions or appropriate safeguards.
Personal data is retained for no longer than necessary to achieve the purposes for which it was collected, without prejudice to any additional legal obligations.
Retention periods must be defined separately for:
Requests submitted through the contact form.
Bookings and communications with guests.
Administrative, accounting and tax documentation.
Technical and security logs.
Statistical and advertising data.
Any data processed through external service providers.
The provision of browsing data that is strictly necessary is connected to the technical operation of the website.
Providing data requested for contacts and bookings is optional; however, failure to provide essential information may prevent the request from being processed or the contract from being concluded.
Consent to non-essential statistical and advertising processing is optional, and refusal must not prevent the normal use of services that do not depend on such processing.
Where provided for by the GDPR, data subjects may exercise the following rights:
Access to their personal data (Art. 15).
Rectification of inaccurate data (Art. 16).
Erasure of data (Art. 17).
Restriction of processing (Art. 18).
Data portability (Art. 20).
Objection to processing (Art. 21).
Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7).
Data subjects also have the right not to be subject to decisions based solely on automated processing in the cases provided for by Article 22 of the GDPR.
Requests may be sent to:
The Data Controller will respond within the time limits established by applicable law.
Data subjects who believe that the processing of their personal data infringes applicable law may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority.
Official website: https://www.garanteprivacy.it
This is without prejudice to the right to seek judicial remedies before the competent courts.
The Data Controller may update this Privacy Policy to reflect regulatory, organizational or technical changes, or changes to the services used.
The updated version will be made available on this page, together with the date of the latest update.
Bed and Best S.r.l.s.
Via Cola di Rienzo 190, 00192 Rome
VAT No. 17597001001
Email: info@bedandbest.it
