Privacy policy

Last update: 20 May 2026

This privacy notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and to applicable Italian data protection law.

1. Data Controller

The Data Controller is Welcomely S.r.l., with its registered office at Via Redipuglia 49, 07026 Olbia (SS), Italy ("Welcomely").

For any questions or requests relating to the processing of personal data, you can contact Welcomely at info@welcomely.it.

2. Categories of personal data

Welcomely may process the following categories of personal data:

• identification and contact details (for example: name, surname, email address, telephone number);
• data relating to enquiries and bookings (for example: dates of stay, number of guests, preferences and operational notes);
• payment and invoicing data, processed also via certified third-party providers;
• browsing data, technical logs, IP addresses, online identifiers and data collected through cookies and similar technologies;
• communications sent through forms, email, chat or other digital channels;
• data of guests requested by applicable law for public security and tax purposes;
• data of owners or potential owners who request information or start a property management relationship.

3. Purposes and legal bases of processing

Personal data are processed for the following purposes and on the following legal bases:

1. Managing enquiries and bookings: handling contact requests, quotes, booking requests and any pre-contractual measures.

• • Legal basis: performance of a contract or pre-contractual measures.

2. Managing the stay and customer care: managing the stay, guest assistance, operational communications before and after check-in, complaints and after-sales support.

• • Legal basis: performance of a contract; legitimate interest in ensuring an adequate level of service.

3. Compliance with legal obligations: fulfilling legal, regulatory and administrative obligations, including tax, accounting and public security obligations.

• • Legal basis: compliance with a legal obligation.

4. Protecting rights and security: protecting Welcomely’s rights and assets, preventing fraud, ensuring IT security, managing disputes and defending Welcomely’s rights in court.

• • Legal basis: legitimate interest in protecting its rights and ensuring the security of systems and assets.

5. Marketing and newsletters: sending newsletters, promotions and commercial communications relating to Welcomely’s services and to services similar to those already purchased.

• • Legal basis: consent of the data subject, or legitimate interest (soft spam) where applicable under the law.

6. Analysis and improvement of services: conducting aggregated and anonymised statistics where possible, monitoring performance of the website and improving services and processes.

• • Legal basis: legitimate interest in improving services and the website; consent, where required for the use of certain cookies or similar technologies.

7. Management of relationships with owners and partners: managing relationships with property owners, suppliers, intermediaries and business partners involved in the marketing of properties and ancillary services.

• • Legal basis: performance of a contract or pre-contractual measures; legitimate interest in managing business relationships.

4. Nature of provision of data

The provision of data marked as mandatory in forms, in booking processes or in contact requests is necessary in order to handle the request, conclude the contract or fulfil legal obligations. If such data are not provided, Welcomely may be unable to process the booking, finalise the stay or provide the requested services.

The provision of data for marketing, newsletter or profiling purposes is optional. If you do not provide such data or do not give your consent (where required), this will not affect your ability to use the main services.

5. Methods of processing

Personal data are processed using electronic and, where strictly necessary, paper-based tools, in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation.

Welcomely adopts appropriate technical and organisational measures to protect data from unauthorised access, loss, alteration, disclosure or destruction, having regard to the state of the art, implementation costs and the nature, scope, context and purposes of processing.

6. Recipients of personal data

Within the limits of the purposes described above, personal data may be disclosed to the following categories of recipients:

• Welcomely’s internal staff duly authorised to process personal data;
• property owners, where necessary to manage the stay or the contractual relationship;
• IT, hosting and cloud service providers;
• providers of CRM systems, property management systems (PMS) and channel managers;
• payment service providers, banks, electronic money institutions and anti-fraud providers;
• providers of communication, email, SMS and messaging services, including operational automations and reminders;
• legal, tax, accounting and administrative consultants and insurers;
• online travel agencies (OTAs), booking platforms and commercial partners involved in the distribution of properties or ancillary services;
• public authorities and other entities to whom data must be disclosed pursuant to law or orders of competent authorities.

Such parties process the data as data processors (pursuant to Article 28 GDPR) or as independent data controllers, depending on the role they play in relation to the specific processing.

7. Transfers of data outside the EEA

Some providers may process or store personal data outside the European Economic Area (EEA). In such cases, Welcomely ensures that the transfer takes place in compliance with the GDPR, based on adequacy decisions, standard contractual clauses adopted by the European Commission, appropriate safeguards or other lawful transfer mechanisms under Articles 44 et seq. GDPR.

8. Data retention

Personal data are retained for no longer than is necessary for the purposes for which they are processed and, in any case, in accordance with the retention periods laid down by applicable law.

In general:

• contractual, administrative and tax data are retained for the period required by civil, tax and accounting law;
• data processed for public security purposes are retained for the period indicated by applicable legal provisions;
• marketing data are retained until consent is withdrawn or objection is raised, and in any event in accordance with Welcomely’s data minimisation criteria;
• browsing data and technical logs are retained for the time strictly necessary for security, analysis and maintenance purposes;
• contact requests that do not result in a contract are retained for the time needed to handle the request and for a reasonable period for defence purposes.

9. Cookies and tracking technologies

The website uses technical cookies that are necessary for its operation and, where required by law and subject to consent, analytical, marketing and profiling cookies, as well as similar technologies.

The types of cookies used, their duration, purposes and third-party providers are described in Welcomely’s Cookie Policy available on the website. You can change your cookie preferences at any time via the cookie banner or your browser settings, within the limits of the tools made available.

10. Automated processing and profiling

Welcomely may use operational automations to send service communications, reminders, pre-stay and post-stay messages, manage the booking flow, implement commercial segmentation and prevent fraud.

Where decisions are based solely on automated processing, including profiling, and produce legal effects concerning you or similarly significantly affect you, Welcomely will provide you with specific information on the logic involved, as well as on the significance and envisaged consequences of such processing.

11. Data subjects’ rights

Data subjects may exercise their rights under Articles 15–22 GDPR, including the rights to:

• obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, access to the data (right of access);
• obtain the rectification of inaccurate personal data and the completion of incomplete data (right to rectification);
• obtain the erasure of personal data in the cases provided for by law (right to erasure);
• obtain restriction of processing in the cases provided for by law (right to restriction of processing);
• object, on grounds relating to their particular situation, to processing based on legitimate interest, and to object to processing for direct marketing purposes (right to object);
• receive the personal data concerning them in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where the legal requirements are met (right to data portability);
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before such withdrawal.

To exercise these rights, data subjects may contact Welcomely at info@welcomely.it. Welcomely will respond within the time limits laid down by law, normally within one month, which may be extended in complex cases.

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority or with the competent supervisory authority.

12. Children

Welcomely’s services are not intended for children under 18 years of age. If Welcomely becomes aware that it has inadvertently collected personal data relating to minors, such data will be deleted or anonymised, unless their retention is required by law.

13. Security and data breaches

Welcomely adopts appropriate technical and organisational security measures to protect personal data, including access controls, authentication systems, encryption where appropriate, monitoring and backup procedures.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, Welcomely will notify the competent supervisory authority and, where required, the data subjects, in accordance with Articles 33 and 34 GDPR.

14. Updates to this notice

This privacy notice may be updated from time to time, for example to reflect changes in law, technology or Welcomely’s organisation. The updated version will be published on the website and will indicate the date of the latest revision.