This page explains how Hugowiz Sas di Donelli Ugo Mendes & C. handles the personal data of people who visit milanskyline.it and of people who book the Milan Skyline Apartment. It is the notice required by articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and by Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.
Data controller
Hugowiz Sas di Donelli Ugo Mendes & C., VAT and tax code 07762540966, with registered office at Via Pompeo Cambiasi 10, 20131 Milan, Italy. For anything concerning personal data, write to info@milanskyline.it or call +39 338 858 9561. Hugowiz Sas is a small company and has not appointed a data protection officer (DPO): requests go straight to the controller, Ugo Mendes Donelli.
What data we handle
- Contact and booking data: first and last name, email address, phone number, arrival and departure dates, number of guests, the requests you write to us. At check-in we collect identity documents, as the law requires.
- Booking platform data: if you book through Booking.com, Airbnb or your.rentals, the data reaches us from the platform (name, contacts, booking, messages). The source of this data is the platform you booked with: we do not collect it directly from you (art. 14 GDPR). The platform also handles the same data on its own account, under its own notice.
- Browsing data: pages visited, IP address, browser and device type, where the visit came from. This data comes from Google Analytics 4 and only if you accept analytics cookies.
- We do not ask for special categories of data (health, religious or political beliefs, sexual orientation) and we do not run advertising profiling.
Purposes and legal bases
Every processing operation has its legal basis, given here next to it (art. 6 GDPR):
- Managing the booking and the stay — performance of a contract or pre-contractual steps (art. 6.1.b): answering a request, confirming the booking, handing over the keys, handling payment and the messages about the stay.
- Meeting legal obligations — legal obligation (art. 6.1.c): invoicing and keeping accounting records, reporting guests to the public security authority, tax obligations.
- Keeping the site working and secure — legitimate interest of the controller (art. 6.1.f) in preventing abuse and defending a right in case of a dispute.
- Measuring visits and showing the booking widgets — consent (art. 6.1.a and art. 122 of the Italian Privacy Code): Google Analytics 4, the Booking.com booking form and reviews, and the your.rentals direct booking widget. Without consent these tools are not loaded.
Recipients and suppliers
- Aruba S.p.A., for the domain, the website hosting and the email mailbox.
- Google Ireland Limited, for Google Analytics 4 and only with your consent.
- Booking.com B.V., Airbnb Ireland UC and your.rentals: the platform you book with handles the data as an independent controller; the Booking.com widgets (booking form and reviews) and the your.rentals direct booking are loaded only with your consent.
- The tax adviser, for accounting obligations, and public authorities when the law requires it.
- Suppliers that handle data on behalf of the controller receive written instructions (art. 28 GDPR).
Transfers outside the European Union
Google may also process data in the United States: the transfer relies on the standard contractual clauses approved by the European Commission (art. 46 GDPR) and on the other safeguards described in its notice; you can ask us for a copy of the appropriate safeguards (art. 46(2)(c) GDPR). Booking.com, Airbnb and your.rentals state in their own notices where they process data. If you want to know which safeguards apply to a transfer that concerns us, write to us.
How long we keep data
- Bookings, invoices and accounting records: 10 years: not our choice, it is the period the law requires for keeping accounting records (art. 2220 of the Italian Civil Code and tax rules).
- Google Analytics data: the data retention period set in the Google Analytics 4 property: 14 months, Google's default, which the controller can change in the property configuration.
- Proof of consent (the choice saved in the browser): 6 months (182 days); after that we ask again.
- Requests received by email or phone: 12 months, then they are deleted if there is no reason to keep them.
Your rights
You can ask at any time for:
- access to your data and a copy of it (art. 15)
- rectification of what is wrong or incomplete (art. 16)
- erasure of the data, when there is no reason to keep it (art. 17)
- restriction of processing (art. 18)
- objection to processing based on legitimate interest (art. 21)
- portability of the data you gave us, in a machine-readable format (art. 20)
- withdrawal of consent at any time, without affecting the lawfulness of processing already carried out (art. 7.3)
Write to info@milanskyline.it; we answer within one month (art. 12 GDPR) and, if the request is complex, we tell you and give you a date. If the answer does not satisfy you, you can lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) (art. 77 GDPR), Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it.
Giving your data is optional. Without contact and booking data, however, we cannot manage the stay; without analytics cookies the site works just the same.
Cookies
A cookie is a small file that a site saves in the browser. This site loads third-party tools only after your consent, and consent is given from the banner that appears on your first visit or from the button in the "Book" section of the home page.
Necessary cookies
We set no session cookies. We save one preference in localStorage, key msa-consent with the date in msa-consent-data: it is your consent choice, it stays in the browser, it is not sent to any server, and it lasts 182 days (about 6 months).
Analytics (only with consent)
Google Analytics 4, identifier G-RQNCV80DTR, sets the cookies _ga and _ga_ID (where ID identifies the property), which tell one browser from another and last up to 24 months: that is Google's default, changeable in the property configuration. They start only with "Accept all"; with "Necessary only" gtag.js is not even downloaded. Google's notice is at policies.google.com/privacy.
Third-party cookies (only with consent)
In the "Book" section of the home page, with your consent, three third-party tools are loaded: the Booking.com booking form, the Booking.com reviews and the your.rentals direct booking widget. They may set their own cookies; durations and purposes are stated in their own notices (booking.com and your.rentals), which we do not control.
How to change or withdraw consent
At the bottom of every page there is "Manage cookies": it opens the banner again and you can choose anew. If you go from "Accept all" to "Necessary only", the page deletes the _ga cookies and reloads without trackers. You can also clear the site data in your browser settings: the choice disappears and we ask you again on your next visit.
Changes
If something changes — a new supplier, a new purpose, a different retention period — we update this page and the date at the top. The version published here is the one that applies.