OURBNB - Privacy Policy

    Privacy Policy

    Last updated: 19 May 2026

    This Privacy Policy describes how OURBNB ("we", "us" or "our") collects, uses and protects the personal data of users ("user" or "data subject") who visit our website and use our enquiry, property management and booking services.

    Personal data is processed in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable national law.

    1. Data Controller

    The Data Controller is:

    OURBNB
    Registered office: Via Vittorio Veneto 25, Udine, Italia
    VAT number: 03090610308
    Contact email: info@ourbnb.properties
    Phone: +39 345 984 6792

    2. Types of Data Collected

    We collect different types of personal data to provide and improve our services.

    A. Data voluntarily provided by the user

    When users fill in the contact forms on the website, we may collect:

    • Identification data: first name and last name.
    • Contact data: email address and phone number.
    • Business data: company name, if provided by the user.
    • Request-related data: city or property of interest, length of stay, number of guests and other information useful for managing the request.
    • Messages: any additional information freely entered in the "Message" field.

    Fields marked as required in the forms are necessary for us to respond to the request. Failure to provide such data may prevent us from contacting you or properly managing the request. Optional fields are voluntary and only help us understand the request more fully.

    B. Browsing data

    The IT systems used to operate the website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category may include, for example:

    • IP addresses or domain names of the devices used by users;
    • time of the request;
    • method used to submit the request to the server;
    • numerical code indicating the status of the server response;
    • technical information about browser, operating system and device.

    This data is used to allow the website to function, obtain aggregated statistical information, improve performance and verify any anomalies or security issues.

    C. Data collected through third-party services

    Some website features rely on external providers, described in section 4. These services may process technical data, online identifiers or information about the user's interaction with the service, according to their respective privacy policies.

    3. Purposes and Legal Bases of Processing

    Personal data is processed for the following purposes.

    A. Managing requests and contacts

    We process data entered in forms to respond to requests sent through the website, provide information about our services, prepare quotes and manage the preliminary steps before a booking or collaboration.

    • Legal basis: performance of pre-contractual or contractual measures requested by the data subject (Art. 6.1.b GDPR).

    B. Managing bookings, stays and contractual relationships

    When a request becomes a booking, an advanced negotiation phase or a contractual relationship, we may process the data necessary for the operational, administrative and accounting management of the relationship.

    • Legal basis: performance of a contract or pre-contractual measures (Art. 6.1.b GDPR) and compliance with legal obligations (Art. 6.1.c GDPR).

    C. Website security and operation

    We use technical browsing data to ensure platform security, prevent abuse or cyberattacks, monitor proper website operation and resolve technical issues.

    • Legal basis: legitimate interest of the Data Controller (Art. 6.1.f GDPR) in the security and continuity of the service.

    D. Aggregated statistics and performance

    We use analytics and performance measurement tools to understand website usage in aggregate form and improve speed, reliability and user experience.

    • Legal basis: legitimate interest of the Data Controller (Art. 6.1.f GDPR), provided that the tools used do not involve advertising profiling or invasive tracking.

    E. Compliance with legal obligations

    We may need to process personal data to comply with obligations under laws, regulations or EU rules, or to respond to requests from competent authorities.

    • Legal basis: compliance with a legal obligation (Art. 6.1.c GDPR).

    F. Legal defence

    Personal data may be used to establish, exercise or defend a right of the Data Controller in judicial or out-of-court proceedings.

    • Legal basis: legitimate interest of the Data Controller (Art. 6.1.f GDPR).

    4. Processing Methods and Third-Party Services

    Data is processed using electronic and digital tools, with logic strictly related to the purposes indicated and with appropriate measures to protect data security and confidentiality.

    For the technical and operational management of the website, we use third-party service providers who may act, depending on the case, as data processors or independent data controllers.

    Contact form management (FormSubmit)

    We use FormSubmit to send and manage messages from contact forms.

    • Data processed: name, email, phone, company, city, request details, message and other data entered in the form.
    • Note: when you submit a form, the data is routed through FormSubmit servers before being delivered to our email inbox.
    • Service Privacy Policy: FormSubmit Privacy Policy

    Hosting and infrastructure (Vercel)

    The website is hosted on Vercel infrastructure. The provider may process technical data, system logs and information necessary for website deployment, security and availability.

    • Data processed: technical browsing data, IP addresses, request logs, device and browser information.
    • Service Privacy Policy: Vercel Privacy Policy

    Analytics and performance (Vercel Analytics and Speed Insights)

    We use Vercel Analytics and Vercel Speed Insights to monitor website performance, loading speed, Core Web Vitals and aggregated page usage.

    • Data processed: technical data and aggregated metrics related to browsing and performance.
    • Note: these tools are designed to operate without advertising profiling cookies.
    • Service Privacy Policy: Vercel Privacy Policy

    CMS and content (Sanity)

    Some website content may be managed through Sanity, which provides CMS services and content delivery through APIs and CDN.

    • Data processed: technical data necessary for requesting and delivering content.
    • Service Privacy Policy: Sanity Privacy Policy

    Images and media (Cloudinary, Sanity CDN and Unsplash)

    The website may load images and media from external services such as Cloudinary, Sanity CDN and Unsplash.

    Fonts (Google Fonts)

    The website uses Google Fonts to load typefaces. When fonts are loaded, the user's browser may establish a connection with Google servers.

    • Data processed: technical request data, IP address and browser information necessary to deliver fonts.
    • Service Privacy Policy: Google Privacy Policy

    Maps (Google Maps)

    Maps displayed on individual property pages are provided through embedded Google Maps content. The map is loaded only after a user choice or if the user has already saved the related technical preference in the browser.

    • Data processed: Google may collect browsing data, IP address, device information and, if the user is logged into a Google account, associate the view with the user's profile.
    • Note: embedded Google Maps content is provided by Google and is subject to Google's privacy policies and settings.
    • Service Privacy Policy: Google Privacy Policy

    The general locations map is generated locally using the D3.js library and, by itself, does not load maps from third parties.

    WhatsApp

    The website may include links or buttons that allow users to contact us through WhatsApp. WhatsApp opens only after a voluntary action by the user.

    • Data processed: once WhatsApp is opened, Meta/WhatsApp may process data according to its own policies and settings.
    • Service Privacy Policy: WhatsApp Privacy Policy

    5. Cookies and Tracking Technologies

    This website minimizes the use of cookies and tracking technologies.

    • Technical cookies and equivalent tools: we may use localStorage or similar technical tools to save user preferences, such as light/dark theme and the technical preference for loading Google Maps (ourbnb-google-maps-consent). The Google Maps preference is saved locally in the browser and can be removed through the dedicated control in the map box or by clearing site data from the browser. These tools are necessary or functional for a proper browsing experience and do not require prior consent.
    • Analytics and performance: Vercel Analytics and Vercel Speed Insights are used for aggregated and performance metrics and are not used for advertising or profiling purposes.
    • Third-party embedded content: services such as Google Maps may use cookies or similar technologies according to their own policies when loaded within the website after the user's choice or based on a previously saved technical preference.
    • Profiling cookies: we currently do not use proprietary profiling cookies or third-party advertising tools, such as Google Analytics advertising features, Google Ads or Meta/Facebook Pixel, to track user behaviour for marketing purposes.

    6. Transfers of Data Outside the EU

    Some providers used by the website, including FormSubmit, Vercel, Google, Sanity, Cloudinary, Unsplash and Meta/WhatsApp, may process personal data outside the European Economic Area (EEA).

    When this occurs, the transfer is carried out on the basis of instruments provided by the GDPR, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission or other appropriate safeguards provided by applicable law.

    You may request more information about the safeguards applied to transfers outside the EU by writing to the Data Controller's email address indicated in this policy.

    7. Retention Period

    Personal data is retained for the time strictly necessary to achieve the purposes for which it was collected.

    • Simple contact requests: for the time necessary to handle the request and for a subsequent period not exceeding 24 months, unless further retention is required in connection with the request or the data subject objects.
    • Negotiations, quotes and booking requests: for the time necessary to manage the negotiation and document communications, generally no longer than 24 months if no contractual relationship follows.
    • Bookings, contracts and administrative documentation: for the duration of the relationship and, where applicable, for 10 years or for any other period required by civil, tax or accounting obligations.
    • Technical data and security logs: for the time necessary for website operation and security, generally up to 7 days, unless further retention is required to investigate unlawful acts or protect rights.

    8. Data Subject Rights

    As a data subject, you have the rights provided by Articles 15-22 of the GDPR, including:

    • Access: to ask for confirmation as to whether personal data concerning you is being processed.
    • Rectification: to ask for inaccurate data to be corrected or incomplete data to be completed.
    • Erasure: to ask for data to be deleted in the cases provided by law.
    • Restriction: to ask for processing to be restricted in certain cases.
    • Portability: to receive data in a structured, machine-readable format, where applicable.
    • Objection: to object at any time to processing based on legitimate interest.
    • Withdrawal of consent: to withdraw any consent given, without affecting the lawfulness of processing carried out before withdrawal.

    To exercise your rights, you can contact us at: info@ourbnb.properties.

    You also have the right to lodge a complaint with the Italian Data Protection Authority through www.garanteprivacy.it, or to bring proceedings before the competent courts.

    9. Profiling and Automated Decision-Making

    We do not use personal data collected through the website for automated decision-making processes, including profiling under Art. 22 GDPR.

    10. Changes to this Policy

    We reserve the right to amend this Privacy Policy at any time. We invite you to consult this page regularly, referring to the last updated date indicated above.