Privacy Policy
Last updated: November 4th, 2026
This Privacy Policy explains how Nea Apartments processes personal data relating to people who visit its website, submit an enquiry through the contact form or use the contact details provided on the site.
This notice covers the website and the enquiries arising from it. The processing of personal data relating to bookings, stays and administrative or tax obligations may also be subject to additional information and requirements under applicable law.
1. Data controller
The data controller is:
Anna Criscuolo
Nea Apartments
Via Aquila 152, 80143 Naples, Italy
Email: neaapartments@gmail.com
For questions concerning the processing of personal data, you may contact the controller at the email address indicated above.
2. What personal data we collect
The website may process the following categories of personal data.
Data provided through the contact form
First and last name.
Email address.
Expected check-in and check-out dates.
Preferred bed configuration.
Any additional information entered in the optional message field.
This information is provided directly by the user when completing and submitting the form.
Data communicated through other channels
If you contact us by email, telephone or messaging applications, we may process the information contained in your communication and the data necessary to respond to your enquiry.
If you choose to contact us through an external service such as WhatsApp, Telegram, LINE or Viber, the relevant provider processes data according to its own terms and privacy policy.
Technical browsing data
During your visit, technical data necessary for the operation and security of the website may be processed. This may include your IP address, browser and device information, the date and time of requests, and technical server logs. The actual categories and retention periods depend on the hosting configuration and the security tools used.
The website does not currently use traffic analytics or behavioural advertising tools, subject to any future changes that would be accompanied by the necessary updates to this notice and the relevant consent settings.
3. Purposes and legal bases of processing
Personal data are processed for the following purposes.
Handling enquiries and availability requests
Data submitted through the form or communicated directly are used to respond to enquiries, check availability and, where requested, provide information or a quotation relating to a stay.
The legal basis is taking steps at the data subject’s request prior to entering into a contract, under Article 6(1)(b) of the GDPR.
Managing bookings and guest relationships
Where an enquiry results in a booking or contractual relationship, the necessary data are processed to manage the stay and related administrative requirements.
The applicable legal bases depend on the specific purpose and may include performance of a contract and compliance with legal obligations.
Website security and proper operation
Technical data, where collected, are used to maintain the website, identify technical issues and prevent misuse or unauthorised access.
Where applicable, the legal basis is the controller’s legitimate interest in ensuring the security and proper operation of its systems, subject to the rights and freedoms of data subjects.
Displaying external content, such as Google Maps
The embedded map and other external content requiring consent are activated only in accordance with the preferences expressed by the user through the cookie and consent management system.
When you authorise the map to load or open a Google Maps link, Google may receive technical connection and device data according to its own processing practices.
You may change or withdraw your consent through the consent settings available on the website. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
4. Whether providing data is mandatory
Providing the information marked as required in the contact form is necessary for the controller to handle the request. If these fields are not completed, we may be unable to respond adequately or check the requested availability.
The additional message field is optional.
Please do not include unnecessary information in the free-text field, particularly health information or other special categories of personal data. If you need to communicate a specific requirement, please contact the controller directly and provide only the information strictly relevant to that request. Any processing of special-category data requires an applicable legal condition under Article 9 of the GDPR.
5. Contact by email or WhatsApp
When a user submits an enquiry through the form, the data are sent to the controller through the email system configured for the website.
If the user selects the WhatsApp button, some of the information entered in the form may be used to prepare a message. The message is not sent automatically: the user must proceed to WhatsApp and personally confirm that it should be sent.
Opening WhatsApp involves the use of an external service and may result in data processing by its provider. The privacy notice and terms of the service apply.
6. Recipients of personal data
Personal data may be processed, to the extent necessary for the purposes described above, by the following recipients or categories of recipients:
Website hosting, IT infrastructure and security providers, including the hosting provider used for the website.
Email and message-delivery service providers.
External service providers activated by the user, such as Google Maps and messaging applications.
Authorised collaborators or professional advisers, where necessary to manage enquiries or meet administrative and legal requirements.
Public authorities where disclosure is required by law.
Technical providers may process data on behalf of the controller or act according to their own purposes and responsibilities, depending on the service involved.
Personal data are not sold to third parties. The website does not currently use personal data for behavioural advertising campaigns or commercial profiling.
7. Transfers outside the European Economic Area
Some external service providers may process data in countries outside the European Economic Area, depending on the service and its configuration.
Where personal data are transferred internationally, the transfer must comply with the GDPR, including, where applicable, adequacy decisions or appropriate safeguards provided for by law.
Before this Privacy Policy is finalised, the providers actually used and the applicable transfer mechanisms must be verified.
8. Data retention
Personal data are retained for as long as necessary for the purposes for which they were collected, subject to applicable legal obligations.
Enquiries that do not result in a booking: data relating to enquiries that do not lead to a booking are retained for up to six months after the enquiry has been concluded, unless longer retention is necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.
Bookings and stays: data required to manage a booking and comply with administrative, accounting or tax obligations are retained for the periods required by applicable law.
Technical data and security logs: retention periods depend on the server configuration and the security tools used and must be verified against the actual settings of the relevant providers.
9. Your rights
Subject to the conditions and limits set by the GDPR, you may have the right to:
Obtain confirmation as to whether personal data concerning you are being processed and access those data.
Request the rectification of inaccurate data or completion of incomplete data.
Request erasure of your data where the relevant conditions are met.
Request restriction of processing.
Object to processing in the circumstances provided for by law.
Receive your data in a structured, commonly used and machine-readable format where the right to data portability applies.
Withdraw consent previously given, without affecting the lawfulness of processing carried out before withdrawal.
To exercise these rights, please contact the controller using the email address provided in this Privacy Policy.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) in accordance with the procedures available on its official website: https://www.garanteprivacy.it/.
The controller will respond to requests concerning data subject rights within the time limits set by the GDPR, normally within one month of receipt, subject to extensions where permitted by law.
10. Cookies and external services
The website uses Complianz to manage cookie preferences and external content that requires consent.
For detailed information about cookie categories, services used and how to manage your preferences, please consult the Cookie Policy available on the website.
External links, including links to maps and messaging applications, may lead to websites or services governed by their own privacy policies.
11. Data security
The controller implements technical and organisational measures appropriate to the circumstances and risks of processing, with the aim of protecting personal data against unauthorised access, loss, disclosure or alteration.
No electronic transmission or storage system can be regarded as entirely risk-free.
12. Automated decision-making
For the purposes described in this Privacy Policy, the controller does not intend to make decisions based solely on automated processing, including profiling, that produce legal effects concerning a data subject or similarly significantly affect them.
13. Changes to this Privacy Policy
This Privacy Policy may be updated if the website, the services used or the methods of processing personal data change.
The updated version will be published on this page together with the relevant update date.