Your Stay app privacy notice
Last updated: 21 October 2026
Privacy notice pursuant to Article 13 and, where applicable, Article 14 of Regulation (EU) 2016/679 for users of the Your Stay app · Version 2026-4 of 21 October 2026
This is a courtesy translation. In case of discrepancies, the Italian version prevails.
This notice describes how Resort 95 Village S.r.l. processes the personal data of guests and staff who use the Your Stay app to manage bookings and stays, write to the property in chat, use the artificial intelligence concierge (optional) and take part in the De Angelis Privilege programme.
For browsing the website, guest registration on arrival and other processing, the website Privacy Policy and the specific notices provided at the time of collection apply. For the loyalty programme, the De Angelis Privilege privacy notice remains valid and is summarised here for the part handled through the app.
1. Data controller and contacts
Resort 95 Village S.r.l.
Registered office: Via Giovanni XXIII, 33 - 63074 San Benedetto del Tronto (AP), Italy
Tax code and Companies Register number: 02344200445
REA: AP - 205865
Email for privacy requests: segreteria@deangelisvillage.com
Certified email (PEC): info@pec.resort95village.com
Requests can also be sent by post to the registered office, marked “Privacy”.
2. Who this notice applies to
- Guests: anyone who creates an account in the app to manage bookings and stays, write to the property in chat and use the De Angelis Privilege programme.
- Staff: employees and collaborators of the Company who access the app with a service account to assist guests.
For staff, this notice covers only the use of the app. The employment relationship is described in the staff privacy notice.
3. Personal data processed
We process only the data needed for the app features you use.
| Area | Data |
|---|---|
| Guest account | First name, last name, email address, password (stored only in encrypted, unreadable form), telephone (optional), language, country. Codes sent by email to verify your address on registration and to recover your password; on iOS and Android also the booking reference requested at login, except in visitor mode. Date and time of access. |
| Staff account | Name, role and property, personal login credentials, date and time of access and a log of operations carried out in the app (for example messages sent, requests handled). |
| Bookings and stays | Booking reference, dates, property, accommodation, number and composition of guests, ages of minors when needed, amounts, payment status, service requests. Data may also come from the person who booked for you, travel agencies, tour operators or booking platforms. |
| Chat with the property | Content of messages, attachments you choose to send (for example a photo of a fault), date and time, name of the staff member who replies. |
| AI concierge (optional) | Stay preferences (dates, number of people, interests, pace), requests you write to the concierge and replies, proposed programmes and their status, choice to receive a daily proposal, consent and its version. |
| De Angelis Privilege | Card number, tier and expiry, points balance and transactions, rewards requested, benefits assigned; amount, date and outlet of purchases recorded with the card, without details of what was consumed. |
| Device and notifications | Push notification identifier, device model and operating system, app version, device language, technical error and security logs. |
| Consents | Text accepted, document version, date and time; withdrawn consents. |
The app accesses the camera, photo library or notifications only for the features that need them and only after your permission, which you can revoke at any time in your device settings.
Do not enter card numbers, security codes, passwords or health information in the chat or the AI concierge. For accessibility needs, allergies or assistance, the property will indicate the appropriate channel and provide the specific notice: these data also require a condition under Art. 9 GDPR.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing the guest account: registration with email address verification, login with email and password, password recovery and account security. | Art. 6(1)(b) GDPR: performance of the app service contract requested by the user. |
| Showing and managing bookings, changes, payments, service requests and communications about the stay. | Art. 6(1)(b) GDPR: performance of the contract and pre-contractual measures. |
| Replying to chat messages before, during and after the stay. | Art. 6(1)(b) GDPR when the request concerns the booking; Art. 6(1)(f) for other requests, in the interest of responding. |
| Managing participation in De Angelis Privilege: card, points, tier, benefits and rewards. | Art. 6(1)(b) GDPR: performance of the Programme participation contract. |
| Using the AI concierge: interpreting your requests and preferences to point you to information in the property’s catalogue and suggest available activities and services; if you choose, preparing a proposal for you every day. | Art. 6(1)(a) GDPR: optional consent, separate from the others and revocable at any time. Without consent you can choose services yourself or write to reception. |
| Sending service push notifications (confirmations, reminders, chat replies). | Art. 6(1)(b) GDPR. Notifications can be turned off in your device settings. |
| Sending offers and news, including offers reserved for Privilege members and selected on the basis of tier and previous stays, by email or notification. | Art. 6(1)(a) GDPR and Art. 130 of Italian Legislative Decree 196/2003: optional, separate and revocable consent. |
| Allowing staff to use the app for their work and keeping track of who carried out each operation. | Art. 6(1)(b) and (c) and Art. 88 GDPR; Art. 4(2) of Italian Law 300/1970 (work tools). |
| Complying with administrative, tax and accounting obligations. | Art. 6(1)(c) GDPR. |
| Ensuring the security and operation of the app, preventing abuse and fraud, defending the Company’s rights. | Art. 6(1)(f) GDPR: legitimate interest, subject to a balancing test. |
The Privilege tier is calculated automatically using objective, public thresholds set out in the Terms and Conditions (nights, stays, spending). On request, a member of staff checks the calculation.
The AI concierge does not decide for you: it only selects information, services and times already in the property’s catalogue. Each proposed programme is checked by staff and becomes a booking only after you confirm it. Requests about payments, cancellations, health or allergies are passed to staff.
Data recorded on staff use of the app are not used to monitor work activity remotely. They may be used for the purposes of the employment relationship only within the limits of Art. 4(3) of Italian Law 300/1970 and of this notice.
5. Providing data
Name and email are required to create the account; without them the app cannot be used. Telephone, photos in chat, notifications, the AI concierge and marketing consent are optional: refusing them does not prevent you from booking, using the chat or taking part in Privilege. Withdrawal of consent applies to the future and does not affect the lawfulness of prior processing.
6. How data are processed and recipients
Data are processed electronically by authorised staff (reception, assistance, outlets, administration), each only as far as needed for their duties. Staff see only the guest data needed for the request they are handling. The Controller adopts technical and organisational measures appropriate to the risks, with access restrictions and procedures for deleting data.
The following may access the data as processors bound by an agreement under Art. 28 GDPR:
- providers of hosting, development and maintenance of the app and the management system;
- the provider of the booking management system;
- the chat service provider, where different from the management system;
- email and push notification service providers (Apple Push Notification service, Google Firebase Cloud Messaging);
- OpenAI, provider of the artificial intelligence model used by the concierge, only if you use the AI concierge after giving consent;
- administrative and tax consultants.
What OpenAI receives. For each request to the AI concierge we send OpenAI:
- the text you write and the latest messages of your conversation with the concierge;
- your preferences (number of people, interests, pace);
- the chosen date;
- the list of the property’s available services, information and times.
We do not send your name, email, telephone, booking reference, card number or other account data, but OpenAI receives everything you write in the message: avoid entering unnecessary personal data. Storage of requests for the app is disabled and, under the service terms, the data sent are not used to train the models. OpenAI may retain them for a limited period, up to 30 days, for security and abuse prevention.
Banks and payment service providers process payment data as independent controllers. If you add the Privilege card to Apple Wallet or Google Wallet, the card’s name, tier, number and QR code are sent to the chosen service, which processes them under its own terms. Data are not sold or disclosed to third parties for their own purposes.
7. Transfers outside the European Economic Area
Apple and Google notification services and, for users of the AI concierge, the OpenAI service may involve processing in the United States. In these cases the transfer takes place with the safeguards of Articles 44 et seq. GDPR, for example the EU-US Data Privacy Framework adequacy decision or standard contractual clauses.
The Controller does not transfer other app data outside the European Economic Area. If a provider were to do so, the transfer would take place only with the same safeguards.
8. Data retention
Data are kept for as long as needed for each purpose, then deleted or irreversibly anonymised, including in backup copies according to the cycles defined by the Controller.
| Data | Retention |
|---|---|
| Guest account | Until the account is deleted. After 36 months without stays, purchases or logins, the account is deleted or anonymised, with prior notice by email. |
| Chat messages and attachments | 24 months after the end of the last stay, except where needed for a pending complaint or dispute. |
| Bookings and contractual documents | For the duration of the relationship and then up to 10 years, for limitation periods. |
| Accounting and tax records, including points transactions linked to tax documents | 10 years (Art. 2220 of the Italian Civil Code), anonymised after the account is closed where possible. |
| AI concierge: messages | 30 days. |
| AI concierge: preferences and proposed programmes | 90 days from the last update; confirmed programmes follow the rules for bookings. You can delete them immediately from the concierge in the app; if you withdraw consent, no further requests are sent to OpenAI. |
| Privilege Programme data | For the duration of membership; after 36 months without stays, purchases or access to the member area, deleted or anonymised. |
| Marketing consent | Until withdrawn, or up to 24 months after the last activity. |
| Proof of consent | For as long as needed to demonstrate it was collected, and in any case no longer than 10 years. |
| Verification and recovery codes, access logs | Codes: 15 minutes, maximum 5 attempts. Access logs: 12 months. |
| Push notification identifier | Until you log out, uninstall the app or delete the account. |
| Staff accounts and operations log | Account deactivated at the end of employment. Operations log: 12 months, except data linked to accounting records. |
| Technical and security logs | 12 months, except selective retention for incidents or requests from authorities. |
9. Deleting your account
You can delete your guest account at any time, free of charge:
- in the app (iOS and Android): in your profile settings, with the “Delete account” function, confirming with your account password;
- without the app: by writing to segreteria@deangelisvillage.com from the account’s email address, with the subject “Cancellazione account Your Stay”.
Deletion is carried out within 30 days and you receive confirmation by email. Deleting the account does not cancel bookings: the booking conditions apply to changing or cancelling them.
With the account, the profile, chat messages, AI concierge preferences, messages and programmes, notification identifiers and marketing consents are deleted or anonymised. If you are a De Angelis Privilege member, the membership ends: as provided by the Terms and Conditions, unused points and the tier lapse, while rewards already confirmed remain valid.
Only data that the law requires us to keep or that are needed to defend a right are retained, for the periods in section 8: contractual and tax documents relating to bookings, points transactions linked to tax documents (anonymised where possible), proof of consent and your email address on the suppression list for promotional communications, if you have objected.
Staff accounts are managed by the Company: they are deactivated at the end of employment or on request to the property manager.
10. Rights of data subjects
In the cases and within the limits provided by the GDPR you may request access to your data and a copy, rectification, erasure, restriction and portability of the data you provided. You may object at any time to direct marketing and, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 21 GDPR).
Marketing consent can be withdrawn from the profile preferences in the app, from the link in every email or by writing to the Controller. Consent to the AI concierge can be withdrawn from the concierge preferences in the app: from then on no new requests are sent to OpenAI. Push notifications can be turned off in your device settings.
Requests should be sent to segreteria@deangelisvillage.com or to the other contacts in section 1. We reply without undue delay and normally within one month, which may be extended by two months in the cases of Art. 12 GDPR. Requests are free of charge; if we have doubts about your identity, we ask only for the information needed to verify it.
You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of your country of residence under Art. 77 GDPR, and you may also apply to the courts.
Information on how to lodge a complaint with the Garante
11. Minors
The account and the Privilege Programme are reserved for adults. Data of minors travelling with you are limited to what is needed for the booking and are not used for marketing. If we discover an account created by a minor, we delete it.
12. Updates
This notice may be updated for new app features or changes in the law. The current version is always available in the app and on this page (https://villaggiocentrovacanzedeangelis.com/en/privacy-app/). Significant changes are communicated in the app or by email before they apply; publication of a new version alone does not constitute consent.