Privacy Policy

Last updated: 14 October 2026

Who we are

The data controller is Aura Luxury S.r.l., Via Fratelli Cairoli 13, 22100 Como, Italy, VAT IT12007020964 ("Aura", "we"). Contact for privacy matters: info@auraluxuryco.com.

What data we collect and why

  • Handling enquiries (contact form, email, WhatsApp, phone)
    Data: Name, email, phone, message, travel dates
    Legal basis (GDPR art. 6): Pre-contractual steps at your request (6.1.b)
    Kept for: 24 months after last contact

  • Booking and managing your stay, including payments, check-in, guest communication and concierge services
    Data: Name, contact details, guests in party, dates, payment details (processed by our payment provider), special requests
    Legal basis (GDPR art. 6): Performance of a contract (6.1.b)
    Kept for: 10 years for accounting and tax records

  • Guest registration with the Police (Alloggiati Web, art. 109 TULPS), tourist tax (Comune) and tourism statistics (ISTAT / Regione Lombardia)
    Data: Identity document details, nationality, date and place of birth for every guest
    Legal basis (GDPR art. 6): Legal obligation (6.1.c)
    Kept for: As required by law. ID copies are not kept after transmission.

  • Accounting, invoicing and tax
    Data: Billing details, amounts paid
    Legal basis (GDPR art. 6): Legal obligation (6.1.c)
    Kept for: 10 years

  • Newsletter and offers
    Data: Email address
    Legal basis (GDPR art. 6): Consent (6.1.a), which you can withdraw at any time
    Kept for: Until you unsubscribe

  • Website analytics and advertising measurement
    Data: Cookie identifiers, device and usage data
    Legal basis (GDPR art. 6): Consent (6.1.a), see our Cookie Policy
    Kept for: See Cookie Policy

  • Protecting our rights, such as handling damage claims or disputes
    Data: Booking and communication records
    Legal basis (GDPR art. 6): Legitimate interest (6.1.f)
    Kept for: Until the claim is resolved and limitation periods have expired

Who we share data with

We share data only as needed for the purposes above, with:

  • Service providers acting as processors: Hostaway (booking system), Squarespace (website), Google Workspace (email and files), our payment provider, and our cleaning, maintenance and concierge partners.

  • The owner of the property you stay in, limited to what is needed for your stay.

  • Booking platforms (Airbnb, Booking.com, Vrbo, Google), when you book through them. Their own privacy policies also apply.

  • Public authorities (Questura, Comune di Como, ISTAT, tax authorities), where the law requires it.

Some providers (for example Hostaway, Squarespace and Google) may process data outside the EEA. Where they do, transfers are covered by an adequacy decision (including the EU–US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.

Your rights

You have the right to access, correct or delete your data; to restrict or object to processing; to data portability; and to withdraw consent at any time. To exercise these rights, email info@auraluxuryco.com. You may also lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Do you have to give us your data?

Booking details and guest ID data are required by contract and by law: without them we cannot confirm your stay. Newsletter and analytics data are optional.