Privacy policy
How we handle your data when you contact us and when you stay with us.
Last updated: 29 September 2026
Who handles your data
The data controller is the owner (landlord) of the apartment you book. Far37 and Edera Apartment belong to different owners: the landlord's name is stated in the rental agreement you receive before your stay.
The apartments are managed by Lemilà – Authentic Stay, which answers requests sent through the website and handles bookings on the owners' behalf. For any privacy request, including one addressed to the owner, write to info.lemilastay@gmail.com: we will reply or forward it to the owner.
What data we process
- Contact and request details: name, email, phone, dates, number of guests and the messages you send us through the website, WhatsApp or email.
- Booking and payment details: amounts, payment dates, bank transfer details. We do not store payment card data.
- Guest data required by law: for each guest, first and last name, sex, date and place of birth, nationality and ID document details.
Why we process it
- To answer requests and manage your booking and rental agreement (Art. 6(1)(b) GDPR).
- To meet legal obligations (Art. 6(1)(c) GDPR): reporting guests to the police via the Alloggiati Web portal (Art. 109 TULPS), statistical reporting to the regional system and ISTAT, collecting the City of Milan tourist tax, and tax and accounting obligations.
- To protect our rights in case of disputes (Art. 6(1)(f) GDPR).
Providing guest data is required by law: without it we cannot complete your stay. We don't use your data for advertising and we don't sell it.
Who we share it with
- Public authorities, where required by law: the Italian State Police, the Lombardy Region and ISTAT, the City of Milan, the Italian Revenue Agency.
- Lemilà – Authentic Stay, which manages the apartment and bookings on the owner's behalf.
- Providers that help us manage bookings: email (Google), messaging (WhatsApp, by Meta), website hosting (Netlify), bank and payment services, our accountant.
Some of these providers may process data outside the European Union, for example in the United States. In those cases the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
How long we keep it
- Requests that don't lead to a booking: up to 12 months.
- Agreement, payment and tax data: 10 years, as required by tax law.
- ID documents: we use them for the mandatory police report and don't keep copies longer than necessary. We keep the report receipts for the period required by law.
This website
This website uses no profiling cookies and no analytics or advertising tools, and it doesn't load content from external services. Our hosting provider logs technical visit data, such as IP addresses, for security and operation. When you tap a WhatsApp button or an Airbnb link, you leave the site and those services' privacy policies apply.
Your rights
You can ask us at any time to access, correct or delete your data, restrict or object to its processing, or receive it in a portable format (Arts. 15-22 GDPR), by writing to info.lemilastay@gmail.com. Some data cannot be deleted while the law requires us to keep it. You can also lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or the authority in your country.
Terms of your stay: Booking terms.