This site runs no analytics, sets no advertising or marketing cookies, and loads no tracking pixels. Fonts and video are served from our own domain. It sets one cookie to remember your cookie choice. Two third parties can load: the Google map on a scene page, only after you accept, and the Amenitiz booking panel, only when you open it. This notice tells you everything the GDPR requires us to tell you.
HOSTAGE sarl and EGOB25 srls decide together why and how the data described here is processed, and are joint controllers for it.
They decide jointly, so the arrangement does not divide you between them: you may exercise every right described below against either company, and a request sent to the address above reaches both. Neither will send you back to the other.
You can reach us for any privacy question at hostagerie@gmail.com or by phone on +33 6 66 07 06 16 (Nice) and +39 371 109 1174 (Rome).
We have not appointed a Data Protection Officer. We are not required to: we run no large-scale monitoring and process no special categories of data.
Each purpose below stands on its own legal basis under Article 6 of the GDPR.
| What | Why | Legal basis |
|---|---|---|
| Delivering this website | Serving the pages you ask for and keeping the site available and secure. | Legitimate interest, Art. 6(1)(f): running a website that works. |
| Your cookie choice | Remembering whether you accepted or refused, so the banner does not ask again, and so we can show that you were asked. | Legal obligation, Art. 6(1)(c), read with Art. 7(1): we must be able to demonstrate consent. |
| The map on a scene page | Showing where a property is. | Your consent, Art. 6(1)(a), given through the cookie banner and withdrawable at any time. |
| The booking panel | Letting you check dates and book a stay through Amenitiz. | Steps taken at your request before a contract, Art. 6(1)(b). |
| Your message to us | Replying to what you asked, whether you write by email, call, or use the contact form. | Steps taken at your request before a contract, Art. 6(1)(b), or our legitimate interest in answering you, Art. 6(1)(f). |
| Keeping the form usable | Stopping automated abuse. We store a salted one-way hash of your IP address alongside the message, never the address itself. We treat that hash as personal data, not as anonymous. | Legitimate interest, Art. 6(1)(f): protecting the form from bulk submissions. |
Strictly necessary storage is set without asking, because the site cannot work without it. Everything else waits for your consent. This is the complete list.
Two of the categories in that panel — analytics and marketing — set nothing at all today, because this site uses neither. They are offered so your choice is recorded before any such tool could ever be added, never after.
| Name | Set by | Purpose | Lifetime | Category |
|---|---|---|---|---|
| cc_cookie | HOSTAGE (this site) | Stores your cookie choice so the banner does not ask again. | 6 months | Necessary |
| hostage-intro | HOSTAGE (this site) | Plays the opening title sequence only once per visit. Held in session storage, not as a cookie, and never sent to us. | Until you close the tab | Necessary |
| payload-token | HOSTAGE (this site) | Keeps a member of our team signed in to the content system at /admin. It is never set for ordinary visitors. | 2 hours | Necessary |
| Google Maps cookies | Google Ireland Limited | Displays the map on a scene page. Google sets its own cookies and receives your IP address. Nothing loads until you accept the functional category. | Set by Google. See Google's own privacy policy. | Functional — consent required |
| Amenitiz cookies | Amenitiz | Runs the booking panel, and only once you open it yourself. Amenitiz acts as its own controller under its own privacy policy. | Set by Amenitiz. See their privacy policy. | Necessary for the service you requested |
Select “Cookies” in the footer of any page to reopen the panel and change your answer. Withdrawing is exactly as easy as accepting, and it takes effect at once: the map goes back to a placeholder. Withdrawal does not make what happened before it unlawful. We will not ask again for six months unless you clear your browser storage or change your settings yourself.
You can also block or delete cookies in your browser settings. Blocking the strictly necessary ones may stop parts of the site from working.
We sell nothing and share nothing for marketing. These are the only parties involved, and each one only in the role named.
| Party | Role | Purpose |
|---|---|---|
| Vercel Inc. | Hosting provider, acting as our processor | Serves the site and processes technical request data such as IP addresses. |
| Resend | Email provider, acting as our processor | Delivers the notification email when you send the contact form. |
| Google Ireland Limited | Map provider, acting as its own controller | Receives your IP address and request data if, and only if, you allow the map to load. |
| Amenitiz | Booking engine, acting as its own controller | Handles a booking you start from a scene page, under its own privacy policy. |
Vercel and Google are United States companies and may process data outside the EEA. Those transfers rely on the European Commission's adequacy decision of 10 July 2023 for the EU-US Data Privacy Framework. That decision is in force at the date below and is under appeal before the Court of Justice of the European Union. If it is set aside we will move the transfers onto standard contractual clauses. Write to us for a copy of the safeguards in place.
| What | How long |
|---|---|
| Contact form messages and email correspondence | 24 months after our last exchange. A daily job deletes anything past that date, so the period is enforced and not merely stated. We keep a message longer only where we need it to manage a booking or to establish or defend a legal claim. |
| The abuse-prevention hash | A salted one-way hash of your IP address, stored with the message to stop automated abuse. Your address itself is never written down. The hash is pseudonymised rather than anonymous: it tells nobody who you are, but we do not claim it is irreversible, so we treat it as personal data and delete it with the message. |
| Your cookie choice | 6 months, or until you change it or clear your browser storage. |
| Server request logs | Held by Vercel for the period stated in its own documentation. We do not keep a separate copy. |
Under the GDPR you can ask us to:
Write to hostagerie@gmail.com. We answer within one month. We never charge for this, and we will not ask you for more data than we need to find your record.
If you think we have handled your data wrongly, you can lodge a complaint with a supervisory authority. Ours are the Garante per la protezione dei dati personali in Italy (garanteprivacy.it) and the Commission Nationale de l'Informatique et des Libertés in France (cnil.fr). You can also complain to the authority where you live, where you work, or where you believe the problem happened.
No. Giving us your data is neither required by law nor by a contract, and you are free to browse the whole site without doing so. If you choose not to give us your contact details, the only consequence is that we cannot reply to you.
We take no automated decisions about you and we do not profile you.
If this notice changes we will update the date below. Where a change affects something you consented to, we will ask you again rather than assume the old answer still stands.
Last updated: 30 August 2026