Privacy notice
Last updated: 23 October 2026. This notice explains the processing of personal data when you visit demorastay.com, send an enquiry or use Demora’s restricted management tools.
1. Controller and contact details
The controller is DEMORA STAY S.R.L. - SEMPLIFICATA, operating under the Demora brand, with its address at Piazzale Siena 18, 20146 Milan (MI), Italy. For privacy enquiries and rights requests, email demorastay@gmail.com or call +39 342 956 4295.
VAT: 14163830962 · REA: 2764557 · Certified email (PEC): demorastay@legalmail.it. Enquiry contact: Bryan Valenza.
2. Information processed
- Browsing: the server and security systems may record your IP address, request time, requested resource, response status and technical information sent by your browser. This information is not used to create advertising profiles.
- Contact and property assessment: information you provide, including your name, contact details, property location and features, sleeping capacity and message. Required fields are identified in the form.
- Restricted area and management services: account details and, where relevant to the assignment, information about owners, contacts and guests, properties, stays, agreements, deadlines, documents and financial records. Access depends on the user’s assigned role.
- Requested documents: files supplied through a dedicated request link where necessary for a case. Please do not send identity documents or unrelated information through general enquiry forms.
3. Purposes and legal grounds
- Enquiries and requested assessments: steps taken at your request before entering into a contract, under Article 6(1)(b) GDPR.
- Agreed services and restricted access: performance of a contract where you are a party. Information concerning other people involved is processed under the legal ground relevant to the activity and Demora’s role.
- Mandatory requirements: compliance with applicable legal obligations, under Article 6(1)(c) GDPR.
- Security and legal rights: preventing abuse, protecting access and establishing or defending legal claims, based on the legitimate interests in service security and the protection of legal rights, under Article 6(1)(f) GDPR.
The checkbox beside the notice confirms that you have read it. It is not marketing consent. The website does not automatically subscribe you to newsletters or advertising campaigns and does not perform advertising profiling.
4. What happens to a form submission
Your enquiry is recorded in Demora’s system. The site also attempts to send an email notification to the configured contact address. The record does not depend on successful email delivery. An anti-spam field, temporary token and limits based on an identifier derived from the IP address help prevent automated abuse. Those limit identifiers do not contain the IP address in plain text; the hosting provider’s technical logs may contain it.
5. People and providers with access
Authorised personnel handling your enquiry or management service can access relevant information according to their duties. Providers necessary to operate the service, including VHosting and email services, may process information. Advisers or parties involved in a case may receive information where necessary and justified, and authorities may receive it where required by law. Personal information is not published on the website or sold to third parties for advertising.
Where management is carried out on behalf of another organisation, controller and processor roles must be established in the relevant assignment. This notice does not replace the specific agreements and information applicable to that relationship.
6. External services and international transfers
Links to WhatsApp, social networks and maps open external services when you choose to follow them. Their providers’ privacy notices then also apply. The website does not automatically embed maps, tracking social widgets or advertising tools from those services.
A Gmail address is also used for communications. Google states that information may be processed on servers in different countries and describes its transfer mechanisms in its data transfer information. Where processing involves transfers outside the European Economic Area, GDPR safeguards such as adequacy decisions or standard contractual clauses apply, depending on the service and destination country.
7. Retention
Enquiries that do not lead to a service: for the time needed to respond to and close the enquiry; subsequently only where necessary for legal obligations or to establish, exercise or defend legal claims, limited to relevant records. For an ongoing relationship, relevant records are kept for the duration of the service and subsequently for applicable legal obligations or legal claims, with access limited to the remaining purposes.
Technical logs follow the hosting service’s settings and retention periods. Session and technical identifier lifetimes are described in the cookie notice. Retained backup copies must also be considered when deleting operational records. Deletion and the handling of retained copies are performed manually.
8. Security and processing methods
Information is processed electronically and, where necessary, by authorised personnel. The site uses HTTPS. Access to the management area requires authentication and is restricted by role. Private documents and databases are stored outside the publicly accessible website directory. Backups currently run manually. Access management, retention procedures and protection of retained copies also form part of handling the information securely.
9. Providing information
You can browse public pages without completing a form. Required fields are necessary to submit and handle an enquiry; optional fields can be left blank. Requirements relating to a specific management assignment are explained in the applicable contractual relationship.
10. Your rights
Where applicable under the GDPR, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Contact the privacy address above. Only information necessary to verify your identity may be requested.
You may complain to the Italian Data Protection Authority or another competent supervisory authority. The website does not make solely automated decisions producing legal effects and does not carry out advertising profiling.
11. Changes
The notice is updated when services or processing change. The date above identifies the version. The cookie notice explains browser technologies separately.