FattoreGuest data privacy: what to do (and not do) with documents
Updated 12 October 2026
Applies in Italy: the rules in this article are for agriturismi, B&Bs, campsites and other holiday accommodation in Italy.
In short. In a 2026 note, Italy's data protection authority (Garante) clarified that accommodation providers must not keep copies of guests' documents, on paper or digital, beyond what's needed to send to the police. Copies must be deleted right after sending. The only thing to keep, for five years, is the portal receipt.
Photographing the document, sending it to yourself on WhatsApp, keeping the "guest documents 2024" folder on the computer: handy, common practices. And, says the Garante, wrong. Let's see the right way, which is also simpler.
What the Garante says
The Garante's note restates a GDPR principle: collect only the data you need, and keep it only as long as necessary. For guests, the document data is needed to report to the police through Alloggiati Web. Once sent, the document copy is no longer needed.
What you can do
- Collect the guest's identifying data (the ones needed for Alloggiati Web).
- Verify the document in person or by live remote identification, as required for check-in.
- Send the data to the police through the portal.
What you must not do
- Keep copies or photos of documents beyond sending to the police.
- Ask for documents via WhatsApp or other messaging apps.
- Keep document archives "just in case".
What to keep, and for how long
| What | How long |
|---|---|
| Copy or photo of the document | delete right after sending to the police |
| Alloggiati Web receipt | five years, as proof of sending |
Two more things to sort, beyond deleting
- The guest privacy notice, updated.
- The processing register and some written rules for whoever does check-in.
Where does Fattore come in?
With Fattore's online check-in you collect the data needed for the registrations without having document photos sent on WhatsApp. The data takes the right route: from the booking to the Alloggiati Web registrations, with the receipt to keep. See the modules.
Frequently asked questions
Can I keep the document copy "just to be safe"?
No. Per the Garante it must be deleted right after sending to the police. The only thing to keep is the portal receipt.
What if the guest sends it to me on WhatsApp?
Better avoid: the Garante advises not to use messaging apps for documents. A proper online check-in solves it upstream.
What do I risk if I keep archives?
They're breaches that can fall under the GDPR, with significant fines. Simpler, and safer, not to keep what you don't need.
Want to collect data the right way? Try the live demo: a sample agriturismo with real-looking data, so you can click through rooms, bills and guest registrations without signing up. Prefer a guided tour? Book a 30-minute call.
This is a practical guide and doesn't replace advice from a privacy consultant.
Sources
Want to see it in action?
Fattore takes care of the ordinary. You take care of the extraordinary.