Privacy policy
Privacy Policy
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 ("Privacy Code"), as amended by Legislative Decree 101/2018.
Last updated: 17 May 2026
1. Data controller
The data controller is Rocas S.r.l., the company operating under the Toc Toc brand.
Registered office: Via dei Serragli 126R, 50124 Florence (FI), Italy
Tax code and VAT number: 07441540486
Registered with the Florence Companies Register, R.E.A. no. FI-703348
Share capital: € 20.000 fully paid up
Certified email (PEC): rocas.srl@pec.it
Email: info@toc-toc.it
Phone: +39 334 8720022
2. Who this policy applies to
This policy covers the personal data of: visitors to www.toc-toc.it; people who contact the controller through the contact form, email, phone or WhatsApp; guests and tenants who book accommodation managed under the Toc Toc brand, directly or through booking platforms; property owners who appoint the controller or contact it for that purpose.
3. Data we process
Browsing data: IP address, browser type and operating system, pages visited, date and time of access and other technical parameters collected by IT systems while the site is used.
Data you provide: first name, surname, email, phone number and the content of messages sent through the contact form, email, phone or WhatsApp.
Booking and stay data: personal details, identity document details and copy, Italian tax code, address of residence, contact details, stay dates, payment data and, for transitional leases, documents proving the temporary need for the stay (for example study or work). The same data may concern every person staying in the accommodation, all of whom must be declared to the controller.
Owner data: personal and tax details, contact details, cadastral data of the property and bank details.
The controller does not request special categories of data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR). Please do not provide them unless strictly necessary.
4. Purposes and legal bases
Answering information and quote requests. Legal basis: pre-contractual measures, Art. 6(1)(b) GDPR.
Managing bookings, online check-in, stays, lease agreements and brokerage mandates. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
Complying with legal obligations: guest registration with the Public Security Authority (Art. 109 TULPS), notice of property transfer (Art. 12 Decree-Law 59/1978), lease registration, tourist tax, tax and accounting obligations and, where applicable, anti-money laundering obligations (Legislative Decree 231/2007). Legal basis: legal obligation, Art. 6(1)(c) GDPR.
Securing the website and preventing fraud and abuse. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
Establishing, exercising or defending the controller's rights, in or out of court. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
Sending marketing and promotional communications. Legal basis: consent, Art. 6(1)(a) GDPR, which can be withdrawn at any time.
5. Whether providing data is mandatory
Providing data for contractual and legal purposes is necessary: without it, we cannot handle your request, booking or contract. Providing data for marketing purposes is optional, and refusing has no effect on the services.
6. How data is processed
Data is processed with manual and electronic tools, by authorised staff, with appropriate technical and organisational measures under Art. 32 GDPR. The controller does not carry out automated decision-making, including profiling, under Art. 22 GDPR.
7. Recipients
The controller's staff and collaborators authorised to process data.
Providers processing data on the controller's behalf, appointed as processors under Art. 28 GDPR: IT, hosting and email services, property management and channel manager software, payment service providers, cleaning and maintenance companies, accounting and tax advisers.
Parties acting as independent controllers: property owners, to the extent needed to sign and perform the contract; the platforms through which the booking was made; banks; legal advisers.
Public authorities, where required by law: police headquarters (Questura), Italian Revenue Agency, Municipality of Florence, judicial authorities.
Data is not disseminated.
8. Transfers outside the European Economic Area
Some providers and collaborators, for example for remote customer support or IT services, may process data outside the European Economic Area. In that case, data is transferred to countries covered by a European Commission adequacy decision (Art. 45 GDPR) or under the standard contractual clauses adopted by the Commission (Art. 46 GDPR). A copy of the safeguards can be requested from the controller.
9. Retention
Information requests not followed by a contract: 12 months from the last contact.
Contractual, accounting and tax data: 10 years from the end of the relationship (Art. 2220 Italian Civil Code).
Copies of identity documents: as long as needed for legal obligations and to protect the controller's rights.
Marketing data: until consent is withdrawn, and no longer than 24 months from when it was given.
Browsing data: as long as needed for technical and security purposes, unless required to investigate unlawful conduct.
If a dispute arises, the relevant data is kept until it is resolved.
10. Cookies
The site uses technical cookies needed for it to work, which do not require consent. Third-party analytics cookies and profiling cookies are set only with consent, given through the banner shown on the first visit and changeable at any time.
11. Your rights
Under Articles 15-22 GDPR you can at any time access your data, ask for it to be corrected or erased, ask for processing to be restricted, object to processing based on legitimate interest, receive your data in a structured format and transmit it to another controller (portability), and withdraw your consent, without affecting the lawfulness of processing carried out before withdrawal.
Send requests to info@toc-toc.it or rocas.srl@pec.it. The controller replies within one month of receipt, a period that may be extended in the cases set out in Art. 12 GDPR.
You also have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it).
12. Minors
Bookings are reserved for adults. The controller does not knowingly collect data from minors, except data on underage guests provided by the person with parental responsibility for legal compliance purposes.
13. Changes
The controller may update this policy. The version in force is published on this page with the date of the last update.
In case of discrepancy between the Italian and English versions, the Italian version prevails.
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 ("Privacy Code"), as amended by Legislative Decree 101/2018.
Last updated: 17 May 2026
1. Data controller
The data controller is Rocas S.r.l., the company operating under the Toc Toc brand.
Registered office: Via dei Serragli 126R, 50124 Florence (FI), Italy
Tax code and VAT number: 07441540486
Registered with the Florence Companies Register, R.E.A. no. FI-703348
Share capital: € 20.000 fully paid up
Certified email (PEC): rocas.srl@pec.it
Email: info@toc-toc.it
Phone: +39 334 8720022
2. Who this policy applies to
This policy covers the personal data of: visitors to www.toc-toc.it; people who contact the controller through the contact form, email, phone or WhatsApp; guests and tenants who book accommodation managed under the Toc Toc brand, directly or through booking platforms; property owners who appoint the controller or contact it for that purpose.
3. Data we process
Browsing data: IP address, browser type and operating system, pages visited, date and time of access and other technical parameters collected by IT systems while the site is used.
Data you provide: first name, surname, email, phone number and the content of messages sent through the contact form, email, phone or WhatsApp.
Booking and stay data: personal details, identity document details and copy, Italian tax code, address of residence, contact details, stay dates, payment data and, for transitional leases, documents proving the temporary need for the stay (for example study or work). The same data may concern every person staying in the accommodation, all of whom must be declared to the controller.
Owner data: personal and tax details, contact details, cadastral data of the property and bank details.
The controller does not request special categories of data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR). Please do not provide them unless strictly necessary.
4. Purposes and legal bases
Answering information and quote requests. Legal basis: pre-contractual measures, Art. 6(1)(b) GDPR.
Managing bookings, online check-in, stays, lease agreements and brokerage mandates. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
Complying with legal obligations: guest registration with the Public Security Authority (Art. 109 TULPS), notice of property transfer (Art. 12 Decree-Law 59/1978), lease registration, tourist tax, tax and accounting obligations and, where applicable, anti-money laundering obligations (Legislative Decree 231/2007). Legal basis: legal obligation, Art. 6(1)(c) GDPR.
Securing the website and preventing fraud and abuse. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
Establishing, exercising or defending the controller's rights, in or out of court. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
Sending marketing and promotional communications. Legal basis: consent, Art. 6(1)(a) GDPR, which can be withdrawn at any time.
5. Whether providing data is mandatory
Providing data for contractual and legal purposes is necessary: without it, we cannot handle your request, booking or contract. Providing data for marketing purposes is optional, and refusing has no effect on the services.
6. How data is processed
Data is processed with manual and electronic tools, by authorised staff, with appropriate technical and organisational measures under Art. 32 GDPR. The controller does not carry out automated decision-making, including profiling, under Art. 22 GDPR.
7. Recipients
The controller's staff and collaborators authorised to process data.
Providers processing data on the controller's behalf, appointed as processors under Art. 28 GDPR: IT, hosting and email services, property management and channel manager software, payment service providers, cleaning and maintenance companies, accounting and tax advisers.
Parties acting as independent controllers: property owners, to the extent needed to sign and perform the contract; the platforms through which the booking was made; banks; legal advisers.
Public authorities, where required by law: police headquarters (Questura), Italian Revenue Agency, Municipality of Florence, judicial authorities.
Data is not disseminated.
8. Transfers outside the European Economic Area
Some providers and collaborators, for example for remote customer support or IT services, may process data outside the European Economic Area. In that case, data is transferred to countries covered by a European Commission adequacy decision (Art. 45 GDPR) or under the standard contractual clauses adopted by the Commission (Art. 46 GDPR). A copy of the safeguards can be requested from the controller.
9. Retention
Information requests not followed by a contract: 12 months from the last contact.
Contractual, accounting and tax data: 10 years from the end of the relationship (Art. 2220 Italian Civil Code).
Copies of identity documents: as long as needed for legal obligations and to protect the controller's rights.
Marketing data: until consent is withdrawn, and no longer than 24 months from when it was given.
Browsing data: as long as needed for technical and security purposes, unless required to investigate unlawful conduct.
If a dispute arises, the relevant data is kept until it is resolved.
10. Cookies
The site uses technical cookies needed for it to work, which do not require consent. Third-party analytics cookies and profiling cookies are set only with consent, given through the banner shown on the first visit and changeable at any time.
11. Your rights
Under Articles 15-22 GDPR you can at any time access your data, ask for it to be corrected or erased, ask for processing to be restricted, object to processing based on legitimate interest, receive your data in a structured format and transmit it to another controller (portability), and withdraw your consent, without affecting the lawfulness of processing carried out before withdrawal.
Send requests to info@toc-toc.it or rocas.srl@pec.it. The controller replies within one month of receipt, a period that may be extended in the cases set out in Art. 12 GDPR.
You also have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it).
12. Minors
Bookings are reserved for adults. The controller does not knowingly collect data from minors, except data on underage guests provided by the person with parental responsibility for legal compliance purposes.
13. Changes
The controller may update this policy. The version in force is published on this page with the date of the last update.
In case of discrepancy between the Italian and English versions, the Italian version prevails.