Exho Management Srls, as Data Controller (hereinafter, "Data Controller" or "Guest House") for Tenuta dell'Inviolata, hereby provides you, pursuant to and for the purposes of EU Regulation No. 2016/679 (hereinafter, "GDPR"), with information regarding the processing of personal data collected during the activities of booking rooms and purchasing its products and services.
1. Personal data and source of the data
As part of the activities of booking rooms and purchasing guest house products and services, the Data Controller processes personal data and contact details (e.g., name, surname, e-mail address, mobile phone number, nationality, etc.) relating to future guests, payment and credit card details, as well as any other information indicated in the “Notes” field. All this information is provided directly by the person making the booking.
With reference to the “Notes” field, the Data Controller invites you not to provide particular categories of data such as data relating to your state of health (information on any motor disabilities, allergies, intolerances, etc.), religious beliefs, sexual orientation, political and philosophical opinions.
2. Purpose, legal basis of the processing and nature of the provision of data
As part of the activities of booking rooms and purchasing Guest House products and services, your data will be processed for the following purposes:
a) Managing the booking and the reservation of ancillary services and products, as well as responding to any requests.
The legal basis of the processing is the performance of contractual obligations pursuant to Article 6(1)(b) of the GDPR.
The provision of personal data is necessary; therefore, the omission of the personal data requested makes it impossible to conclude and execute the room booking and the purchase of services and ancillary products.
b) Fulfilment of regulatory obligations to which the Data Controller is subject, including but not limited to tax obligations related to the execution of the contract, other administrative/accounting obligations and obligations related to the legislation on online payments.
The legal basis of the processing is the fulfilment of regulatory obligations pursuant to Article 6(1)(c) of the GDPR.
The provision of personal data is necessary; therefore, the omission of the personal data requested makes it impossible to conclude and execute the room booking and the purchase of services and ancillary products.
c) Defence of the Data Controller's rights in judicial and extrajudicial proceedings.
The legal basis for the processing of the data is the pursuit of the legitimate interest consisting in the protection of the interests and rights of the Hotel pursuant to Article 6(1)(f) GDPR.
The provision of personal data is necessary; therefore, the omission of the personal data requested makes it impossible to conclude and execute the room booking and the purchase of services and ancillary products. However, you may request to object at any time, by sending a motivated request to the Data Controller, to the processing of personal data carried out on the basis of legitimate interest, pursuant to and for the purposes of Article 21 GDPR; your request, in this sense, will be subject to evaluation and response by the Data Controller.
3. Recipients of the data
The data may be communicated for the pursuit of the aforementioned purposes to other entities such as, for example, public authorities and law enforcement agencies, law firms, accountants, etc., who will process the data as independent data controllers for their own purposes. The following subjects may also have access to the data:
• the staff of the Data Controller, who are expressly authorised to process them, in accordance with the instructions given, pursuant to Articles 29 and 32(4) of the GDPR and 2-quaterdecies of Legislative Decree no. 196/2003;
• service providers in favour of the Data Controller, appointed as Data Processors, including but not limited to booking system providers, IT providers, etc. The updated list of Data Processors may be requested to the Data Controller.
Personal data are not disseminated.
4. Data retention periods
The processed data are kept only for the time strictly necessary to carry out the activities/purposes described above and, in particular, for the time required by the tax law (10 years) or for the period of prescription of possible legal actions.
5. Extra-EEA Data transfer
The data are stored and processed within the European Economic Area. With regard to the possible transfer of data to Third Countries outside the European Economic Area, the Data Controller informs you that the transfer will be carried out according to one of the modalities set out in Articles 44 et seq. of the GDPR, such as, for example, the adoption of Standard Clauses approved by the European Commission, the selection of subjects participating in international programmes for the free movement of data or operating in countries considered safe by the European Commission, in compliance with Recommendations 01/2020 adopted on 10 November 2020 by the European Data Protection Committee. Alternatively, transfers may be necessary on the basis of one of the exceptions set out in Article 49 of the GDPR, for example with the informed consent of the data subject or to perform a contract concluded between the data subject and the Data Controller or pre-contractual measures taken at the request of the data subject, or a contract concluded between the Data Controller and another natural or legal person for the benefit of the data subject, or for important reasons of public interest or to establish, exercise or defend a right in court or, again, to protect the vital interests of the data subject or of other persons where the data subject is physically or legally incapable of giving consent. Further information on possible transfers and the related safeguards implemented can be obtained, upon request, from the Data Controller.
6. Data subject’s rights
Data subjects may assert their rights and/or request information on the processing of their data by contacting the Data Controller. The GDPR grants the right to:
a) withdraw the consent given, with the understanding that withdrawal of consent shall not affect the lawfulness of the processing based on the consent prior to the withdrawal;
b) access or obtain a copy of the personal data as well as to know the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organisations; where possible, the period for which the personal data are to be stored or, if this is not possible, the criteria used to determine that period; the existence of the data subject’s right to request from the data controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning him or her or to object to their processing; the right to lodge a complaint with a supervisory authority; where the data are not collected from the data subject, all available information on their source; the existence of an exclusively automated decision-making process, including profiling, and, at least in such cases, meaningful information on the logic used, as well as the importance and the envisaged consequences of such processing for the data subject;
c) rectification and integration of inaccurate or outdated data;
d) erasure, whenever the data are no longer necessary in relation to the purposes pursued, or if the data subject decides to withdraw consent or objects to the processing and there are no other legal grounds for keeping the data, or if the data are processed unlawfully, or have to be erased because of a legal obligation;
e) restriction of processing if the data subject contests the accuracy of the personal data, for the period necessary for the controller to verify the accuracy of the personal data; if the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead that their use be restricted; even though the controller no longer needs them for the purposes of the processing, if the personal data are necessary for the establishment, exercise or defence of legal claims; if the data subject has objected to the processing, pending verification as to whether or not the legitimate reasons of the controller prevail over those of the data subject.
In cases of exercise of the rights referred to in points c), d), and e), the data subject has the right to know the recipients to whom the personal data have been transmitted and the right that the Controller communicates to them the rectification, erasure or restriction of the processing, unless this proves impossible or involves a disproportionate effort.
f) data portability, i.e. to receive in a structured, commonly used and machine-readable format the personal data concerning him/her, including the direct transfer of the same by the Controller to other Controllers, where the processing is carried out by automated means and is based on consent or contract;
g) object to the processing where the processing is based on the legitimate interest of the Controller, as already specified in point 2 above;
h) lodge a complaint to the competent Supervisory Authority (for Italy, the Garante per la protezione dei dati personali, https://www.garanteprivacy.it).
7. Contact details
For any request to verify, modify or delete your personal data you can write to [email protected]
Informative note as per Art. 13 Law Decree No. 2016/679
As Law Decree No. 2016/679 (the "Personal Data Privacy Law"), La Tenuta dell’Inviolata, Via Di Cori 8 - 00049 Velletri (RM), intends to process the personal data that you have provided exclusively for the fulfilment of the obligations prescribed by contract or law that govern the business relationship between us. For this reason, we will not process confidential data or data of judicial pertinence. As per Art. 13 of the above-mentioned law, we are obliged to inform you of the following:
Data acquisition.
Your data can be collected through:
• websites managed by us, through which it is possible to access this Privacy Policy (collectively referred to as the "Websites");
• the software applications we provide for use on PCs and mobile devices (the "Apps");
• the social pages controlled by us, through which it is possible to access this Privacy Policy (collectively called our "Social pages");
• HTML e-mail messages sent by us containing the link to this Privacy Policy and those we received;
• your visit or stay in one of our facilities or other type of offline interaction. Collectively, reference is made to websites, apps and our social pages with the name "online services" and "services" if you include offline channels. The use of the aforementioned Services implies acceptance by you of the terms and conditions set forth in this Privacy Policy.
Purpose of data processing
The data that you place at our disposal will be processed in the context of our company's daily operations and in particular for the fulfilment of the obligations imposed by contract or law (e.g. compliance with administrative, fiscal and accounting, etc. requirements) and for market research and direct marketing.
Method of treatment.
As regards the method of treatment given, we inform you that your data will be entered in special identification archives in both paper and computerised form with adequate security measures taken for the protection of the privacy in accordance with the regulations in force. Your personal data will be processed by the appropriate data processing and filing software.
Obligatory or optional data entry
We inform you that your consent is not required (as per Art. 23 and respective amendments of the above-mentioned law) whenever our company requires the data in question for the fulfilment of obligations prescribed by contract or law, whenever such data can be taken from public registers, lists, deeds or documents that are part of public domain and can be freely accessed by anyone and whenever such data is processed for the defence of rights in Court of Law. In any case however, all such data can be processed but not disclosed.
Consequences of refusal to grant consent.
Your refusal to consent to our processing of data we consider fundamental as per Point a) above (such as names, registered office, headquarters, branch offices, capital stock, telephone numbers, fax numbers, name of legal representative, V.A.T. and income tax registration numbers, corporate purpose and banking co-ordinates, etc.) may prevent us from establishing or continuing a contractually-regulated business relationship with you.
Parties to whom your data may be communicated.
Your personal data may be communicated to the parties in the following categories:
- Parties granted rights to data access by law;
- payment and payment collection management credit institutes, insurance companies, and auditors;
- credit recovery companies;
- data processing and information technology companies;
- correspondence service companies;
- consociate, subsidiary or parent companies.
Parties that may gain awareness of your data in the execution of their duties
Your personal data will be processed by parties in the following categories:
- company management, in their role as the parties in charge of such processing;
- headquarter operatives, in their role as the parties in charge of such processing;
- hotel management operatives, in their role as the parties in charge of such processing;
- reception, administration and accounting operatives of the structure La Tenuta dell’Inviolata, Via Di Cori 8 - 00049 Velletri (RM).
Such data will never be distributed without your previous written consent.
Rights as per Art. 7 of Law Decree 2016/679
Lastly, in regard to the above, we inform you of your rights as per Art. 7 of the above-mentioned law and precisely what you may be entitled to receive at our expense:
a) the indication of the origin of the data, the purposes and methods of processing, the identification of the owner of the processing and the managers in charge of processing, and the categories of party to whom such data can be communicated or those who may come to the awareness of such data in the performance of their duties as parties assigned to data processing;
b) the confirmation of the existence of the personal data that regards you and the logic applied to any computerised processing performed;
c) the cancellation and transformation in anonymous form of any data processed in violation of the above-mentioned law;
d) the updating, correction and completion - if you desire - of such personal data;
e) the certification that the operations mentioned in Points c) and d) were brought to the attention of those to whom such data has been communicated or distributed with the exception of the cases prescribed by law;
f) the right to oppose on legitimate grounds the processing of your personal data, even when such processing is performed for appropriate purposes;
g) the right to oppose, in any case, the processing of your personal data for the purpose of transmission of direct sales or advertising material or commercial communication or market research.
Parties assigned to processing
The owner of the processing performed is La Tenuta dell’Inviolata, Via Di Cori 8 - 00049 Velletri (RM).
In order to obtain all data processing manager, send an e-mail to the following address: [email protected]
Regulations references
The complete text of the GDPR can be consulted by accessing the following website:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
