Privacy Policy
The personal data of the user is processed by HOTEL LA SPIAGGIA S.A.S. di Poggi Maria & c., which is the data controller, in compliance with the personal data protection principles established by GDPR Regulation 2016/679 and current national legislation.
SOURCE OF PERSONAL DATA
Personal data is collected by recording the data gathered directly from the data subject, at the time of initial contact or subsequent communications.
METHODS AND PURPOSES OF DATA PROCESSING
1. We inform you that the processing of your personal data will comply with the provisions set out by the GDPR, using paper-based, computerized, and telematic tools, with logic strictly related to the stated purposes, and with methods suitable for ensuring security and confidentiality in accordance with the provisions of Article 32 of the GDPR.
Purposes of processing:
Fulfilling pre-contractual and contractual obligations arising from the performance of the service you requested
Ensuring the services requested by the user
Managing the guest's name for room assignment and booking purposes
Fulfilling contractual and tax obligations arising from ongoing relationships with the data subject
Managing the stay, communicating data to the police authority (Questura), and for statistical purposes (ISTAT)
Filling out guest registration forms
Collecting the tourist tax
Issuing invoices
Fulfilling obligations required by law and/or EU regulations
Managing any complaints/disputes
Sending communications by email or SMS, upon the customer's request
Allowing the administrative/accounting management of the company
Prevention of COVID-19 contagion: real-time temperature measurement
In particular, for the purposes specified below, the user's data will be processed ONLY upon specific consent given:
Consent to the processing of special categories of data (collection of health-related data regarding dietary habits, allergies, and intolerances)
Signature Signature
accept
do not accept
Page 2 / 3
LEGAL BASIS
2. The legal bases on which the processing of ordinary data is founded, pursuant to Art. 6 of the GDPR, are:
Contract;
Legal obligation;
The legal basis on which the processing of special categories of personal data is founded, pursuant to Art. 9 of the GDPR, is:
Consent;
The company processes users' optional data on the basis of consent, meaning through explicit approval of this privacy policy and in relation to the methods and purposes described.
The legal bases on which the processing of ordinary data is founded, pursuant to Art. 6 of the GDPR, and on which the processing of special categories of personal data is founded, pursuant to Art. 9 of the GDPR (Prevention of COVID-19 contagion: real-time temperature measurement), are:
Implementation of anti-contagion safety protocols pursuant to the Prime Ministerial Decree (DPCM) of 17 May 2020;
Public interest
CATEGORIES OF RECIPIENTS
3. Without prejudice to communications made in fulfillment of legal and contractual obligations, all data collected and processed may be disclosed exclusively for the purposes specified above to the following categories of recipients:
Supervisory and control authorities;
Banks and credit institutions;
Insurance companies;
Police forces;
Law firms;
Judicial offices;
In managing your data, the following categories of authorized persons and/or external data processors* — appointed in writing and given specific written instructions regarding data processing — may also become aware of it:
Personnel authorized/appointed by the Data Controller
Personnel authorized/appointed by external Data Processors:
- Accountant; Provision, maintenance, and support of management software;
*The list of appointed data processors is available at our offices
RETENTION PERIOD
Customer management: Data will be processed for the entire time necessary to carry out the ongoing business relationship and in accordance with the retention periods required by law.
Real-time body temperature detection - Regulatory Protocol on measures to combat and contain the spread of the COVID-19 virus in workplaces: Data will be retained until the end of the state of emergency.
Page 3 / 3
RIGHTS OF THE DATA SUBJECT
4. Pursuant to EU Regulation 679/2016 (GDPR) and current national legislation, the data subject may, in accordance with the methods and within the limits set forth by current legislation, exercise the following rights:
request confirmation of the existence of personal data concerning them (right of access of the data subject – Art. 15 of Regulation 679/2016);
know its origin;
receive an intelligible communication of it;
obtain information about the logic, methods, and purposes of the processing;
request its updating, rectification, integration, erasure, transformation into anonymous form, or blocking of data processed in violation of the law, including data no longer necessary for the purposes for which it was collected (right to rectification and erasure – Arts. 16 and 17 of Regulation 679/2016);
right to restriction and/or objection to the processing of data concerning them (Art. 18 of Regulation 679/2016);
right to withdraw consent;
right to data portability (Art. 20 of Regulation 679/2016);
in cases of processing based on consent, receive their own data provided to the controller, in a structured, commonly used, and machine-readable format;
the right to lodge a complaint with the Supervisory Authority (right of access of the data subject – Art. 15 of Regulation 679/2016).
The Data Controller for your personal data is HOTEL LA SPIAGGIA S.A.S. di Poggi Maria & c., VAT No. 01472210119, Tax ID 01472210119, with registered office at Via Fegina, 98 – 19016 Monterosso al Mare (SP)
Email: [email protected]
PEC (certified email): [email protected]
Phone: 0187 817567
