CUSTOMER PRIVACY NOTICE
Version 1.1 dated 4 April 2019
Pursuant to Articles 13 and 14 of EU Regulation No. 2016/679 (hereinafter “GDPR”), concerning the protection of personal data and their free movement, RESIDENZA LA COLLINA SRLS, as Data Controller, is required to provide you with all information concerning the purposes and methods of processing your personal data, the indication of the parties to whom your data may be disclosed, and all the rights granted to you by law in relation to the management of personal data by the Data Controller.
You are therefore invited to take note of the information contained herein and to give your consent to the processing by signing this privacy notice.
1. Who determines the purposes and methods of processing?
The Data Controller
The Data Controller of personal data is RESIDENZA LA COLLINA SRLS, with registered office in Alghero, VIA LOGUDORO 3/A, 07041, VAT No. 02981690908.
2. What personal data are processed by the Data Controller?
The Data Controller will collect and process your personal data, meaning any information that may identify you and that is directly or indirectly attributable to you, including, by way of example:
1. Personal identification data;
2. Special categories of data;
3. Data relating to your stay;
4. Personal preferences;
5. Identification documents;
6. Handwritten signature;
7. Purchase history;
8. Credit card and/or banking data;
9. Video surveillance images;
10. Data relating to electronic devices used to connect to the property’s network;
11. Data relating to telephone calls;
12. Data relating to access to and use of ICT resources;
and any other data necessary to achieve the purposes referred to in paragraph 4.
Special categories of data will also be processed, such as:
• Data relating to health conditions.
3. How are personal data collected?
Personal data are provided directly by the data subject to the Data Controller or collected through other parties, such as:
• OTAs (Online Travel Agencies), such as Booking.com, Venere.com, Worldhotels.com, Trivago.com, Expedia.com, etc.;
• Traditional travel agencies;
• Institutions, associations, organisations, companies or private individuals organising events or stays at the property.
4. Why do you collect my data?
Purposes of processing
The personal data collected by the Data Controller will be processed for the following purposes:
a. Customer management;
b. Signing and management of contracts;
c. Administrative management;
d. Management of disputes;
e. Customer care;
f. Public relations;
g. Promotion, marketing and advertising;
h. Protection of people's physical health;
i. Internal security;
j. Protecting and ensuring the safety and physical integrity of persons;
k. Protecting the integrity of the property and company assets;
l. Enabling the use of and ensuring the security of the ICT infrastructure.
Legal basis for processing
The processing of data will be carried out in strict compliance with legal requirements, according to the principles of lawfulness and fairness and with respect for the right to privacy.
The processing of data will be based on:
• Consent;
• Pre-contractual and contractual obligations;
• Legal obligations;
• Legitimate interest of the Data Controller.
5. How will the collected data be processed?
Methods of processing
Processing will be carried out by automated and manual means, in compliance with Article 32 of GDPR 2016/679 and, in particular:
a. Through operations allowing the collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, use, disclosure, deletion and destruction of data.
b. Through the use of electronic or otherwise automated tools enabling the storage, management and transmission of data, always configured so as to guarantee maximum confidentiality and the necessary protection.
c. Through documents stored on paper, with appropriate security measures to prevent access by unauthorised persons.
6. Why should I provide my data to the Data Controller? Can I refuse?
Nature of the provision of data and refusal to provide them
Where the provision of personal data is necessary for the performance of a contract or compliance with a legal obligation, processing is indispensable. In the event of refusal to process the data covered by this privacy notice, the Data Controller will not be able to carry out the activities referred to in paragraph 4 and, in general, will not be able to fulfil the obligations undertaken.
7. Who will have access to my data?
Disclosure of data
Personal data may be transferred to and processed by other parties, acting as authorised persons, data processors or independent data controllers, in order to comply with pre-contractual, contractual or legal obligations, or on the basis of a legitimate interest.
The categories of recipients may include, by way of example:
• Authorised personnel;
• Data Processors;
• System administrators;
• Accounting consultants;
• Legal consultants;
• Banks;
• Insurance companies;
• Auditing companies;
• Companies providing services for the maintenance of the property’s accommodation infrastructure;
• Companies providing Internet and email services;
• Institutions, associations, organisations, companies or private individuals organising events or stays at the property;
• Public authorities;
• Police forces.
The data provided and collected by the Data Controller are not subject to public dissemination or profiling.
8. Could my data be transferred abroad?
Personal data may be transferred to countries within the European Union or to countries outside the European Union, or to an international organisation, where this is necessary to achieve the purposes referred to in paragraph 4 and to fulfil the obligations undertaken.
As of the date of this notice, the countries to which your data are transferred are:
• Other EU countries besides Italy;
• United Kingdom;
• Ireland;
• Switzerland;
• USA.
9. How long will my data be retained?
Personal data will be retained for the time strictly necessary to carry out the activities connected with the purposes described in this privacy notice.
In particular, retention periods will be:
• 10 years (as required by civil law obligations – Article 2220 of the Italian Civil Code);
• Maximum 3 months from the check-out date for credit card data;
• Maximum 3 years from the last check-out for personal data, special categories of data, stay-related data, personal preferences, identification documents, handwritten signature, purchase history and marketing data (points 2.1 to 2.7), unless otherwise indicated by the data subject;
• Maximum 5 days for video surveillance images;
• 90 days from check-out for telephone traffic data.
In all cases, longer retention periods may apply where provided for by specific sector regulations.
In the event of disputes, personal data will be retained until the expiry of the limitation period established by law for the protection of rights connected with the contractual relationship.
10. How can I take action to limit, prevent or object to the processing of my data by the Data Controller?
Rights of the data subject
By means of a written communication sent by certified email (PEC) or registered letter with return receipt to the address of the Data Controller, you have the following rights:
Right of access to data (Article 15 GDPR)
To obtain from the Data Controller confirmation as to whether or not personal data concerning you are being processed and, where this is the case, to obtain access to the personal data and to certain information specifically indicated in Article 15 of the GDPR.
Right to rectification (Article 16 GDPR)
To obtain from the Data Controller, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.
Right to erasure (Article 17 GDPR)
To obtain from the Data Controller the erasure of personal data concerning you without undue delay, and the Data Controller is obliged to erase your personal data without undue delay, unless there are reasons preventing the exercise of this right.
Right to restriction of processing (Article 18 GDPR)
If the processing is based on consent or a contract and is carried out by automated means, you have the right to receive, in a structured, commonly used and machine-readable format, the personal data that you have provided to the Data Controller, and you have the right to transmit such data to another Data Controller or have them transmitted directly by the Data Controller, where technically feasible.
Right to object (Article 21 GDPR)
To object at any time, on grounds relating to your particular situation, to the processing of personal data based on the legitimate interest of the Data Controller or on your consent, including profiling, unless the Data Controller demonstrates compelling legitimate grounds for the processing which override your rights.
Right not to be subject to automated decision-making, including profiling (Article 22 GDPR)
Not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.
As stated in paragraph 7, the Data Controller does not use automated decision-making processes.
Right to lodge a complaint with the supervisory authority (Article 77 GDPR)
Without prejudice to any other administrative or judicial remedy, if you believe that the processing of your personal data violates this Regulation, you may lodge a complaint with the supervisory authority and, more generally, exercise all rights granted to you by applicable law.
11. How long will it take to receive a response from the Data Controller?
In the event that you request information concerning your data, the Data Controller will respond as soon as possible, unless this proves impossible or involves a disproportionate effort, and in any event no later than 30 days from the request.
Any inability or delay on the part of the Data Controller in fulfilling the requests will be justified.
12. Commencement and effectiveness
This privacy notice shall also apply to positions opened before 25 May 2018.
The undersigned, having been identified, declares that they have received complete information pursuant to Articles 13 and 14 of EU Regulation 2016/679 and have fully understood its contents.
For acknowledgement of receipt of the privacy notice
Version 1.1 dated 4 April 2019
Name and surname: __________________________
DECLARATIONS OF CONSENT TO PROCESSING
☐ I AUTHORISE ☐ I DO NOT AUTHORISE
the Data Controller to process the special categories of data referred to in Article 9 of EU Regulation 679/2016, in order to provide an optimal level of hospitality and for the protection of my physical health;
☐ I AUTHORISE ☐ I DO NOT AUTHORISE
the Data Controller to communicate data relating to my stay, solely for the purpose of enabling the receipt of any messages and telephone calls addressed to me.
☐ I AUTHORISE ☐ I DO NOT AUTHORISE
the Data Controller to send promotional communications to my contact details.
Alghero, __________________________
Signature: __________________________
