L’Aldiola srl, as Data Controller (hereinafter, “ Data Controller” or “Hotel”), hereby provides you, pursuant to and for the purposes of EU Regulation No. 2016/679 (hereinafter, “GDPR”), with information regarding the processing of personal data collected during the activities of booking rooms and purchasing its products and services.
As part of the activities of booking rooms and purchasing hotel products and services, the Data Controller processes personal data and contact details (e.g., name, surname, e-mail address, mobile phone number, nationality, etc.) relating to future guests, payment and credit card details, as well as any other information indicated in the “Notes” field. All this information is provided directly by the person making the booking.
With reference to the “Notes” field, the Data Controller invites you not to provide particular categories of data such as data relating to your state of health (information on any motor disabilities, allergies, intolerances, etc.), religious beliefs, sexual orientation, political and philosophical opinions.
As part of the activities of booking rooms and purchasing hotel products and services, your data will be processed for the following purposes:
The legal basis of the processing is the performance of contractual obligations pursuant to Article 6(1)(b) of the GDPR.
The provision of personal data is necessary; therefore, the omission of the personal data requested makes it impossible to conclude and execute the room booking and the purchase of services and ancillary products.
The legal basis of the processing is the fulfilment of regulatory obligations pursuant to Article 6(1)(c) of the GDPR.
The provision of personal data is necessary; therefore, the omission of the personal data requested makes it impossible to conclude and execute the room booking and the purchase of services and ancillary products.
The legal basis for the processing of the data is the pursuit of the legitimate interest consisting in the protection of the interests and rights of the Hotel pursuant to Article 6(1)(f) GDPR.
The provision of personal data is necessary; therefore, the omission of the personal data requested makes it impossible to conclude and execute the room booking and the purchase of services and ancillary products. However, you may request to object at any time, by sending a motivated request to the Data Controller, to the processing of personal data carried out on the basis of legitimate interest, pursuant to and for the purposes of Article 21 GDPR; your request, in this sense, will be subject to evaluation and response by the Data Controller.
The data may be communicated for the pursuit of the aforementioned purposes to other entities such as, for example, public authorities and law enforcement agencies, law firms, accountants, etc., who will process the data as independent data controllers for their own purposes. The following subjects may also have access to the data:
Personal data are not disseminated.
The processed data are kept only for the time strictly necessary to carry out the activities/purposes described above and, in particular, for the time required by the tax law (10 years) or for the period of prescription of possible legal actions.
The data are stored and processed within the European Economic Area. With regard to the possible transfer of data to Third Countries outside the European Economic Area, the Data Controller informs you that the transfer will be carried out according to one of the modalities set out in Articles 44 et seq. of the GDPR, such as, for example, the adoption of Standard Clauses approved by the European Commission, the selection of subjects participating in international programmes for the free movement of data or operating in countries considered safe by the European Commission, in compliance with Recommendations 01/2020 adopted on 10 November 2020 by the European Data Protection Committee. Alternatively, transfers may be necessary on the basis of one of the exceptions set out in Article 49 of the GDPR, for example with the informed consent of the data subject or to perform a contract concluded between the data subject and the Data Controller or pre-contractual measures taken at the request of the data subject, or a contract concluded between the Data Controller and another natural or legal person for the benefit of the data subject, or for important reasons of public interest or to establish, exercise or defend a right in court or, again, to protect the vital interests of the data subject or of other persons where the data subject is physically or legally incapable of giving consent. Further information on possible transfers and the related safeguards implemented can be obtained, upon request, from the Data Controller.
Data subjects may assert their rights and/or request information on the processing of their data by contacting the Data Controller. The GDPR grants the right to:
In cases of exercise of the rights referred to in points c), d), and e), the data subject has the right to know the recipients to whom the personal data have been transmitted and the right that the Controller communicates to them the rectification, erasure or restriction of the processing, unless this proves impossible or involves a disproportionate effort.
The contact details of the Data Controller and the Data Protection Officer, where appointed, are available in the privacy policy accessible from the footer of the Hotel website.