pursuant to Articles 13 and 14 of EU Regulation No. 679/2016 - GDPR

Dear Customer and Dear Guests,
in accordance with the legislation in force on the protection of personal data, we wish to inform the data subject that personal data are processed by the Controller fairly and transparently, for lawful purposes and in a manner that protects the confidentiality, fundamental freedoms and rights of the data subject.

1. Source of the data and processing methods

Personal data may be collected directly from the data subject or may reach us from third parties. Specifically, personal data may be transmitted to us by OTAs (Online Travel Agencies) solely where the data subject chooses to use such platforms to make a booking. By way of example, data may be transmitted to us by portals such as Booking.com, Expedia, Trip.com, Hotels.com, Agoda, Lastminute.com, Reserving, HRS, etc.

In the case of a booking made through the dedicated online platform provided by the Controller, the data may reach us through the provider of that platform.

Processing is also carried out with the aid of electronic means.

2. Categories of data processed and Purposes

The personal data processed include the following categories for the purposes indicated below.

• A) Contractual and booking purposes:
  • Categories of Customer data: personal details (first name and surname), residential address, contact details (e-mail address, telephone number), data relating to the stay (arrival/departure dates, preferences communicated), payment data (credit card details as a guarantee or for settlement).
  • Legal basis: processing is necessary for the performance of a contract or of pre-contractual measures requested by the data subject (Art. 6(1)(b) GDPR).
  • Nature of the provision of data: mandatory and necessary to confirm the booking and manage the contractual relationship.
• B) Public Security obligations relating to Guests (Alloggiati Web portal):
  • Categories of Guest data: first name, surname, place and date of birth, sex, citizenship, identity document details (type, number, place of issue), residential address.
  • Legal basis: processing is necessary for compliance with a legal obligation (Art. 109 Royal Decree 773/1931; Art. 6(1)(c) GDPR).
  • Nature of the provision of data: mandatory by law; refusal precludes staying at the property.
• C) Administrative, accounting and tax obligations:
  • Categories of Customer data: billing data (first name and surname, address, tax code/VAT number), data relating to financial transactions carried out with the Controller in connection with the contract.
  • Legal basis: processing is necessary for compliance with legal obligations of an administrative, accounting and tax nature (Art. 6(1)(c) GDPR).
  • Nature of the provision of data: mandatory by law; refusal precludes staying at the property.

In the event of further processing or further processing purposes, specific additional information will be provided.

3. Categories of data recipients

Personal data will not be disclosed to the public, but may be communicated to the following categories of recipients, appointed as external data processors where necessary:

• Public Security Authorities (Police Headquarters – Questura);
• Consultants and freelance professionals (e.g. accountant for bookkeeping, relevant consultants for handling specific matters relating to the contract, etc.);
• Technical and IT service providers, including providers and operators of management software, of the booking management platform and of cloud storage services, etc.;
• Providers of document management and e-mail services and suppliers of systems for managing the latter (“in client”);
• Banks and providers of electronic payment applications, for the management of collections and payments.

The Controller remains available to provide, at the Data Subject’s request, further detailed information on the individual recipients to whom the data will actually be communicated.

4. Transfer of data to third countries and decision-making processes

• The Controller does not intend to transfer data to countries outside the scope of application of the GDPR. However, should it be necessary to transfer data to servers located in third countries in order to carry out the activities described above, such transfer will take place fully lawfully in accordance with the requirements of Chapter V of the GDPR (adequacy decisions, standard contractual clauses, binding corporate rules, measures of the competent authorities or specific derogations in accordance with the law).
• No automated decision-making process, including profiling as referred to in Art. 22 of the GDPR, is used.

5. Data retention periods

• Personal and contact data, contractual data and data for accounting purposes: retained for 10 years from the end of the relationship (Art. 2220 of the Italian Civil Code for the retention period of accounting records; Art. 2946 of the Italian Civil Code for the ordinary limitation period).
• Guest data: data acquired solely for communication to the Police Headquarters (Questura) are not retained by the Controller beyond the duration of the rental/stay.

6. Rights of the data subject

The data subject may exercise the rights provided for by EU Regulation 2016/679:

• Access (Art. 15): to find out which personal data we are processing.
• Rectification (Art. 16): to obtain the correction of any inaccurate data.
• Erasure / Right to be forgotten (Art. 17): to request the removal of data no longer necessary for the purposes of the processing.
• Restriction (Art. 18): to obtain from the Controller the restriction of processing in the cases specifically indicated by that article.
• Portability (Art. 20): to receive the personal data provided to the Controller in a structured, commonly used and machine-readable format and to transmit them to another controller without hindrance.
• Objection (Art. 21): to obtain the cessation of processing based on the legal grounds under Art. 6(1)(e) and (f) of the Regulation, on legitimate grounds relating to the data subject’s particular situation.
• Complaint (Art. 77): the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali – www.garanteprivacy.it).
• Judicial remedy (Art. 79): the right to bring proceedings before the judicial authority where the data subject considers that their rights have been infringed in the course of processing.

7. Data Controller

To enable the data subject to exercise their rights and for any other matter, the following contact details are provided.

• Data Controller: Nuovo Albergo Touring Srl, Viale Darfo Dallai n. 1 - 41012 - Carpi (MO), Tax Code and VAT No. 01989040363.
• Privacy contact: Dott. Marco Malavasi.
• E-mail: info@hoteltouringcarpi.it.