Privacy policy
PRIVACY POLICY
INFORMATION* ON THE PROCESSING OF PERSONAL DATA in
accordance with Articles 13/14 EU Regulation 2016/679 “General Data Protection
Regulation”
Dear guest,
the company I Girasoli SAS di Vincenzo Leardini. (VAT no.: 02346590405) with
registered office in Via
Cà Rastelli 13, 47843 Misano Adriatico (RN) ITALY, head of the group of the same name, as
Data Controller, wishes to provide to you information on the use of your
personal data that you provided and/or is referable to you at the point of
booking and stay at the hotel premises of the group.
Pursuant to Articles 13/14 EU Regulation 2016/679, the data controller company
wishes to inform you that it will handle personal data provided by you or
referable to you in accordance with the provisions set out by the law.
The regulation states that the processing of your personal data (personal
details, place of residence, contact details, email, mobile, data relating to
preferences, information relating to the booking, to your stay, navigation data
etc.) will be characterised by principles of accuracy, permissibility,
transparency and privacy protection.
1) Purposes – booking and stay
Personal data provided by you or referable to you at the point of booking
and/or stay will be processed in order to assign hotel services as
requested.
The legal basis for this processing resides in the requirement to meet
contractual and/or precontractual obligations in accordance with Article 6(1)
(b) of EU Regulation 2016/679 and the need to conform to legal obligations
contained in Article 6(1) (c) of EU Regulation 2016/679. We would like to
inform you that the provision of this personal data is indispensable in order
to provide the hotel services requested by you; where the data is not provided,
the data controller company may be unable to provide all or some of the
services requested.
Personal data within the meaning of Article 4(1) of EU Regulation 2016/679 may
be used for as long as necessary in order to meet contractual and/or legal
obligations.
2) Profiling and marketing purposes (optional)
Upon your express authorisation, personal data (as per Article 4(1) of EU
Regulation 2016/679) provided by you or referable to you at the point of
booking and/or stay may be processed for the following additional purposes:
A) direct marketing activity via the sending of publicity/promotional material
through the post; email/ sms/mms, mobile applications or other digital
communication channels.
B) client profiling activity aimed at improving the supply of goods and services
by the I
Girasoli SAS di Vincenzo Leardini. (client
profiling).
Please note that the processing procedures above may be managed to include your
consumer preferences to improve the efficiency of the I Girasoli SAS di Vincenzo Leardini. commercial policies
and services; consequently you may receive discounts, offers or targeted
promotions on the basis of your preferences and consumption habits.
The provision of data for the purposes described in A) – B) is optional so
that all hotel services can still be supplied, even where you refuse to
authorise the processing for the purposes listed in point 2).
The legal basis for the processing is represented by your express consent given
by ticking the appropriate clauses and completing the double opt-in procedure.
Personal data under Article 4(1) EU Regulation 2016/679 provided by you or
relating to you will be processed in compliance with the law for the period of
time taken to complete the purposes listed in point 2) with regard to the
principle of balancing the legitimate interests of the data controller with the
rights and freedoms of the customer who is the data subject. Your data will be
processed in accordance with the time frames set out in the legal provisions,
or in the absence of specific regulations, your data will be processed for as
long as necessary to complete marketing and profiling activities; the data
controller company guarantees that the processing of the data will not take
place for an indeterminate period of time.
We acknowledge that you are entitled at any time to withdraw your consent to
the activities mentioned in point 2) by means of a simple informal written
communication sent to the contact details of the data protection officer as
specified below in this policy.
In accordance with the law, any data which has been processed before the
withdrawal of consent shall be made safe.
Further information and clarifications pertaining to
the processing mentioned in point 1) and in point 2) are provided below:
- Personal data provided by you or referable to you may be processed
employing partially or fully automated means through the use of hard-copy,
electronic, and/or magnetic means.
- Personal data connected to you will not be circulated but may be passed or be
brought to the attention of appropriately trained operators who form part of
the data controller company and/or external parties collaborating with the
companies as data processing officers or independent controllers such as - by
way of example, which is not intended to be exhaustive:
- Companies, firms and/or
contractors engaged to process and manage personal data;
- Companies, firms and/or
contractors engaged in consultancy and/or technical, company or ICT
management;
- Companies belonging to
the I
Girasoli SAS di Vincenzo Leardini supplying goods and/or services and engaged in related activities;
- Other parties to whom it
is necessary to pass data for the proper and complete fulfilment of the
contractual relationship and/or to meet legal requirements and/or to
achieve the specified purposes.
- You are also informed that you are entitled to make a request to the data
controller company (I
Girasoli SAS di Vincenzo Leardini.) for access to your personal
data, rectification, deletion, restriction of data processed; you are,
moreover, entitled to object to the processing of personal data and to exercise
your right to portability. The rights contained in this paragraph may be
exercised as provided for by Articles 15, 16, 17, 18, 20, 21 EU Regulation
2016/679 which we have reproduced at the foot of this policy document for your
convenience. All the rights may be exercised in relation to the data controller
company; you may also object to the supervisory authority under the national
legislation in force.
- For any clarification and to exercise the rights above, you are free to apply
to the Data Protection Officer (DPO) in the person of the temporary director of
the privacy office of the I Girasoli SAS di Vincenzo Leardini. who can be
reached at Via
Cà Rastelli 13, 47843 Misano Adriatico (RN) ITALY, or on
telephone no. +39 0541 610724 or via email at info@locandagirasoli.it.
I Girasoli SAS di Vincenzo Leardini.
*This policy document complements and completes information already known
to the data subject.
EXTRACT FROM EU REGULATION 679/2016
Article 15 Right of access by the data subject The data
subject shall have the right to obtain from the controller confirmation as to
whether or not personal data concerning him or her are being processed and,
where that is the case, access to the personal data and the following
information: a) the purposes of the processing; b) the categories of personal
data concerned; c) the recipients or categories of recipients to whom the
personal data have been or will be disclosed, in particular recipients in third
countries or international organisations; (d) where possible, the envisaged
period for which the personal data will be stored, or, if not possible, the
criteria used to determine that period; (e) the existence of the right to
request from the controller rectification or erasure of personal data or
restriction of processing of personal data concerning the data subject or to
object to such processing; (f) the right to lodge a complaint with a
supervisory authority; (g) where the personal data are not collected from the
data subject, any available information as to their source; (h) the existence
of automated decision-making, including profiling, referred to in Article 22(1)
and (4) and, at least in those cases, meaningful information about the logic
involved, as well as the significance and the envisaged consequences of such
data processing for the data subject. 2. Where personal data are transferred to
a third country or to an international organisation, the data subject shall
have the right to be informed of the appropriate safeguards pursuant to Article
46 relating to the transfer. 3. The controller shall provide a copy of the
personal data undergoing processing. For any further copies requested by the
data subject, the controller may charge a reasonable fee based on
administrative costs. Where the data subject makes the request by electronic
means, and unless otherwise requested by the data subject, the information
shall be provided in a commonly used electronic form. 4. The right to obtain a
copy referred to in paragraph 3 shall not adversely affect the rights and
freedoms of others.
Article 16 Right to rectification The data subject shall have the
right to obtain from the controller without undue delay the rectification of
inaccurate personal data concerning him or her. Taking into account the
purposes of the processing, the data subject shall have the right to have
incomplete personal data completed, including by means of providing a
supplementary statement.
Article 17 Right to erasure (“right to be forgotten”) The data
subject shall have the right to obtain from the controller the erasure of
personal data concerning him or her without undue delay and the controller
shall have the obligation to erase personal data without undue delay where one
of the following grounds applies: a) the personal data are no longer necessary
in relation to the purposes for which they were collected or otherwise
processed; 4.5.2016 IT Official Journal of the European Union L 119/43 b) the
data subject withdraws consent on which the processing is based according to
point (a) of Article 6(1), or point (a) of Article 9(2), and where
there is no other legal ground for the processing; c) the data subject objects
to the processing pursuant to Article 21(1) and there are no overriding
legitimate grounds for the processing, or the data subject objects to the
processing pursuant to Article 21(2); d) the personal data have been
unlawfully processed; e) the personal data have to be erased for compliance
with a legal obligation in Union or Member State law to which the controller is
subject; f) the personal data have been collected in relation to the offer of
information society services referred to in Article 8(1). 2. Where the
controller has made the personal data public and is obliged pursuant to paragraph
1 to erase the personal data, the controller, taking account of available
technology and the cost of implementation, shall take reasonable steps,
including technical measures, to inform controllers which are processing the
personal data that the data subject has requested the erasure by such
controllers of any links to, or copy or replication of, those personal data. 3.
Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
a) for exercising the right of freedom of expression and information; b) for
compliance with a legal obligation which requires processing by Union or Member
State law to which the controller is subject or for the performance of a task
carried out in the public interest or in the exercise of official authority
vested in the controller; c) for reasons of public interest in the area of
public health in accordance with points (h) and (i) of Article 9(2) as
well as Article 9(3); d) for archiving purposes in the public interest,
scientific or historical research purposes or statistical purposes in
accordance with Article 89(1) in so far as the right referred to in
paragraph 1 is likely to render impossible or seriously impair the achievement
of the objectives of that processing; or e) for the establishment, exercise or
defence of legal claims.
Article 18 Right to restriction of processing 1. The data subject
shall have the right to obtain from the controller restriction of processing
where one of the following applies: a) the accuracy of the personal data is
contested by the data subject, for a period enabling the controller to verify
the accuracy of the personal data; b) the processing is unlawful and the data
subject opposes the erasure of the personal data and requests the restriction
of their use instead; c) the controller no longer needs the personal data for
the purposes of the processing, but they are required by the data subject for
the establishment, exercise or defence of legal claims; d) the data subject has
objected to processing pursuant to Article 21(1) pending the verification
whether the legitimate grounds of the controller override those of the data
subject. 2. Where processing has been restricted under paragraph 1, such
personal data shall, with the exception of storage, only be processed with the
data subject’s consent or for the establishment, exercise or defence of legal
claims or for the protection of the rights of another natural or legal person
or for reasons of important public interest of the Union or of a Member State.
L 119/44 IT Official Journal of the European Union 4.5.2016 3. A data subject
who has obtained restriction of processing pursuant to paragraph 1 shall be
informed by the controller before the restriction of processing is lifted.
Article 20 Right to data portability 1. The data subject shall have
the right to receive the personal data concerning him or her, which he or she
has provided to a controller, in a structured, commonly used and
machine-readable format and have the right to transmit those data to another
controller without hindrance from the controller to which the personal data
have been provided, where: a) the processing is based on consent pursuant to
point (a) of Article 6(1) or point (a) of Article 9(2) or on a
contract pursuant to point (b) of Article 6(1); and b) the processing is
carried out by automated means. 2. In exercising his or her right to data
portability pursuant to paragraph 1, the data subject shall have the right to
have the personal data transmitted directly from one controller to another,
where technically feasible. 3. The exercise of the right referred to in
paragraph 1 of this Article shall be without prejudice to Article
17. That right shall not apply to processing necessary for the performance
of a task carried out in the public interest or in the exercise of official
authority vested in the controller. 4. The right referred to in paragraph 1
shall not adversely affect the rights and freedoms of others.
Article 21 Right to object 1. The data subject shall have the right
to object, on grounds relating to his or her particular situation, at any time
to processing of personal data concerning him or her which is based on point
(e) or (f) of Article 6(1), including profiling based on those
provisions. The controller shall no longer process the personal data unless
the controller demonstrates compelling legitimate grounds for the processing
which override the interests, rights and freedoms of the data subject or for
the establishment, exercise or defence of legal claims. 2. Where personal data
are processed for direct marketing purposes, the data subject shall have the
right to object at any time to processing of personal data concerning him or
her for such marketing, which includes profiling to the extent that it is
related to such direct marketing. 3. Where the data subject objects to
processing for direct marketing purposes, the personal data shall no longer be
processed for such purposes. 4.5.2016 IT Official Journal of the European Union
L 119/45 4. At the latest at the time of the first communication with the data
subject, the right referred to in paragraphs 1 and 2 shall be explicitly
brought to the attention of the data subject and shall be presented clearly and
separately from any other information. 5. In the context of the use of
information society services, and notwithstanding Directive 2002/58/EC, the
data subject may exercise his or her right to object by automated means using
technical specifications. 6. Where personal data are processed for scientific
or historical research purposes or statistical purposes pursuant
to Article 89(1), the data subject, on grounds relating to his or her
particular situation, shall have the right to object to processing of personal
data concerning him or her, unless the processing is necessary for the
performance of a task carried out for reasons of public interest.
Cookies policy
Extended information on Cookies
Cookies consist of portions of code installed in the browser that assist the
Owner of the website in providing the service according to the purposes
described. Some of the purposes for which the Cookie