Request for availability and prices

Information regarding processing of personal data

Under art. 13 of the EU Regulation no. 679/2016 (hereinafter, "GDPR"), the company Zaccaria SNC (hereinafter, "Data Controller"), of the processing of Personal Data provided by you as a Data Subject in relation to the establishment and execution of the contractual relationship in progress, inform you that: the processing of data shall follow principles of correctness, lawfulness, transparency and the protection of privacy, the right to personal identity and data protection. Data will be processed electronically and on paper and will be entrusted to the managers and to the persons in charge, according to the law, with the use of security measures to guarantee the confidentiality of the person to whom the data refer and to avoid undue access.

1. PURPOSE OF TREATMENT AND DURATION OF TREATMENT
The sensitive and personal data you provide is collected for the following services.

2. COMMUNICATIONS THROUGH THE WEBSITE AND / OR REGARDING RESERVATIONS:

Use of the contact form or request for prices and availability: sending requests through the website forms is subject to acceptance of this privacy policy and therefore explicit consent is required. The data will be retained for 2 years, unless otherwise applicable, and subsequently deleted.
Data supplied voluntarily by the user: The optional, explicit and voluntary sending of e-mails to the addresses indicated on this site - sending containing requests, communications or other personal data spontaneously communicated - entails the necessary acquisition of such personal information that will be used for the sole purpose of providing an answer and / or to satisfy the request of the interlocutor, where this is possible.
Navigation data: The computer systems and software procedures in charge of the websites operation acquire, during their normal operation, some personal data (so-called log files) the transmission of which is implicit in the use of internet communication protocols. This information is not collected in order to be associated to identified data subjects, but due to its same nature can, by means of processing and integration with data held by third parties, allow users to be identified. This category includes the IP addresses or domain names of the computers used by the users to connect to the website, URI (Uniform Resource Identifier) form addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the reply given by the server (done, error, etc.) and other parameters concerning the user’s operating system and computer environment.

3. RESERVATIONS AND MANAGEMENT OF ANNEXED SERVICES - ONLINE AND ON SITE:  

To obtain and confirm your booking of accommodations and other services, and to provide such services as requested. Since this processing is required to define our contractual relationship and to perform under our contract with you, your consent is not required, unless certain “sensitive” information is submitted. Should you refuse to submit your personal information, we will not be able to confirm your booking or provide you with the requested services. Processing shall cease once you check out, although some of your personal information may (or in some instances, has to) continue to be processed for the purposes and in the manner described below. Particularly sensitive data such as health data (food or products allergies) may be required, which are only required to provide a better service. These data will be deleted upon departure;
To comply with our “Public Safety Law” (Article 109 Royal Decree n. 773, 18/6/1931) which requires that we provide identification data of our guests to the police, for purposes of public safety, in the manner established by the Ministry of the Interior (Decree of 7 January 2013). Data submission is mandatory, and does not require your consent. Should you refuse to provide such information, we will not be able to host you in our hotel. Data acquired for such purposes shall not be retained by us, unless you provide consent to their retention as required under point 4, infra;
To comply with applicable administrative, accounting, and tax regulations. For these purposes, your consent is not required. Personal information is processed by us and our persons in charge of data processing, and is disclosed outside the company only when and if required by law. Should you refuse to submit the required data for the above purposes, we will not be able to provide you with the requested services. Data acquired for such purposes is retained by us for the required statutory period (10 years – or longer, in case of tax audits);
To speed-up check-in on your next visit to our hotel. For such purposes, upon obtaining your consent (which can be revoked at any moment), your information will be retained for a maximum of 2 years and will be used the next time you are our guest, for the reasons listed supra;
To speed up the procedures of your check-in. To perform this task, the receptionist will make a photocopy of the passport or any valid document able to prove the identity of each one of the guests lodging at the hotel. This photocopy will be destroyed at the date of check-out.
To guarantee the hotel against damages. For this purpose, the data of a valid credit card of a guest will be requested. This data will be stored in our software system using appropriate security measures such as encryption. Your consent is not required as legitimate interest of the data controller to be protected from any damage. Alternatively, a cash security deposit will be required.
To allow you to receive messages and telephone calls during your stay. Your consent is required for such purposes. You can revoke your consent at any time. Such processing, where consent is granted, shall end when you check out;
To send you advertising messages and updates on special rates and promotions. For this purpose, upon obtaining your consent, your information shall be retained for a maximum of 2 years and will not be disclosed to third parties. You may revoke your consent at any moment;
For purposes of protecting persons, property, and company assets, using a video-surveillance system for some areas of the hotel, which are duly identified by signage. Your consent is not required for such processing because it is conducted pursuant to our legitimate interest to safeguard persons and property against potential violence, theft, robbery, damage, and vandalism. Surveillance is also conducted for purposes of fire prevention and occupational safety and health. Recorded images are erased after 24 hours, except on holidays or other days the business is closed; images are never retained for more than one week. These images are not subject to third-party disclosure, except as required to comply with a specific investigatory demands from a court or the police.
All the above data are handled manually on paper or by means of the computer system, on which they are stored and will be deleted from this system in the manner defined previously . All documents are also stored in our computer archive using the electronic data storage system and will be kept for the duration required by law.
You have the right at any time and for free, to oppose to the treatments that require the consent to be exercised under the conditions described below (vds. Point 8).

  4. TREATMENT METHODS
The processing of personal data - as identified above - is achieved by means of the operations indicated into the GDPR art. 4 no. 2) and more precisely: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, delete and destruction of data. Personal data are subjected to both paper and electronic and / or automated processing.  

5. DATA ACCESS
The data may be made accessible for the purposes referred to point 1:
to employees and collaborators of the Data Controller, in their capacity as authorized personnel and / or system administrators;
to companies affiliated with the data controller or third parties (for example, providers for the management and maintenance of the website, online booking, suppliers, lenders, professional offices, etc ) who carry out outsourced activities on behalf of the data controller, in their capacity as data processors and / or joint data controllers of the treatment.  



6. DATA COMMUNICATION

The scope of communication of the data themselves will concern:
with regard to the services provided for by the law, the Authorities, Public Administrations, Ministries and Chambers of Commerce, the companies affiliated with the Data Controller and Professional Studies with a representative mandate ;
as for all the services offered by the Data Controller with a request for consent, to companies affiliated with the Data Controller for sending advertising material by email, postal mail, messaging and telephone .
as for all the services offered by the Data Controller, only for statistical purposes and to improve the offered services, hardware and software company maintenance. Personal and sensitive data are not subject to disclosure outside the Data Controller and the companies that have an agreement with the Data Controller.

  7. DATA TRANSFER
The management and storage of personal data will be carried out on servers of the data controller and / or third-party companies appointed and duly appointed as Data Processors. Currently the servers are located in Italy at the headquarters of the data controller. Email archiving is managed in the cloud through Google Inc. services  in Europe and the United States of America. The management of online bookings can be managed on servers outside the European Union, according to strict security and privacy criteria. In any case, it is understood that the Data Controller, where necessary, will have the right to move the server location to Italy and / or the European Union and / or not-EU countries. In this last case , the Data Controller ensures that the transfer of data will take place in compliance with the applicable legal provisions , stipulating, if necessary, agreements that guarantee an adequate level of protection and / or adopting the contractual clauses, standards set by the European Commission.  

8. RIGHTS OF THE INTERESTED PARTY
In your capacity as an interested party, you have the rights referred to in art. 15 GDPR and precisely the rights of: the. obtain from the Data Controller confirmation about the processing in progress or not of personal data concerning you, even if not yet registered; if so, has the right to have access to it through communication in an intelligible form; ii. obtain the indication: a) of the origin of personal data; b) of the purposes and methods of the processing; c) of the logic applied in case of treatment carried out with the aid of electronic instruments; d) of the identifying details of the holder, of the responsible and of the representative designated according to the art. 3, paragraph 1, GDPR; e) of the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them as the representative designated in the territory of the State, managers or agents; iii. obtain: a) updating, rectification or, when interested, integration of data; b) the cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed(unless different legal or contractual obligations) ; c) the attestation that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case where such fulfillment is it proves impossible or involves a use of means manifestly disproportionate to the protected right; iv. to object, in whole or in part: a) for legitimate reasons to the processing of personal data concerning you, even if pertinent to the purpose of collection (unless different legal or contractual obligations); b) to the processing of personal data concerning you for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication, through the use of automated call systems without the intervention of a operator by e-mail and / or through traditional marketing methods by telephone and / or paper mail. It should be noted that the right of opposition of the interested party, set out in point b) above, for direct marketing purposes through automated methods extends to traditional ones and that in any case the possibility remains for the data subject to exercise the right to object even only partially. Therefore, the interested party can decide to receive only communications using traditional methods or only automated communications or none of the two types of communication. It is now specified that the revocation of the consent given to the processing of the data provided for the purposes described in paragraph 1.b above will not affect the lawfulness of the treatment based on the consent given prior to the notification. Where applicable, it also has the rights referred to in Articles 16-21 GDPR (Right of rectification, right to be forgotten, right of limitation of treatment, right to data portability, right of opposition) unless different legal or contractual obligations , as well as the right of complaint to the Guarantor Authority.  

9. RULES OF EXERCISE OF RIGHTS
You can exercise your rights at any time by sending:
an e-mail to info@hotelpaganelli.com;  


10. DATA OF THIRD PARTIES (EVEN MINORS)
With specific reference to all data (personal andf sensitive) of third parties (relatives and / or cohabitants, guests, housewives, minors ), including those of any minors, the processing of data will be based on principles of correctness , lawfulness, transparency and the protection of privacy, the right to personal identity and data protection in accordance with current regulations, with the use of security measures - also further than those defined in this statement - designed to guarantee the confidentiality of the person to whom the data refer and to avoid undue access. Any sensitive data of minors will be processed only and exclusively through the explicit consent of a parent or legal tutor.  

11. DATA CONTROLLER, DATA PROCESSOR AND OTHERS
The Data Controller is ZACCARIA SNC, with registered office in Castello 4687, 30122 Venezia, VAT number 03683460277, tel 041 5224324, info@hotelpaganelli.com. The updated list of joint data controllers and data processor is kept at the headquarters of the Data Controller.