Privacy Policy

Pursuant to Regulation (EU) 2016/679 (hereinafter referred to as the "Regulation", or "GDPR"), this page describes how the personal data of users consulting the Data Controller's website are processed.

This information does not concern other sites, pages or online services that can be reached via hypertext links that may be published on this site, but which refer to resources outside the domain

https://www.hotelmaestri.com/

Following consultation of the site, data relating to identified or identifiable natural persons may be processed.

DATA PROCESSED, PURPOSE OF PROCESSING AND LEGAL BASIS

1) NAVIGATION DATA

Legal basis: "processing of data necessary for the navigation of the website" - contractual obligation - Art. 6(1)(b) GDPR

The computer systems and software procedures used to operate this site acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes the IP addresses or domain names of the computers and terminals used by users, the URI/URL (Uniform Resource Identifier/Locator) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computer environment. This data, necessary to navigate the Site and to use the information it contains, is also processed by the data controller for the purpose of:

- obtain aggregate and anonymous statistical information on the use of the Site (most visited pages, number of visitors per time slot or per day, geographical areas of origin of visitors, etc.);

- check the correct usability of the content offered by the Site;

- prevent or counteract any possible cybercrime, fraudulent use of the functionalities available on the site, also with a view to reconstructing security incidents and their traceability

Conservation:

In compliance with the principles of lawfulness, purpose limitation and data minimisation, in accordance with Article 5 of the GDPR, browsing data will be stored for a period of time not exceeding the achievement of the technical purposes described above for which they are collected and processed, except in the event of the need to ascertain criminal offences by the judicial authorities.

2) DATA COMMUNICATED BY THE USER

Legal basis: "data processing necessary to answer users' questions" - contractual obligation - Art. 6(1)(b) GDPR

The optional, explicit and voluntary sending of messages to the contact addresses of the Data Controller, private messages sent by users to institutional profiles/pages and on social media (where this possibility is provided for), as well as the filling in and forwarding of forms on the Data Controller's websites, including requests for bookings and/or quotations, entail the acquisition of the sender's contact data, necessary to reply, as well as all the personal data included in the same communications.

For booking requests, the Data Controller uses CRM (Customer Relationship Management) provided by the following Data Processor:
ZUCCHETTI HOSPITALITY SRL - Via Solferino n.1 - 26900 Lodi (LO)

Conservation:

The data communicated by the user are stored for the time necessary to handle individual requests; any subsequent storage for statistical purposes provides for anonymisation of such data (except in the event of the need to ascertain criminal offences by the judicial authorities).

3) NEWSLETTER

Legal basisConsent of the data subject' - Art. 6(1)(a) GDPR

The processing of the data required for the administration of the newsletter takes place with the explicit consent of the user. You can revoke this consent at any time by unsubscribing using the functionalities indicated in all e-mails or by sending an e-mail to the contact details of the data controller.

Conservation:

The data communicated by the user are stored until consent is revoked by the person concerned.

METHODS OF TREATMENT
The data will be processed using paper, magnetic, computer or telematic instruments and supports. The data will be included in the relevant databases that may be accessed, and therefore become known, by the employees expressly designated by the Data Controller as Data Processors and/or Persons in charge of processing. Data processors and persons in charge of the processing may perform consultation, use, processing, comparison and any other appropriate operation, including automated operations, only in cases where they have been expressly authorised to do so.

RECIPIENTS OF DATA

The recipients of the data collected as a result of the consultation of some of the services listed above are certain entities designated by the Data Controller pursuant to Article 28 of the Regulation, as data processors, and other additional service providers in the field of web-agencies, digital communication, system support, and any other digital service providers for which you can request a full list by writing to the Data Controller's contact details.

Some data and information may be transmitted or acquired by subjects identified as autonomous controllers; these data relate to cookies that are usually anonymised before being sent, for statistical purposes. If transfer to non-EU countries is envisaged, the guarantee measures taken will be indicated.

The personal data collected are also processed by the Data Processors formally appointed by the Data Controller, who operate on the basis of specific instructions provided as to the purposes and methods of processing.

SECURITY OF PROCESSING

Personal data transmitted and stored for the time necessary for the stated purposes are protected by specific technical and organisational security measures with reference to Art. 32 of the Regulation, capable of guaranteeing on a permanent basis the confidentiality, integrity, availability, as well as the ability to promptly restore the availability and access of personal data in the event of a physical or technical incident, including against the risks of destruction, loss, modification, unauthorised disclosure of or access, whether accidental or unlawful, to personal data transmitted, stored or otherwise processed.

COMMUNICATION, DISSEMINATION AND TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EU

Personal data may be disclosed in execution of legal obligations but will not be disseminated in any way.
The data controller does not directly transfer personal data to countries outside the EU. However, if you consent to the use of analytical and/or profiling cookies, your data may be transferred to the USA, a country that does not currently provide adequate guarantees for the processing of your data, but Google has declared the implementation of additional security measures that the data controller has assessed to be sufficient.

RIGHTS OF THE INTERESTED PARTY (Art. 15, 16, 17, 18, 19, 20, 21, 22 EU Reg. 679/2016)
The data subject shall have the right to obtain confirmation as to whether or not personal data concerning him exist, regardless of their being already recorded, and communication of such data in intelligible form. The data subject has the right to be informed: of the source of the personal data, of the purposes and methods of processing, of the logic applied to the processing if the latter is carried out with the help of electronic means, of the identification data concerning data controller, data processors and the representative designated as per Section 5(2), of the entities or categories of entity to whom or which the personal data may be communicated and who or which may get to know said data in their capacity as designated representative(s) in the State's territory, data processor(s) or person(s) in charge of the processing. The interested party has the right to obtain the updating, rectification or, when interested, the integration of data; the cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected; portability of the data. The data subject has the right to object, in whole or in part: on legitimate grounds, to the processing of personal data concerning him/her, even if pertinent to the purpose of collection; to the processing of personal data concerning him/her, where it is carried out for the purpose of sending advertising materials or direct selling or else for the performance of market or commercial communication surveys.

To exercise your rights, you can also use the template prepared and available on the website of the Data Protection Authority at this link:

https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9038275

Le requests may be addressed to the data controller using the contact addresses of the Data Controller listed at the beginning of the information notice.

RIGHT OF COMPLAINT

Data subjects who consider that the processing of personal data relating to them carried out through this website is in breach of the provisions of the Regulation have the right to lodge a complaint with the Garante, as provided for by Article 77 of the Regulation itself, or to take legal action (Article 79 of the Regulation). The model for lodging a complaint is available on the website of the Data Protection Authority at this link: https://www.garanteprivacy.it/home/docweb/-/docwebdisplay/docweb/4535524