Web Customer Policy

Information pursuant to Article 13 of (EU) Regulation 2016/679 on the protection of personal data (GDPR) and request for consent to process personal data collected from the data subject

Elahotel S.r.l., with its registered office in Via Trento n. 138 65122 Pescara (Pe) VAT ID 01749280689, in its capacity as the data controller of personal data pursuant to Article 24 of EU Regulation n. 2016/679 (“General Data Protection Regulation”, hereinafter GDPR), Legislative Decree o. 196/2003 (“Personal Data Protection Code”) as amended by Legislative Decree 101/2018, informs you pursuant to Article 13 EU Regulation no. 2016/679 (hereinafter, “GDPR“) that your data will be processed in the manner and for the purposes for which it was acquired and as specified below (for any assistance or communication please refer directly to our Data Protection Officer – E-mail address: dpo@hvillamaria.it). dpo@hvillamaria.it).

1. 1. Reason for processing and personal data required
      
      The Data Controller processes the personal data communicated to us by you as part of the management of relations with our facility with regard to planned activities, or those anticipated in this respect; as specified in the purposes of processing. The data required are as follows (data in brackets are examples):
      • Cat 1. Personal data (first name, surname, e-mail address)
      • Cat 2. Bank, accounting/tax data (credit card number)
      
      
      We take our responsibility for your privacy very seriously. The information we request when booking is required in order to offer you a professional and accurate service, as is our custom. We will only disclose your personal information to third parties for the purpose of completing your booking, in order to provide you with the information or services you have requested, or otherwise with your explicit consent.
      
      Elahotel does not adopt any automated decision-making processes, including profiling; as referred to in Article 22(1) and (4) of Regulation (EU) No 2016/679. 2016/679.
   
   
   
   2. Purposes of processing and the obligatory or optional nature of data provision
      
      Your personal data is processed for the following purposes:
      1. Booking and provision of services requested by the user
      2. Direct and indirect marketing and market research (including the sending of newsletters related to sales promotions)
      
      
      
      The processing referred to in point a) is mandatory for the provision of the services requested by the user. Please note, we will not charge your credit card. Your credit card details are only required to guarantee your booking. Your data is sent to us via a secure server. We use the latest and most secure technology available, which encrypts all personal data. Our server and network are protected by firewalls against unauthorised access. This means that we can guarantee that it is completely safe to send us your details.
      
      The processing referred to in point b) requires your explicit and express consent by marking specific “flags”.
      
      Please note that the objective of direct marketing activities (carried out by Elahotel srl) and indirect marketing activities (through Social Networks) is to collect and use data that is relevant and limited to the necessary with regard to the end purpose for which they are processed, in order to carry out studies, research, market statistics, and to send informative and/or commercial communications.
      
      If the Data Controller intends to further process personal data for a purpose other than the one for which it was collected, prior to such further processing, we are required to provide you with information about this other purpose and any further relevant information, and collect specific consent where appropriate.
   
   
   
   3. Processing methods
      
      The data will be processed in accordance with the principles of correctness, lawfulness (provided for in Article 6 GDPR), transparency and protection of your privacy and rights.
      
      The processing of your data shall be carried out by automated methods designed to store, manage and transmit it and by using means that are suitable, where applicable and in accordance with the state of the art, to guarantee security and confidentiality through the use of appropriate procedures that avoid the risk of loss, unauthorised access, unlawful use and dissemination.
      
      The processing of your personal data is carried out through the operations indicated in Art. 4 no. 2 GDPR, namely: collection, recording, organisation, structuring, storage, adaptation and modification, extraction, consultation, processing, selection, comparison, use, interconnection, blocking, communication, deletion and destruction of data.
      
      Your personal data is subject to both paper, electronic and/or automated processing by persons specifically authorised to process them.
   
   
   
   4. Place of processing
      
      The data is currently processed and stored at the company’s registered office and operational premises (on an accrual basis):
      • Via Trento n. 138 65122 Pescara (PE)
      • C.da Pretaro, 66023 Francavilla al Mare (CH)
      
      
      It is also processed, on behalf of the Controller, by professionals and/or companies appointed to carry out technical, development, management and administrative/accounting activities.
   
   
   
   5. Storage time
      
      The Controller will process personal data for the time necessary to fulfil the stated purposes and all data provided will be stored in our archives according to the following parameters:
      • for the activities referred to in (a), the data may be retained for the limitation period stipulated by the applicable regulatory provisions, including tax provisions
      • for the activities referred to in (b), until your explicit request to discontinue the service and in any case for a maximum of 7 years from its collection
   
   
   
   6. Communication and transfer of data
      
      Without prejudice to communications made in fulfilment of legal and contractual obligations, all data collected and processed may be communicated in Italy and transferred abroad (within the EU) exclusively for the purposes specified above
      • to parties that provide services for the management of the Company’s computer system, website and telecommunications networks;
      • to consultants of the Company or other entities that provide services related to the Service we provide, including Zucchetti Hospitality Srl (with registered office: Via Solferino, 1, 26900 Lodi – VAT ID 0289417120) through Vertical Booking, a software solution for managing reservations
      
      
      The full list of Data Processors is available upon request. Personal data may also be made known to company employees/consultants who are specially trained and appointed for the purpose. The data communicated will not be disseminated under any circumstances.
   
   
   
   7. Your rights as the data subject
      
      As a data subject, ELAHOTEL reminds you that you have the rights set out in Articles 15-22 GDPR and in particular:
      • obtain confirmation of the existence or otherwise of personal data concerning you, even if not yet recorded, and its communication in intelligible form
      • obtain information on the origin of the personal data, purposes and methods of processing, and logic applied where the processing is carried out using electronic means
      • know of the subjects or categories of subjects to whom your personal data may be communicated or who may gain knowledge of them
      • obtain the updating, rectification or, where interested, integration of data
      • obtain the deletion, transformation into anonymous form or blocking of data processed in breach of the law, including data whose storage is not necessary in relation to the purposes for which the data were collected or subsequently processed
      • oppose, in whole or in part for legitimate reasons, the processing of personal data concerning you (only for marketing processing), even if relevant to the purpose of collection
      • file a complaint with the supervisory authority (Garante Privacy – www.garanteprivacy.it)
   
   Rights may be exercised within the limits established by the legal basis of the processing operations.
   
   
   
   • Methods of exercising rights
     
     You may exercise your rights at any time by sending:
     • a registered letter with proof of receipt to one of the addresses indicated above under ‘place of processing’.
     • an e-mail to dpo@hvillamaria.it
     
     
     It is understood that, where the request for access is submitted by electronic means, the information will be provided in a commonly used electronic format.