Baia del Godano Resort & Spa - “Eukalypto s.a.s. di A.Paparatto & c. ”, Data Controller of personal data, with operational headquarters in Località Tonicello snc, 89866 Ricadi (VV) - ITALY, VAT number 02555770797, who can be contacted by phone at 0963 663460 or at the administration email address firstname.lastname@example.org - considers the “privacy" of its users to be of fundamental importance and guarantees that the processing of personal data is carried out in compliance with fundamental rights and freedoms, as well as the dignity of the data subject, with particular reference to confidentiality, personal identity and the right to the protection of personal data.
Personal information that is collected
On every occasion of contact or interaction with the guest and in all other aspects of our work, we can collect personal information. This personal information may include: contact information; information about personal characteristics, nationality, passport number and date and place of issue; travel history; payment information, such as your payment card number and other card information, as well as authentication information and other billing and account details related to electronic invoicing; preferences, with the prior written consent of the guest; preferences, with prior written consent, regarding marketing and communication; as well as related to the reservation
Purpose of processing
The personal data, also of an identifying nature, provided by you will be processed for purposes related to the management of the booking and any stay, by way of example, we inform you that the data may be processed:
• for inclusion in the personal data of computer databases and / or in physical archives of the company;
• for the management of hotel services;
• for the management of payments;
• for the management of promotions and offers;
• for statistical purposes related to the functionality of the website;
• to satisfy any dispute management, as well as to fulfill any other contractual and / or legal obligation, in particular accounting and tax obligations;
The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.
This is information that is not collected to be associated with identified interested parties, but which by their very nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes the IP addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user's computer environment.
These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and are deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the site: except for this possibility, the data on web contacts do not currently persist for more than seven days.
Our Company may use 'Cookie' technology to improve the possibilities of using the services offered, by associating a 'Cookie' with the connected visitor. 'Cookies' are also used to determine the traffic values of our site and to track your profile during the service ordering process, to calculate discounts and manage any promotions that may be applicable to your account.
Methods of processing
Personal data are processed with automated and manual tools for the time strictly necessary to achieve the purposes for which they were collected.
Specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access.
Nature of the provision of data
For the purposes of booking for a hotel stay, the provision of data is mandatory and failure to provide it may make it impossible to obtain what is requested, for the purposes (by way of example, sending promotional offers, updating on rates, etc.) the provision of the data is optional and does not prevent the provision of the requested service (hotel stay)
No data deriving from the web service (therefore navigation data specified above and cookies) is communicated or disseminated (save communication to judicial or police bodies if necessary).
The data is processed by personnel specifically appointed in writing to process the data (administrative staff and persons in charge of relations with the public, including those outside the Company, those in charge of managing information systems, including those outside the Company who can also perform functions of system administrator and are in in this case, appointed as such, marketing sector personnel also external to the Company, interns, data processors and their collaborators, persons in charge of the specific sector to which a request is addressed, site management personnel also external to the Company) only if the processing is necessary to carry out their duties by carrying out only the operations necessary for the performance of the duties themselves. They can also be processed by data processors (including companies outside the Company that carry out shipping, marketing, and server management and storage activities). External companies can also process the data through specifically appointed persons in writing who can carry out the same activities and process the data for the same purposes, for which the managers have been appointed by Le Garrubbe Hotel Lamezia Srl.
The data provided by the user may be disclosed to subjects for whom there is a communication obligation pursuant to the law or a need for communication to assert a just right of the company to the relevant bodies.
The Data is processed for the time necessary to perform the service requested by the User, or required by the purposes described in this document.
The Data Controller does not transfer personal data to third countries or to international organizations outside the EU.
Rights of interested parties
The interested party always has the right to exercise and assert, towards the Data Controller, the rights recognized by EU Regulation 2016/679 (articles 15 to 22), in particular:
Art. 15 (right of access), 16 (right of rectification) of EU Reg. 2016/679
The interested party has the right to obtain from the data controller confirmation as to whether or not personal data concerning him is being processed and, in this case, to obtain access to personal data and the following information:
a) the purposes of the processing;
b) the categories of personal data in question;
c) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if they are recipients of third countries or international organizations;
d) the retention period of the personal data envisaged or, if this is not possible, the criteria used to determine this period;
e) the existence of the data subject's right to ask the data controller to rectify or delete personal data or limit the processing of personal data concerning him or to oppose their processing;
f) the right to lodge a complaint with a supervisory authority;
h) the existence of an automated decision-making process, including profiling and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the data subject.
Right pursuant to art. 17 of EU Reg. 2016/679 - right to cancellation (”right to be forgotten“)
The data subject has the right to obtain from the data controller the cancellation of personal data concerning him without undue delay and the data controller is obliged to cancel the personal data without undue delay, if one of the following reasons exists:
a) the personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed;
b) the interested party revokes the consent on which the processing is based in accordance with Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), and if there is no other legal basis for the processing ;
c) the interested party opposes the processing pursuant to Article 21, paragraph 1, and there is no legitimate overriding reason for proceed with the processing, or oppose the processing pursuant to Article 21, paragraph 2;
d) the personal data have been unlawfully processed;
e) personal data must be deleted to fulfill a legal obligation under the law of the Union or of the Member State to which the data controller is subject;
f) the personal data were collected in relation to the information society service offer referred to in Article 8, paragraph 1 of EU Reg. 2016/679
Right referred to in art. 18 Right to limitation of treatment
The interested party has the right to obtain from the data controller the limitation of processing when one of the following hypotheses occurs:
a) the data subject disputes the accuracy of personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
b) the processing is unlawful and the interested party opposes the cancellation of personal data and instead requests that its use be limited;
c) although the data controller no longer needs it for processing purposes, the personal data are necessary for the data subject to ascertain, exercise or defend a right in court;
d) the interested party opposed the processing pursuant to Article 21, paragraph 1, EU Reg. 2016/679 pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.
Right pursuant to art. 20 Right to data portability
The interested party has the right to receive in a structured format, commonly used and readable by an automatic device, the personal data concerning him provided to a data controller and has the right to transmit such data to another data controller without impediments from part of the Data Controller.
If you would like more information on the processing of your personal data, or exercise your rights, you can write to the e-mail address email@example.com. Before we can provide you, or change any information, you may need to verify your identity and answer some questions. An answer will be provided as soon as possible.