PRIVACY POLICY
ART. 13 EU REG. N.679 / 2016 (briefly GDPR) AND EFFECTIVE ITALIAN LAW ON THE SUBJECT for the protection of personal data (Legislative Decree n.196 / 2003, Legislative Decree n.101 / 2018)
Note: this policy is to be considered effective only and exclusively for what concerns the website www.hotelcantina.it and for no other websites or external platforms for the research of vacancies, costs, availabilities, bookings, etc. (eg Booking, Trivago, etc.)
- DATA CONTROLLER AND CONTACTS
The data controller is the person in charge of deciding for what purpose to process the data of the interested party, on what legal basis, for how long, and to whom to communicate it.
The Data Controller of the data collected through the website hotelcantina.it is LA CANTINA SRL
Hotel Residence Conference room
Via Statale 179 – 41036 Medolla (MO)
Tel. 053551695 – 51688 Fax 0535.52912
mail: info @ hotelcantina.it
pec: lacantinasrlmedolla @ legalmail.it
Registered at Modena’s Register of Companies
R.E.A. MO-345474- VAT number 02950420360
For any question concerning the processing of your personal data, you can contact the Data Controller by ordinary mail at the address above. The Data Controller is not required to designate a DPO (Data Protection Officer), as there are no legal mandatory requirements.
- PURPOSE OF PROCESSING, LEGAL BASES, STORAGE TIME
The purposes are the reasons for which we process your personal data. Below, you will find a list of purposes. Each purpose “rests” on one or more legal bases.
NB: In addition to the purposes listed below, the Data Controller will be required to provide personal data in fulfillment of justified and legally founded requests by Authorities or other third parties, and in any case every time the communication of data is required by law.
2.a) Website views and browsing
Purpose : to allow correct website navigation.
Legal basis : use of a service requested by the interested party, art. 6.1.b) GDPR.
Notes on processing and storage time :
Viewing the Website and browsing it entail, for reasons intrinsic to the use of IT protocols, an exchange of technical information between the Data Controller’s computer system and yours. The information transmitted is, for example, the following: operating system used, type of browser and version, time of the request, size of information flows.
Data is immediately deleted when the browsing session ends, unless it is necessary for the exercise or defense of rights (see below).
2.b) Management of user requests (sections: booking, contacts)
Purpose : response / execution of the user’s direct request.
Legal basis : contract (including pre-contractual request), art. 6.1.b) GDPR.
Notes on processing and storage time :
Currently, the website supports contacts through contact or booking forms. We only collect the strictly necessary data to respond to the contact request.
The personal data transmitted by completing the aforementioned forms is exclusively used for the aforementioned purpose, it is not processed for marketing or profiling purposes or for any other purpose other than those indicated. It is not shared with third parties. It could be processed by data processors used by the Data Controller for business organization. Data is deleted once the customer’s request has been fulfilled.
2.c) Assessment, exercise and / or defense of a right
Purpose : defense of the rights of the Owner.
Legal basis : legitimate interest, art. 6.1.f) GDPR
Notes on processing and storage time :
The legitimate interest of the Data Controller is to exercise their rights and defend themselves both judicially (including pre-litigation) and out of court, against third parties (including public entities) and all parties involved.
The personal data collected for this purpose is kept for 10 years, as required by the ordinary limitation period (Article 2946 of the Italian Civil Code), unless the limitation period is interrupted.
2.d) Execution of a hotel room booking contract
Purpose: to process the online booking request.
Legal basis: contract art. 6.1.b) GDPR and, in compliance with tax legislation, legal obligation art. 6.1.c) GDPR
Notes on processing and storage times: the storage time is 10 years to the extent that Article 220 of the Italian Civil Code is applicable. The retention time of 10 years will also be effective for the exercise and / or defense of a right as already stated in the previous point 2.c)
- OPTIONAL PROVISION OF DATA AND CONSEQUENCES OF A POSSIBLE REFUSAL TO PROVIDE DATA
The provision of your personal data constitutes a free and voluntary choice. The only consequence in case of failure to provide your personal data will be the impossibility of providing the requested services.
When filling the forms, including the booking form, the provision of some data is essential to process the request. The relevant fields are marked with an asterisk. Those without an asterisk indicate that data entry is purely optional.
- RECIPIENTS OR CATEGORIES OF RECIPIENTS
We will communicate the personal data collected through the Website to:
– consultants and professionals who assist us (also in the legal and commercial fields, if necessary);
– public subjects and authorities when their involvement is necessary (e.g. cyber attacks and, in general, criminal offenses, e.g. in the use of the contact form);
– judicial authorities in the exercise of their functions when deemed necessary or when required by law;
– entities appointed and authorized by the Data Controller to process data. Parties involved have committed to confidentiality or have an adequate legal obligation of confidentiality (e.g. employees and collaborators).
- TRANSFER OF DATA ABROAD
There is no transfer of data abroad.
- source from which personal data originates and, if applicable, whether data comes from sources accessible to the public:
Personal data is communicated to us directly by the interested party by filling the forms on the website.
7.existence of an automated decision-making process, including profiling: No automated decision-making process or data profiling is executed on the Website.
- RIGHTS OF THE INTERESTED PARTY
Your rights are as follows:
1. The interested party has the right to obtain confirmation of the existence of personal data concerning them, even if not yet registered, and their communication in an intelligible form.
2. The interested party has the right to obtain the following information:
a) origins of personal data;
b) purposes and methods of processing;
c) functioning of data handling with the aid of electronic instruments, if applicable;
d) details necessary to identify the data controller and parties involved;
e) subjects, entities, managers or agents to whom personal data may be communicated or who can learn about it as appointed representatives in the territory of the State.
3. The interested party has the right to obtain:
a) the update, correction or, when applicable, integration of data;
b) the cancellation, anonymization, or interruption of transmission of data processed in violation of the law, including data which needs not be kept for the purposes for which the data was collected or subsequently processed;
c) a statement that the operations referred to in letters a) and b) have been brought to the attention, also in regard to their content, of those to whom the data has been communicated or transmitted, exception made for cases in which this fulfillment proves impossible or involves the use of means that are manifestly disproportionate to the protected right.
4. The interested party has the right to object, in whole or in part:
a) for legitimate reasons, to the processing of personal data concerning them, even if pertinent to the purposes of the collection;
b) to the processing of personal data concerning them for the purpose of sending advertising or direct sales material, or for carrying out market research or commercial communication. Furthermore, they have the right to access their data, the right to rectification and cancellation, the right to limitation of processing, right to portability of their data, right to object processing, right not to be subjected to automated decision-making processes (including profiling), right to contact the supervisory authority. At any time, they can exercise the above rights, bearing in mind that the cancellation, limitation and opposition to the processing will make it impossible for the Company to continue the relationship existing between the parties.
Last updated: June 23, 2021
