PRIVACY NOTICE – PERSONAL DATA PROCESSING

pursuant to Article 13 of EU Regulation 2016/679 (GDPR) and Italian Legislative Decree No. 196/2003 as amended by Legislative Decree No. 101/2018

Dear User,

This Privacy Notice describes how Albergo Sole Mio s.n.c. processes the personal data of users who visit and use this website, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter "GDPR") and applicable Italian law.

The processing of your personal data will be conducted in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, as set out in Article 5 of the GDPR.

1. Data Controller

The Data Controller is:

Albergo Sole Mio s.n.c.
Via Istria 6 – 30021 Caorle (VE), Italy
E-mail: info@hotelsolemio.it

The internal Data Processing Manager is Paolo Soncin, reachable at the same registered address. 

2. Categories of Personal Data Processed

2.1 Data voluntarily provided by the user

The optional, explicit and voluntary submission of messages to the contact addresses of this website results in the collection of the sender's contact details (first name, surname, e-mail address, telephone number) and all personal data included in the communications.

2.2 Browsing data

The IT systems and software procedures used to operate this website automatically collect, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (e.g. IP addresses, browser type, operating system, request timestamps, etc.). Such data are used solely to obtain anonymous statistical information about website usage and to monitor correct operation.

2.3 Cookies and tracking technologies

This website may use technical cookies, which are necessary for the website to function, and — subject to prior consent — analytical or profiling cookies. For detailed information, please refer to our Cookie Policy, available on the website.

3. Purposes of Processing and Legal Bases

Personal data are processed for the following purposes:

• Provision of the requested services and management of the contractual relationship (legal basis: performance of a contract – Art. 6(1)(b) GDPR); 

• Compliance with legal, regulatory and tax obligations (legal basis: legal obligation – Art. 6(1)(c) GDPR); 

• Responding to enquiries and requests for information (legal basis: performance of a contract or pre-contractual measures – Art. 6(1)(b) GDPR); 

• Sending commercial and promotional communications, subject to explicit prior consent (legal basis: consent – Art. 6(1)(a) GDPR); 

• Handling potential legal disputes and protecting the Controller's rights (legal basis: legitimate interest – Art. 6(1)(f) GDPR). 

4. Methods of Processing

Personal data are processed by IT and/or electronic means, using organisational and logical methods strictly related to the stated purposes. Processing is carried out in a manner that ensures the security and confidentiality of the data, adopting appropriate technical and organisational measures pursuant to Article 32 of the GDPR.

Data may also be processed manually, in paper form, where necessary for the provision of the service.

5. Disclosure of Data to Third Parties

Personal data are not disseminated to the public. They may be disclosed to:

• Parties providing services instrumental to the Controller's activities (e.g. IT service providers, hosting providers, accounting and legal consultants), acting as Data Processors pursuant to Art. 28 GDPR; 

• Competent authorities, supervisory bodies and public entities, where required by law; 

• Banking and financial institutions for payment management. 

An up-to-date list of Data Processors is available at the Controller's registered office.

6. Transfers of Data Outside the EU

Personal data are not transferred to third countries outside the European Economic Area (EEA), except where technical services are used (e.g. cloud platforms) whose destination country has been recognised by the European Commission as providing an adequate level of protection, or where appropriate safeguards are in place pursuant to Articles 46–49 of the GDPR.

7. Data Retention Period

Personal data will be retained for no longer than is necessary to fulfil the purposes for which they were collected, and in any case:

• Contractual data: for the duration of the relationship and up to 10 years after its termination, in compliance with civil and tax law obligations; 

• Data processed for marketing purposes: until consent is withdrawn; 

• Browsing data and logs: generally no longer than 12 months from collection; 

• Data relating to contact requests: up to 24 months from receipt of the request. 

Upon expiry of the applicable retention period, data will be permanently deleted or anonymised.

8. Rights of the Data Subject

Pursuant to Articles 15–22 of the GDPR, you have the right to:

• Access (Art. 15): obtain confirmation as to whether personal data concerning you are being processed and to obtain a copy thereof; 

• Rectification (Art. 16): request the correction of inaccurate data or the completion of incomplete data; 

• Erasure (Art. 17): request the deletion of your data ("right to be forgotten"), where the applicable conditions are met; 

• Restriction of processing (Art. 18): request that the processing of your data be restricted in certain circumstances; 

• Data portability (Art. 20): receive your data in a structured, commonly used and machine-readable format, and transmit them to another controller; 

• Object (Art. 21): object at any time to the processing of your data on legitimate grounds or for direct marketing purposes; 

• Withdraw consent: withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. 

To exercise your rights, please contact the Controller at the e-mail address indicated in Section 1, or in writing to the registered office. The Controller will respond within 30 days of receipt of the request, except in cases of particular complexity.

9. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), located at Piazza Venezia 11 – 00187 Rome, Italy. Website: www.garanteprivacy.it.

10. Provision of Data and Consequences of Refusal

The provision of personal data is optional, except where it is necessary for the delivery of the requested service or to comply with legal obligations. In such cases, failure to provide the required data may make it impossible to proceed with the request or the contractual relationship.

Where processing is based on consent, the failure to grant it has no consequences other than the inability to carry out the activity for which consent is requested (e.g. sending of newsletters).

11. Automated Decision-Making

The Controller does not carry out processing based on automated decision-making, including profiling, that produces significant legal or similarly significant effects on data subjects.