We inform you,

pursuant to Article 13 of EU Regulation No. 2016/679 (hereinafter, “GDPR“), that in the event of the collection of personal data concerning you, such processing will be carried out in accordance with the principles of fairness, lawfulness, transparency and protection of your confidentiality and your rights;

1. our organization, as a legal entity, acts in the dual role of Data Controller and Data Processor;
2. the Data Controller and the Data Processor (see contact details on the last page), having carried out the necessary internal assessments, have not appointed a Data Protection Officer, as pursuant to Article 37(1) of GDPR 2016/679 this is not required.

Your data will be processed

c/i) pursuant to Article 6(b) and (c), for purposes related to the performance of a contract or pre-contractual measures and to comply with legal obligations to which the Data Controller is subject; for example, data processing necessary for managing requests, quotations and bookings, fulfillment of contractual, accounting and tax obligations, payment management including credit cards, POS and advanced online services handled by the respective banks or agencies, and dispute management; as well as to comply with legal requirements; for example, regulations, EU and local laws or orders from authorities, registration and communication of data to authorities and management of disputes; as well as for the pursuit of the legitimate interests of the Data Controller or third parties under the conditions set out in the GDPR;

c/ii) pursuant to Article 7, subject to your freely given consent, for additional service and marketing purposes; for example, data processing necessary for sending promotional offers regarding our services and other events, rate updates, additional quotations, as well as greetings and holiday communications; to provide additional services such as external communication of data relating to your stay solely to allow the receipt of items, messages and telephone calls addressed to you;

for the processing of special categories of personal data in order to provide a higher level of hospitality; for example, food intolerances, allergies or other specific data;

for the processing of advanced online services; for example, registration in our management system to use your email address to send invoices, receipts, manage loyalty points and similar services;

c/iii) pursuant to Article 7, subject to your freely given consent, for further purposes; for example, data processing necessary to LOGIN to our public WIFI/LAN network to browse the internet;

as well as data processing necessary while using our institutional website, whose transmission is implicit in the use of internet communication protocols; such data are not collected to be associated with identified interests, but by their very nature could, through processing and association with data held by third parties, allow users to be identified; for example, IP addresses or device names of users connecting to the site, URI addresses of requested resources, request time, method used to submit the request to the server, size of the file obtained in response, numerical code indicating the server response status and other parameters relating to the user’s operating system and IT environment;

the aforementioned data may be used solely to obtain anonymous statistical information on the use of the public WIFI/LAN network and institutional website; for example, to monitor the proper functioning of our IT infrastructure and improve the service;

likewise, data may be used by competent authorities; for example, to ascertain responsibility in the event of hypothetical cybercrimes or damage to our WIFI/LAN network, IT system and institutional website.

1. d) pursuant to Article 6(1)(f), considering the reasonable expectations of the parties, for purposes of legitimate interests pursued by the Data Controller or third parties; for example, data for fraud prevention (presence monitoring, access logs, biometric data, video surveillance images…) and direct marketing purposes.

The recipients and categories of recipients of your data are

1. e) natural or legal persons, public authorities, collaborators such as employees, professionals, service providers, entities and associations.

Your personal data may be transferred to a third country or international organization

1. f) as described above, your data, in addition to being processed in paper form within our internal archives or at third parties, are mainly processed and stored electronically on internal mass storage within our structure or within the European Union through hosting, server and cloud services. The Data Controller may, if necessary, move hosting, server and cloud services outside the EU; in such case, data transfers will occur in compliance with applicable legal provisions, subject to the signing of the standard contractual clauses provided by the European Commission.

Data retention period

1. a) for the time necessary to fulfill the above purposes and in any case not exceeding 10 years from termination of the relationship for purposes under c/i and not exceeding 2 years from data collection for purposes under c/ii, c/iii and d.

Data Controller contact details:

Dak srls – Share capital paid: €2000 – REA VE: 404261 – VAT No.: 04351050275 – CIN: IT027019A1GL8F4BC9