Privacy Policy

Privacy Policy

The company Bagni 86-87-88 (hereinafter, the “Controller”), in its capacity as Data Controller pursuant to Articles 4 and 28 of Legislative Decree No. 196 of June 30, 2003 – Personal Data Protection Code (hereinafter, the “Code”) and Articles 4(7) and 24 of EU Regulation 2016/679 of April 27, 2016 – General Data Protection Regulation (hereinafter, the “Regulation”), hereby informs you, pursuant to Article 13 of the Code and Article 13 of the Regulation, that it will process the personal data of users who fill out the forms on the hotel website bagni86-87-88cattolica.it.

1. Subject of the Processing

The data processed includes personal identification data and contact information.

The personal data provided by the user through the forms is collected and processed solely to establish an initial contact for availability inquiries or to make reservations.

Providing the requested data is mandatory, as it is necessary to perform the service. Failure to provide such data may result in the inability to establish or maintain a contractual relationship.

The processing will be carried out using digital and/or analog means. The data will not be publicly disclosed.

In the event of booking confirmation, pursuant to Article 130(4) of the Privacy Code, we may use the data subject’s email address to send newsletters for marketing purposes relating to services similar to those already contracted with the Controller.

2. Purpose of the Processing

The data will be processed to allow for activities related to the initiation and management of the requested service.

Data will be processed lawfully, fairly, and with the utmost confidentiality, in accordance with the minimum security measures provided for by the Code and the Regulation.

It is specified that the email address provided by the user in the form will be exported to a CRM for marketing purposes, pursuant to Article 130(4) of the Privacy Code.

3. Method of Processing

The Controller will process personal data for as long as necessary to fulfill the above purposes and, in any case, no longer than 10 years from the termination of the contract.

4. Data Communication

The Controller may communicate the data for the purposes set out in Article 2 to all parties to whom such communication is required by law. These data will not be disseminated.

5. Data Storage and Transfer

The management and storage of personal data will take place on servers located within the European Union, owned by the Controller and/or by third-party companies duly appointed as Data Processors. Currently, the servers are located in Italy. The data will not be transferred outside the European Union.

6. Rights of the Data Subject

The customer, as the data subject, has the rights provided for by Article 7 of the Privacy Code and Article 15 of the Regulation, specifically:

  1. The data subject has the right to obtain confirmation as to whether or not personal data concerning them exists, even if not yet recorded, and to receive such data in an intelligible form.

  2. The data subject has the right to obtain information regarding:
    a) the origin of the personal data;
    b) the purposes and methods of the processing;
    c) the logic applied if processing is carried out using electronic means;
    d) the identification details of the controller, processors, and designated representative;
    e) the recipients or categories of recipients to whom the personal data may be communicated or who may become aware of it in their capacity as designated representatives in the State, data processors, or persons in charge of processing.

  3. The data subject has the right to obtain:
    a) the updating, rectification, or, where interested, integration of the data;
    b) the erasure, anonymization, or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data was collected or subsequently processed;
    c) certification that the operations in letters (a) and (b) have been notified to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared to the right being protected.

  4. The data subject has the right to object, in whole or in part:
    a) on legitimate grounds, to the processing of personal data concerning them, even if relevant to the purpose of the collection;
    b) to the processing of personal data concerning them for purposes not covered in Article 2.

Pursuant to Articles 15 et seq. of the GDPR, the user also has the right to request at any time access to their personal data, its rectification or deletion, restriction of processing in the cases provided for by Article 18 of the GDPR, and to receive their data in a structured, commonly used, and machine-readable format, in the cases provided for by Article 20 of the GDPR.

At any time, the user may revoke their consent pursuant to Article 7 of the GDPR and lodge a complaint with the competent supervisory authority pursuant to Article 77 of the GDPR if they believe that the processing of their data is in breach of current legislation.

The user may also object to the processing of their personal data under Article 21 of the GDPR, explaining the reasons justifying the objection: the Controller reserves the right to assess the request, which would not be accepted if there are compelling legitimate grounds to proceed with the processing that override the interests, rights, and freedoms of the user.

The data subject may exercise their rights at any time by sending:

– an email to the address: info@bagni86-87-88cattolica.it