The following Privacy Policy applies to all hotels and resorts belonging to the Italiana Hotels & Resort Group (www.himilanrhofair.it, www.hiflorence.it, www.hicosenza.it, www.italiana-hotels.it, www.nuvolegarden.com).

 

Italiana Hotels & Resort s.r.l., with registered office at Viale Europa 205 – Florence (FI), VAT No. 03064800786 (hereinafter, the “Data Controller”), as data controller, hereby informs you, pursuant to Article 13 of EU Regulation No. 2016/679 (hereinafter, the “GDPR”), that your personal data will be processed in accordance with the procedures and for the purposes set out below:

​

1. Subject Matter of the Processing

The Data Controller processes personal and identification data (for example, first name, surname, company name, address, telephone number, e-mail address, banking and payment details), hereinafter referred to as “personal data” or “data” (for example: information concerning your stays, including arrival and departure dates, special requests and your preferences regarding services, such as preferences for rooms, services or other amenities), provided by you in connection with the conclusion of contracts for the Data Controller’s services.

​

2. Purposes of the Processing

Your personal data are processed:

A) Without your express consent (Article 6(1)(b) and (c) GDPR), for the following Service Purposes:

• entering into contracts for the Data Controller’s services;

• completing and managing reservations;

• providing customer assistance;

• fulfilling pre-contractual, contractual and tax obligations arising from existing relationships with you;

• fulfilling obligations required by law, regulations, EU legislation or orders issued by the competent Authorities (such as those relating to anti-money laundering regulations);

• exercising the Data Controller’s rights, including the right of defence in legal proceedings;

B) Only with your specific and separate consent (Article 7 GDPR), for the following Marketing Purposes:

• sending you, by e-mail, post and/or SMS and/or telephone contact, newsletters, commercial communications and/or promotional material concerning products or services offered by the Data Controller, as well as communications aimed at assessing your level of satisfaction with the quality of the services;

• sending you, by e-mail, post and/or SMS and/or telephone contact, commercial and/or promotional communications from third parties.

Please note that, if you are already a customer, we may send you commercial communications relating to products and services of the Data Controller that are similar to those you have already used, unless you object to such communications.

 

3. Methods of Processing

The processing of your personal data is carried out through the operations indicated in Article 4(2) of the GDPR, namely: collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and destruction of data. Your personal data may be processed both in paper form and by electronic and/or automated means.

The Data Controller will process personal data for the time necessary to fulfil the purposes described above and, in any event, for no longer than 10 years from the termination of the relationship for Service Purposes and for no longer than 2 years from the collection of the data for Marketing Purposes.

 

4. Access to Data

Your data may be made accessible for the purposes referred to in Sections 2.A) and 2.B):

• to employees and collaborators of the Data Controller or of the companies belonging to the Italiana Hotels & Resort s.r.l. Group, in Italy and abroad, acting in their capacity as persons authorised to process data and/or internal data processors and/or system administrators;

• to third-party companies or other entities (including, by way of example, hosting and cloud service providers, professional firms, consultants, suppliers, etc.) that perform outsourced activities on behalf of the Data Controller, acting in their capacity as external data processors.

5. Communication of Data

Without the need for express consent (Article 6(1)(b) and (c) GDPR), the Data Controller may communicate your data for the purposes referred to in Section 2.A) to supervisory bodies, judicial authorities, as well as to those entities to which disclosure is required by law for the fulfilment of the aforementioned purposes. Such entities will process the data in their capacity as independent data controllers.

Your data will not be disseminated or made publicly available.

​

6. Data Transfer

The management and storage of personal data will take place on servers located within the European Union, belonging to the Data Controller and/or to duly appointed third-party companies acting as Data Processors. Currently, the servers are located in Italy.

The data will not be transferred outside the European Union. However, it is understood that, should this become necessary, the Data Controller may move the location of the servers to Italy and/or other European Union countries and/or non-EU countries.

In such cases, the Data Controller hereby ensures that any transfer of data outside the EU will be carried out in compliance with the applicable legal provisions, by entering into agreements, where necessary, that guarantee an adequate level of protection and/or by adopting the standard contractual clauses provided for by the European Commission.

 

7. Nature of the Provision of Data and Consequences of Failure to Provide Data

The provision of data for the purposes referred to in Section 2.A) is mandatory. In the absence of such data, we will not be able to guarantee the Services referred to in Section 2.A).

The provision of data for the purposes referred to in Section 2.B) is optional. You may therefore decide not to provide any data or subsequently withdraw your consent to the processing of data already provided. In such cases, you will not receive newsletters, commercial communications or promotional material relating to the Services offered by the Data Controller. You will nevertheless continue to be entitled to the Services referred to in Section 2.A).

 

8. Data Subject Rights

As a data subject, you have the rights set out in Article 15 of the GDPR and, specifically, the right to:

• I. obtain confirmation as to whether or not personal data concerning you exist, even if not yet recorded, and receive communication of such data in an intelligible form;

• II. obtain information concerning:
  a) the source of the personal data;
  b) the purposes and methods of processing;
  c) the logic applied in the event of processing carried out with the aid of electronic instruments;
  d) the identification details of the Data Controller, the Data Processors and the representative appointed pursuant to Article 3(1) of the GDPR;
  e) the entities or categories of entities to whom the personal data may be communicated or who may become aware of them in their capacity as designated representative within the territory of the State, Data Processors or authorised persons;

• III. obtain:
  a) the updating, rectification or, where there is an interest in doing so, completion of the data;
  b) the erasure, anonymisation or blocking of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;
  c) certification that the operations referred to in points a) and b) have been brought to the attention, including with regard to their content, of those to whom the data have been communicated or disseminated, except where such fulfilment proves impossible or involves a manifestly disproportionate effort compared with the right being protected;

• IV. object, in whole or in part:
  a) on legitimate grounds, to the processing of personal data concerning you, even where relevant to the purpose of collection;
  b) to the processing of personal data concerning you for the purpose of sending advertising or direct sales material, or for carrying out market research or commercial communications, through automated calling systems without the intervention of an operator, by e-mail and/or through traditional marketing methods by telephone and/or post.

Please note that the data subject’s right to object, as set out in point b) above, to direct marketing carried out through automated methods also extends to traditional methods. The data subject may, in any event, exercise the right to object only in part. Therefore, the data subject may choose to receive only communications through traditional methods, only automated communications, or neither type of communication.

Where applicable, you also have the rights set out in Articles 16–21 of the GDPR (right to rectification, right to erasure, right to restriction of processing, right to data portability and right to object), as well as the right to lodge a complaint with the competent Data Protection Authority.

 

9. How to Exercise Your Rights

You may exercise your rights at any time by sending:

• a registered letter with acknowledgement of receipt to: Italiana Hotels & Resort s.r.l., with registered office at Via urchia No. 12 – Florence (FI);

• an e-mail to: info@italiana-hotels.com.

10. Minors

The Data Controller’s Services are not intended for persons under 18 years of age, and the Data Controller does not knowingly collect personal information relating to minors.

Should information relating to minors be inadvertently recorded, the Data Controller will promptly delete it upon request by the users concerned.

 

11. Data Controller, Data Processors and Authorised Persons

The Data Controller is Italiana Hotels & Resort s.r.l.

The updated list of Data Processors and persons authorised to process data is kept at the registered office of the Data Controller.

 

12. Amendments to this Privacy Policy

This Privacy Policy may be amended from time to time. You are therefore advised to check this Privacy Policy regularly and refer to the most up-to-date version.