eng
Website users
The following describes how the service www.lentischihotel.com is managed, whose data controller is ITS3 Srl. This notice is provided pursuant to Article 13 of Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 concerning the protection of individuals with regard to the processing of personal data. This notice applies only to the Lentischi Hotel website and not to any other websites that the user may visit via links.
Browsing this website may result in the processing of data relating to identified or identifiable individuals.
Data Controller: Lentischi Hotel – Via degli Asparagi 35 - 09049 - Villasimius - email: [email protected], Company name: ITS3 Srl, with registered office at Via degli Asparagi 35 - 09049 - Villasimius (SU).
Location of data processing and recipients
Processing activities connected with Lentischi Hotel's web services are carried out on the Register.it (team.blue) server farm, with servers located exclusively in Europe. These entities are sub-processors of Blastness S.p.A., with registered office in Milan, Piazza Castello no. 26 – 20121, which performs website maintenance and management operations.
Browsing data
The software applications responsible for the operation of the Lentischi Hotel website acquire certain personal data transmitted through secure protocols. This information is not collected in order to be associated with identified data subjects, but through processing and association with data held by third parties it could make it possible to identify users. This category includes IP addresses, browser identifier (user agent), URI (Uniform Resource Identifier) addresses of requested resources, time of the request, method used to submit the request to the server, numerical code indicating the status of the response provided by the server (e.g. successful, error), and other parameters relating to the user's operating system and IT environment. This data is used solely to obtain anonymous statistical information on website use and to check its correct functioning.
Data voluntarily provided by the user
To access certain services provided through the Lentischi Hotel website, users may be asked to voluntarily and optionally enter certain identifying data (email address, name, contact details and information necessary to provide the requested service).
Provision of the service
Personal data provided by users who make use of the services provided by Lentischi Hotel (e.g. by browsing the website or completing forms for various requests) is used solely to perform the requested service or provide the requested service. The legal basis for processing is the performance of pre-contractual measures in order to respond to your requests.
Further communications following a stay
Following the purchase of a stay, Lentischi Hotel may send the user further communications, including commercial communications relating to its services. The legal basis for the processing described above is the legitimate interest of the data controller (Recital 47 GDPR).
Direct marketing
Where specific consent has been given (by subscribing to the newsletter), Lentischi Hotel may send information by email about new products, promotions and special offers. Users may disable the service at any time through the relevant procedure and/or the methods subsequently indicated for exercising their rights. The legal basis for the processing described above is the data subject's consent. Specific summary notices, where necessary, may from time to time be provided or displayed on website pages prepared for particular additional services requested by the user.
The data retention period is the period necessary for the purposes arising from the requested services and for a further period of 36 months. If the requested information is subject to an online transaction, such data may be retained for accounting and tax reporting purposes for a period of 10 years. With regard to technical data managed by the website, such as cookies, the retention period is determined by the technical characteristics of the cookies themselves and specified in the “Site Cookies” table. The data retention period is renewed for a further 36 months each time new consent to data processing is provided and/or each time the services offered through the user's credentials are accessed (e.g. personal account login).
Except as specified for browsing data, users are free to provide Lentischi Hotel with the personal data requested in order to use the services provided through the website. Failure to provide data relating to fields marked with an asterisk (mandatory) makes it impossible to use the service offered.
Personal data is processed using IT tools designed to ensure the security and confidentiality of the data, and in any case in compliance with the appropriate security measures required by Article 32 GDPR, through secure communication protocols using SSL encryption algorithms. Your personal data will be processed in accordance with the legislative provisions referred to above and the confidentiality obligations set out therein. The Italian Data Protection Authority's provision “Guidelines on promotional activities and combating spam” of 4 July 2013 (published in the Official Gazette no. 174 of 26 July 2013), the Guidelines on the processing of personal data for online profiling of 19 March 2015, and the Guidelines on automated individual decision-making and profiling – WP251, defined under the provisions of Regulation (EU) 2016/679, are considered “good practices”.
The service provider responsible for hosting, maintenance and management of the Lentischi Hotel website is Blastness S.p.A., which guarantees GDPR compliance by implementing European data protection legislation through the adoption of Law no. 171 of 21 December 2018, with the same safeguards provided by the GDPR. Pending the launch of the procedures for an adequacy decision by the European Commission, data processing is permitted where the data subject is party to a contract or pre-contractual measures, or has given consent after being informed of the possible risks of such data transfer (Article 49 GDPR – derogations for specific situations).
Further transfers of data to non-EU countries may occur as a result of the use of Facebook, Google and other social networks or external processing providers located in the USA. Such data processing is safeguarded by the “Privacy Shield” agreements signed by the individual companies.
For the performance and support of the operation and organisation of the business, certain data may be made known or communicated to recipients. These subjects are divided into: third parties, data processors and sub-processors, and authorised personnel acting under the authority of the data controller or processor.
Third parties
Third parties are defined as natural or legal persons, public authorities, services or other bodies that are not the data subject, data controller, data processor or persons authorised to process personal data.
For data processing related to administrative and accounting purposes, legal obligations, customer management and contracts, data may be communicated to:
- Companies managing traditional or electronic postal services.
- Companies registering domain names.
- Any other parties whose communication of data is necessary to achieve the purposes indicated above, or to comply with a legal obligation;
Data processors and sub-processors
These are defined as natural or legal persons, public authorities, services or other bodies that process personal data on behalf of the data controller.
- ITS3 Srl as the primary data processor, and other sub-processors providing technological infrastructure, connectivity and hosting services: Blastness S.p.A. uses additional sub-processors for the provision of services, including Register S.p.A.
- Other IT service providers that may be necessary for service provision and may be located in the USA, with the safeguard of an “adequacy” agreement under the Privacy Shield.
Within our company
Your data will be processed solely by personnel expressly authorised by the Data Controller, with appropriate instructions, training and confidentiality agreements, and in particular by the following category of staff:
- Administration staff.
Your personal data will not be disclosed in any way.
Data subjects (the persons to whom the personal data relates) may exercise the rights provided for by the Regulation at any time through a dedicated personal area. This area can be accessed by requesting the link through the relevant procedure at the bottom of this notice. If the user has subscribed to the newsletter, another method of exercising the rights under the Regulation is available through the relevant link at the bottom of the email received. In particular, data subjects may legitimately exercise the rights set out in Articles 15 to 23, specifically: 1. Erasure of all data. 2. Rectification / modification. 3. Restriction. 4. Data portability. 5. The right to object to automated decision-making (profiling). Any further requests may be indicated in the notes field.
Where applicable, data subjects also have the right to lodge a complaint with the Italian Data Protection Authority as the supervisory authority, in accordance with the applicable procedures. For any further information, and to exercise the rights granted under European regulations, you may contact the Data Controller using the contact details provided above.
Exercise of data subjects' rights. Requests may also be submitted using the following contact details:
Data Controller: Lentischi Hotel – Via degli Asparagi 35 - 09049 - Villasimius - email: [email protected], Company name: ITS3 Srl, with registered office at Via degli Asparagi 35 - 09049 - Villasimius (SU).
The undersigned data subject, having received the information provided by the Data Controller pursuant to Articles 13–14 and the GDPR, confirms having read this privacy notice regarding the processing of data for the purposes necessary to provide the service and to allow Lentischi Hotel to manage and process the data appropriately. This notice also takes into account that the data processor used by Lentischi Hotel for website management is Blastness S.p.A., which has adopted Law 171/2018 in compliance with the GDPR, pending the launch of the procedures for an adequacy decision by the European Commission.
As evidence of your explicit and unequivocal consent, we will record the time, date, IP address and email address. Please note that you may exercise your rights at any time (as listed above) via the link at the bottom of communications received or through the contact channels.