INFORMATION NOTICE PURSUANT TO ART. 13 OF EU REGULATION N. 679/2016 RELATING TO DATA PROCESSING FOR ONLINE RESERVATIONS
LAST UPDATED: August 2020
We hereby provide you with information regarding the processing of your personal data which will be carried out by Hotel La di Moret Srl with registered offices in Udine, Viale Tricesimo N. 276, VAT No. 01199460302 (hereinafter simply the “Company”), in relation to the booking of hotel services offered by the same (the “Hotel Services”).
The categories of personal data to be processed are listed below:
1. The personal data that Hotel La di Moret Srl collects is identification data such as: name, surname, residence/address, email, tax code and/or VAT number, type of room, any third parties with whom the stay will be shared (hereinafter the “Data”).
2. The processing of the above-mentioned Data, by the Company Hotel La di Moret Srl, could concern – upon your explicit consent – also data related to your health ex Art. 9 GDPR (e.g. physical handicap, for which a particular type of room is requested at the time of booking). In these cases, we guarantee that the processing will be limited to the data and operations that are indispensable for fulfilling the obligations, including pre-contractual obligations, relating to the provision of Hotel Services, within the limits of the services you requested when making your reservation or during your stay at our hotel.
a) Identity and contact details of the Data Controller: The Data Controller of the personal data communicated by you at the hotel and during your stay at the same is the Company Hotel La di Moret Srl whose treatment is governed by this Information Notice.
b) The contact details of the Data Protection Officer: The Data Controller is not covered by the provisions of Articles 37 to 39 GDPR which provide for the mandatory appointment of a Data Protection Officer. c) Purpose and legal basis of the processing:
c) Purposes and legal basis: c.1) The Data to be processed includes the identification data required to make the online reservation at the Hotel and is processed for the correct fulfilment of the obligations relating to the reservation by the user/client.
c.2) The processing of the user’s/client’s personal data by Hotel La di Moret Srl may also concern – subject to your express consent – data relating to your health as per Art. 9 GDPR (e.g. physical disability, or other condition for which you require suitable services such as the request – during the booking process – of a particular type of room).
Please note that the provision of data for the above purposes is necessary in order to process your online booking request; there is an obligation to provide such data in order to achieve the above purposes and failure to provide such data, or the provision of partial or incorrect data, may make it impossible to provide the Hotel Services requested and therefore make it impossible to accommodate you at our accommodation facility.
With regard to the Data referred to under letter c.1) the legal basis on which the legitimacy of the data processing is based is the performance of a contract to which the data subject is a party or the implementation of pre-contractual measures taken at the request of the same ex Art. 6 paragraph 1, letter b)
With regard to the Data referred to in letter c.2) the legal basis on which the legitimacy of the processing of the said special data pursuant to Art. 9 – processed for the sole purpose of providing the services offered by the Hotel – is also based on the express consent of the Data Subject pursuant to Art. 9 paragraph 2 lett. a) which is requested by means of a flag when booking the specific room type.
d) Indication of the legitimate interests pursued by the controller or by third parties if the processing is based on Art. 6 paragraph 1 letter f): No legitimate interests of the Data Controller are pursued in connection with this processing (online booking).
e) Recipients or categories of recipients of personal data: The data subject’s data may be made accessible for the purposes referred to in letter c) above and may be communicated exclusively to employees and contractors of the Data Controller in their capacity as delegated data processors; to subjects who provide services for the management of the computer system and telecommunications networks of the Company Hotel La di Moret Srl and/or system administrators; lawyers and consultants of the Company or other subjects who provide services connected to the Hotel. The Data is processed manually and electronically by the Company’s staff and contractors and/or by external parties duly designated by contract as Data Processors and Persons in Charge of Processing. The processing is carried out using tools that guarantee the security and confidentiality of the data and, in particular, using manual, automated, computerised and electronic tools to manage, store and transmit the data in compliance with the regulations in force.
A full list of the Data Processors is available on request, which may be sent to the contact details listed below. The Data communicated will not be disseminated under any circumstances.
f) Transfer of data abroad: Within the scope of the aforementioned processing, no transfer abroad is envisaged. Personal data is, however, stored on servers located in Italy and within the European Union. It is understood that if necessary, the Data Controller may also move the servers outside the EU. In this case, the Data Controller hereby ensures that the transfer of data outside the EU will take place in accordance with the applicable legal provisions, subject to the conclusion of the standard contractual clauses provided for by the European Commission.
2. In addition to the information referred to in paragraph 1, at the time when the personal data is obtained, the Controller shall provide the Data Subject with the following further information necessary to ensure fair and transparent processing:
a) Period of storage or criteria used to establish the period: The data is stored for the time necessary to achieve the purposes for which it was collected and processed and in particular to execute the contract following the online booking. The data pursuant to Art. 9 (any data relating to your state of health, provided only after your express consent) will be deleted at the end of the provision of the service at the Hotel. Additional purposes pursued by the Data Controller will be fully disclosed upon your arrival at the Hotel.
b) Right of access to personal data, rectification, cancellation, portability of the same, limitation or opposition to processing by the Data Subject: The Data Subject may exercise the rights set out in Articles 15 to 22 of the GDPR; in particular, the right of access (art. 15) allows the Data Subject to obtain confirmation as to whether or not data is being processed and, if so, to access the same; the right of rectification and integration (art. The right to deletion/forgetting (art. 17) allows the data subject to request and obtain the deletion of his/her personal data in at least one of the following cases: 1) the necessity of the processing for the original purposes no longer exists; 2) revocation of consent; 3) opposition to the processing; 4) unlawfulness of the processing; the right to restriction (art. 18) is granted to the Data Subject in case of dispute as to the accuracy of the data for the entire period necessary to verify its accuracy; or if the processing is unlawful and the Data Subject decides not to object but to exercise the right to restriction; the right to data portability (art. The right to data portability (art. 20) allows the data subject to receive personal data concerning him/her in a structured, commonly used and machine-readable format and to have it transmitted to another data controller indicated by the data subject. 21) provides for the data subject’s right to object at any time to the processing of data relating to him or her when the legal basis for lawful processing ceases to exist; the right not to be subjected to automated decision-making processes (profiling) (Art. 22) which are likely to produce legal effects capable of significantly affecting the individual, except where such a decision is necessary for the conclusion or performance of a contract; or is authorised by the EU or is based on the data subject’s explicit consent.
c) Right to withdraw consent to data processing: The processing of data as indicated in point c.1. of this Policy is carried out without the consent of the Data Subject. The legal basis for processing is the performance of a contract to which the data subject is party or the implementation of pre-contractual measures taken at the request of the data subject ex Art. 6 paragraph 1, letter b). The processing of data as indicated in point c.2. of this Information Notice is carried out following the express consent of the interested party, who may revoke such consent at any time by sending an email to: firstname.lastname@example.org.
d) Right to lodge a complaint: The Data Subject shall have the right to lodge a complaint with the Supervisory Authority against the processing of data relating to him or her, if it does not comply with the GDPR.
e) Nature of the provision of data and consequences of refusal to provide data: The provision of data and its processing are compulsory in relation to the purposes relating to the fulfilment of contractual and legal obligations for the performance of all activities in the execution of contractual obligations. We refer to the above.
f) Processing pursuant to Art. 22 paragraph1 and 4 (automated decision-making process), logic used and consequences for the data subject: in implementing the processing purposes set out herein, the Data Controller does not carry out automated decision-making processes pursuant to Art. 22 paragraphs 1 and 4.
PLACE AND DATE Contact details You may contact Hotel La di Moret Srl to exercise the rights listed above by writing to the following email address: email@example.com or firstname.lastname@example.org or by sending a registered letter with return receipt to the following address: Hotel La di Moret Srl, with registered office in Udine, Viale Tricesimo N. 276.