Privacy policy

INFORMATION PURSUANT TO ART. 13 of EU Regulation n. 2016/679

Dear Customer, pursuant to art. 13 of EU Regulation n. 2016/679 (for brevity, in the following also only “GDPR”), bearing provisions to protect people and other subjects in the processing of personal data, we inform you that the personal data you provide will be processed in compliance with the GDPR regulation and the obligations of confidentiality, as set out in the present information.

1. Data controller, data treatment purpose and duration.
The data controller is Villa Vitali Srl, based in Bellagio, via Privata Belvedere 1. The treatment is finalized exclusively to the correct and complete execution of the contract and, in particular, to the use of the room rental service / short-term touristic rental managed by Villa Vitali srl. In particular, data will be processed for the purposes of guest registration, apartment booking and cost accounting. Data retention will last be for the duration of the contract and for additional five years.

2. Mode, purpose and legal basis of data processing.
Pursuant to this information and the GDPR, per treatment must be intended (for illustrative and non exhaustive purpose): collection, registration, organization, conservation, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data. The legal basis concerning the execution of the contract does not requires a specific consent and allows the holder of personal data to treat them on the basis of contractual obligations. The treatment can be carried out in automated and / or manual form, in compliance with art. 32 of the GDPR 2016/679 regarding security measures, by specific subjects appointees in compliance with the provisions of art. 29 GDPR 2016/679. Please note that, in compliance with the principles of lawfulness, purpose limitation and minimization of data, pursuant to art. 5 GDPR 2016/679, subject to your free and explicit consent expressed at the bottom of the present information, your personal data will be stored for the time necessary for the attainment of the purposes for which they are collected and processed.

3. Provision and refusal to provide data.
The provision of personal data is strictly necessary to the purpose of carrying out the activities referred to in section 1. Any refusal by the interested party to provide personal data in the case referred to in section 3, makes it impossible to carry out the activities referred to in section 1.

4. Data communication.
The data collected pursuant to this information will never be disclosed and will not be communicated to third parties without your explicit consent, except for the collaborators, also external, and, in general, to all those subjects which communication is necessary for the correct fulfillment of the purposes indicated in section 1. Personal data may, therefore, be communicated to persons in charge of the processing for purposes referred to in section 1, to external collaborators, and, in general, to all those subjects whose communication is necessary for the correct ulfillment of the purposes indicated in section 1, among which – only by way of example:
– banks, for the management of receipts and payments;
– financial administrations or public institutions in compliance with regulatory obligations;
– companies and law firms for the protection of contractual rights;
– clients and / or contractors within the scope of the contract / subcontract (also to fulfill to the charges deriving from the joint and several liability of art. 29 of Legislative Decree no. 276/2003)

5. Disclosure of data.
Personal data are not subject to disclosure.

6. Data transfer abroad.
Personal data will not be transferred to countries of the European Union in the context of the purposes referred to in section 1.

7. Rights of the interested party.
The GDPR, in particular the articles from 15 to 22 of the EU Regulation n. 2016/679, confers to the interested party the exercise of specific rights, including the right to obtain from the holder confirmation of the existence of his own personal data and to have them available in an intelligible form; the interested party has the right to know the origin of the data, the purpose and methods of the treatment, the logic applied to the treatment, the identification details of the owner and the subjects to whom the data can be communicated; the interested party also has the right to get the update and the data portability, i.e. receive them from a data controller in a format commonly used and readable by automatic devices, and to transmit them to another data controller without hindering; to the correction and integration of data and to the cancellation, to oppose at any time the data processing, also in the case of processing for direct marketing purposes, to oppose an automated decision-making process relating to people, including profiling, to ask the data controller to access personal data and correct or cancel them or to limit the processing that concerns them or to oppose to their processing, in addition to the right to data portability, to revoke the consent at any time without prejudice to lawfulness of the treatment based on a previous consent, to make a complaint to a supervisory authority, to the transformation into anonymous form or the stop of data processing in violation of the law. The owner has the right to object, for legitimate reasons, to the processing of data. In relation to the data subject of the processing referred to in present information, to the interested party are, therefore, recognized at any time the following rights, reported here shortly:
– Access (Article 15 EU Regulation No. 2016/679);
– Adjustment (Article 16 EU Regulation No. 2016/679);
– Cancellation (Article 17 EU Regulation No. 2016/679);
– Limitation (Article 18 EU Regulation No. 2016/679);
– Portability, understood as the right to obtain from the holder of the processing data in a structured format commonly used e readable by automatic device to transmit them to a other data controller without impediment (art. 20 EU Regulation n. 2016/67)
– Opposition to processing (article 21 EU regulation no. 2016/679);
– Revocation of consent to treatment, without prejudice to the lawfulness of the treatment based on the consent acquired before of revocation (Article 7, paragraph 3 of EU Regulation No. 2016/679);
– Make a complaint to the Authority for the Protection of personal data (Article 51 EU Regulation No. 2016/679).

8. Procedures for exercising the rights connected to the GDPR
You can exercise your rights with a written request sent to Villa Vitali srl, at the postal address of the registered office or to the email address info@villavitali.it.