Privacy Policy

The protection of the privacy of the Users of our website is an absolute priority for us.

CA.PRI S.R.L., pursuant to articles 13 and 14 of EU Regulation 2016/679 (so-called “GDPR” – General Data Protection Regulation), wishes to inform you pursuant to article 13 of EU Regulation 2016/679 (hereinafter “GDPR” or “Regulation”) and D. Lgs. 196/2003 (Privacy Code), as amended by D. Lgs. 101/2018 and subsequent amendments, regarding the purposes and methods by which it will process the personal data (hereinafter “Data”) of users who visit the following websites:

https://laquacollection.it
https://laquacountryside.it
https://laquabythesea.it
https://laquabythelake.it
https://villacrespi.it

NOTE: These privacy notices are provided solely for the above-mentioned websites and not for other websites that may be accessible to the user through links.

By connecting to the website and, possibly, providing your own data or expressing consent to their processing (when required for specific purposes), the User declares that they are over 16 years of age.

A) SUBJECTS INVOLVED IN DATA PROCESSING

The Data Controller is CA.PRI S.R.L., Tax Code 01938520036, with registered office at VIA GIUSEPPE FAVA 18, 28016 – Orta San Giulio (NO), Italy, tel.: +39 0322 911902, PEC: caprisrlorta@legalmail.it.

Studio Bagaini e Rillo – Viale Marazza 4, 28021 Borgomanero (NO) VAT 01699250039, the company New Sistem s.r.l. – Viale Marazza 4, 28021 Borgomanero (NO) VAT 01622410031, represented by Maria Silvana Rillo, Tax Code RLLMSL61C46H632Y, is appointed by the Controller as Data Protection Officer (DPO) for CA.PRI S.R.L.

Joint Controller of Data Processing: Cannavacciuolo Consulting s.r.l. (Unipersonal company) with registered office at Viale Marazza 4, 28021 Borgomanero (NO) pec: cannavacciuoloconsultingsrl@legalmail.it

The complete and updated list of Data Processors is available at the Controller’s registered office.

For information and management of rights, the interested party may also write to: privacy@cannavacciuologroup.it

B) PERSONAL DATA SUBJECT TO PROCESSING

Through our website, the following personal data of Users may be collected and processed by the Controller (as well as by any Processors):

Common personal data of the User, suitable to allow their identification and the contractualization of any requested services/products: name and surname, email address, telephone number, tax data (where necessary for issuing an invoice), additional identifying data whose transmission to the competent Police Headquarters is mandatory pursuant to article 109 R.D. no. 773/1931 (Consolidated Law on Public Security) and article 2 of the Technical Annex to D.M. 076.01.2013, as well as any additional personal data voluntarily provided by the User for assistance and information.

Data relating to the payment method will not be processed by the Controller but only by the authorized provider through specific and secure protocols (see the privacy policy of the selected provider).

For the purposes of booking, special categories of data may be collected: data concerning health, relating to allergies or food intolerances, as well as additional data connected to particular dietary regimes followed by the User.

C) PURPOSES, LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF PROCESSING

The purposes for which the data mentioned in the previous section are processed by the Controller are as follows:

Management of reservation requests at the Restaurant;
Management of reservation requests at the Hotel;
Compliance with obligations imposed by current legislation (accounting, fiscal, etc.);
Compliance with obligations imposed by current legislation regarding the identification of guests at accommodation facilities and the reporting of names to the competent police headquarters pursuant to article 109 R.D. no. 773/1931 (Consolidated Law on Public Security) and the legislation referenced therein;
Sending newsletters containing commercial proposals related to the Controller’s activities;
Management of website statistics based on non-anonymized data.

Legal Bases for data processing operations:

For purposes 1 and 2, the legal basis is the performance of a contract to which the User is a party or the performance of pre-contractual measures adopted at the User’s request, pursuant to article 6, paragraph 1, letter b) GDPR; for the same purposes, the legal basis for processing any special categories of data is the free, specific, informed and unambiguous consent of the User, pursuant to article 6, paragraph 1, letter a) GDPR.

For purposes 3 and 4, the legal basis is compliance with a legal obligation to which the Controller is subject in accordance with current legislation, pursuant to article 6, paragraph 1, letter c) GDPR.

For purposes 5 and 6, the legal basis is the free, specific (i.e., relating to a single purpose), informed and unambiguous consent expressed by the User, pursuant to article 6, paragraph 1, letter a) GDPR.

For purposes 1 and 2, the User has the contractual obligation to provide the data: in the absence thereof, the Controller will not be able to enter into or execute the contract with the User, providing the requested service or performance.

For purposes 3 and 4, the User has the legal obligation to provide the data: in the absence thereof, the Controller will not be able to comply with the obligations imposed upon it by current legislation and the User will not be able to enjoy the requested service or performance.

For purposes 5 and 6, the provision of data is optional: in the absence thereof, depending on the purpose, the User will not be able to receive newsletters and the Controller will not be able to collect statistics based on non-anonymized data.

D) RECIPIENTS

The data processed through this website, and exclusively for the purposes indicated above, may be communicated to external subjects (external collaborators, suppliers, etc.) appointed as Processors.

For the purpose indicated in point 4, data is also communicated to the bodies identified by current legislation (Police Headquarters competent by territory and Ministry of the Interior – Department of Public Security).

E) TRANSFERS

Data transfers to third countries that do not comply with the conditions provided for in articles 45 et seq. – in particular article 46 – of the GDPR will never be carried out.

F) DATA RETENTION

Personal data collected or otherwise processed through this website will be processed in compliance with the principles set forth in article 5 GDPR (lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability) through paper or electronic methods, exclusively for the pursuit of the purposes indicated above.

Personal data will be retained for a period of time not exceeding that strictly necessary to achieve the stated purposes, unless further retention is required by current legislation or permitted by the Controller’s legitimate interest or for proven legal reasons.

In particular:

For purposes 1 and 2, data will be retained for the time necessary to execute the contract, as well as – on the basis of the Controller’s legitimate interest in possible legal defense – until the expiration of the limitation periods for any actions based on the contract.
For purposes 3 and 4, data will be retained for the time provided by current legislation (e.g., accounting records, invoices, received and sent letters and telegrams must be retained for 10 years pursuant to article 2220 of the Civil Code).
For purposes 5 and 6, data will be retained until the achievement of the individual purpose or, if earlier, until the User revokes their consent.

Once the retention period has expired, personal data will be deleted or radically anonymized, so as to prevent any re-identification of the User. The computer systems used for managing the collected data are configured, from the outset, to minimize data use when it is not strictly necessary to achieve the purpose being pursued.

G) YOUR RIGHTS

The Controller informs the User regarding the rights recognized to them by articles 13, paragraph 2, letters b) and d), 15, 16, 17, 18, 19 and 21 GDPR, namely the rights to: access to data (article 15 GDPR); rectification (article 16 GDPR); erasure (article 17 GDPR); restriction of data processing (article 18 GDPR); data portability (article 20 GDPR); opposition to processing (article 21 GDPR); withdrawal at any time of any consent previously given (article 13, paragraph II, letter c GDPR).

Requests may be addressed to the “SUBJECTS INVOLVED IN DATA PROCESSING”, by sending a registered letter with return receipt to the registered office of the Data Controller (or to the Joint Controller or DPO) or by email to: privacy@cannavacciuologroup.it