Privacy Policy

CA.PRI S.R.L., as the data controller in accordance with articles 13 and 14 of the EU Regulation 679/2016 – General Data Protection Regulation (GDPR), and in compliance with the obligations set by the legislator to protect privacy, hereby wishes to inform you in advance, both regarding the use of your personal data and your rights, by providing the following information:

A) DATA CONTROLLER AND OTHER RESPONSIBLE PARTIES The data controller is CA.PRI S.R.L., VAT number 01938520036, with registered office at VIA GIUSEPPE FAVA 18 – 28016 – Orta San Giulio (NO) – Italy. The updated list of data processors, along with their respective areas of responsibility, is as follows:

Data Controller – CA.PRI S.R.L. Data Protection Officer – CANNAVACCIUOLO ANTONINO

B) PERSONAL DATA SUBJECT TO PROCESSING Non-sensitive personal data – The processing of data for the purpose of confirming a reservation for accommodation, catering, and/or ancillary services (art. 109 R.D. 18.6.1931 n.773) will cease upon the guest’s departure. Non-sensitive personal data (identifying, accounting, financial, commercial, promotional, etc.) – The processing of data will take place for 10 years.

C) PURPOSE, LEGAL BASIS, AND MANDATORY OR OPTIONAL NATURE OF PROCESSING The source of the data referred to in point B is: Data provided by the data subject.

Main Purpose: Customer/guest data is processed for the following purposes: restaurant service – room reservation – administrative/accounting services.

Legal Basis: The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the request of the data subject.

The data subject is obliged to provide personal data.

Possible consequences of not providing personal data: Prevention of the completion of the contract or the provision of the requested service to the data subject.

Secondary Purpose: Customer/guest data will be processed for commercial and promotional purposes only with your consent.

Legal Basis: The processing takes place following the written consent of the data subject, who has the option to give or withhold consent.

D) RECIPIENTS Exclusively for the aforementioned purposes, the data will be made known, in addition to the internal personnel competent in this regard, to external collaborators responsible for their processing, whose list is available at the controller’s office.

E) TRANSFERS No transfers of Personal Data to recipients outside the European Union are made.

F) DATA RETENTION All personal data provided will be processed in compliance with the principles of lawfulness, fairness, relevance, and proportionality, only with the necessary methods, including IT and telematic means, to pursue the above-mentioned purposes. In any case, personal data will be kept for a period not exceeding the time strictly necessary to achieve the indicated purposes. Personal data that does not require storage or for which storage is not provided for by the current legislation, with regard to the indicated purposes, will be deleted or transformed into anonymous form. It should be noted that the information systems used for the management of the collected information are configured, from the outset, to minimize the use of data.

G) YOUR RIGHTS Please note that the data subject has the right to access the data concerning them at any time, by addressing their request to our designated data protection officer for a response, by sending a registered letter with return receipt to the following address:

Data Protection Officer – CANNAVACCIUOLO ANTONINO – VIA GIUSEPPE FAVA 18 – 28016 – Orta San Giulio (NO) – Italy

The aforementioned registered letter can also be sent in advance via email to privacy@villacrespi.it.

Likewise, regarding the processing in question, you have the following rights: Information, Access to data, Rectification of data, Erasure of data, Restriction of processing, Data portability, Lodge a complaint with a supervisory authority, Withdrawal of consent (The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal).