We inform you,
pursuant to Article 13 of the GDPR no. 2016/679 (hereinafter, ‘GDPR’), that in the event of the collection of personal data concerning you, such processing will be based on the principles of correctness, lawfulness, transparency and protection of your privacy and rights;
a) our organisation, as a legal entity, plays the dual role of data controller and data processor;
(b) the data controller and the data processor (see last page for contact details); having made the appropriate assessments internally, have not designated a data protection officer, since, pursuant to Article 37(1) of GDPR No. 2016/679, this is not part of the obligation.

Your data will be processed
c/i) pursuant to Art. 6 letter b) and c) , for purposes relating to the performance of a contract or the execution of pre-contractual measures and to fulfil legal obligations to which the data controller is subject; for example, data processing necessary for the management of requests, quotations and bookings, the fulfilment of all contractual, accounting and tax obligations, the management of payments also by credit cards, POS and evolved online services managed by the respective credit institutions or agencies and the management of disputes; in addition, for all the obligations provided for by law; for example, regulations, community and local regulations or by orders of the authorities, registration and communication of data to the authorities and management of any litigation; in addition, for the pursuit of the legitimate interests of the data controller or third parties under the conditions provided for by the GDPR;
c/ii) pursuant to art. 7, subject to your freely expressed consent, for other service and marketing purposes; for example; processing of data necessary for sending promotional offers on our services and other events, tariff updates, other quotations made as well as greetings and holiday communications; to carry out additional services such as external communication of data relating to your stay for the exclusive purpose of enabling the function of receiving items, messages and telephone calls addressed to you
for the processing of special categories of personal data in order to offer you a better level of hospitality; for example, food intolerances, allergies or other special data;
for the processing of advanced online services; for example, subscribing to our management programme to use your email address to send your bill, receipt or invoice, to manage loyalty scores and other similar services;
c/iii) pursuant to Art. 7, subject to your freely expressed consent, for further purposes; for example; processing of data necessary to LOGIN to our public WIFI/LAN network to surf the Internet ;
as well as data processing necessary during the use of our institutional website whose transmission is implicit in the use of internet communication protocols, such data are not collected to be associated with identified interests, but by their very nature could, through processing and association with data held by third parties, allow users to be identified; for example, this category of data includes IP addresses or the names of the devices used by users who connect to the site, the URI notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server’s response and other parameters relating to the user’s operating system and information environment;
the aforementioned data may be used for the sole purpose of obtaining anonymous statistical information on the use of the public WIFI/LAN network and the institutional site; for example, to check the proper functioning of our IT infrastructure and improve the service;
likewise, the data could be used by the competent authorities, for example, to ascertain liability in the event of hypothetical computer crimes or damage to our WIFI/LAN network, our IT system and our institutional website.
d) pursuant to Art. 6 para. 1 letter f), taking into account the reasonable expectations of the parties, for purposes of legitimate interests pursued by the data controller or third parties; for example; data for fraud prevention purposes (attendance monitoring, entry register, biometric data, video surveillance images …) and direct marketing purposes.

The recipients and categories of the recipients of your data are
e) natural or legal persons, public authorities, collaborators such as employees, professionals, service providers bodies and associations.
Your personal data may be transferred to a third country or international organisation
f) by reason of the foregoing, your data is not only processed in paper format in our organisation’s internal archives or with third parties; it is also processed and stored in electronic format on our internal storage facilities or within the European Union through hosting, server and cloud services. It is in any case understood that the data controller, should it become necessary, will be entitled to move the hosting, server and cloud services also to areas outside the EU; likewise, the data controller assures as of now that the transfer of data to areas outside the EU will take place in compliance with the applicable legal provisions, subject to the stipulation of the standard contractual clauses provided for by the European Commission.

The processing of your data is fair and transparent, carried out by means of the operations of collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data. Your personal data are subject to both paper and electronic and/or automated processing. They may also be processed, solely for the purposes referred to in c/i , c/ii , c/iii and d above, by employees and collaborators of the Data Controller or other entities based in Italy and in other European countries, by third party companies or other entities; for example, by way of example, credit institutions, professional firms, insurance companies for the provision of insurance services, IT and telephone service providers or other entities that provide services/products on behalf of the Data Controller, in their capacity as external data processors.
If personal data are not obtained from the data subject, the data controller will, in application of Article 14 of the GDPR, provide you with any specific circumstances within one month; otherwise, this information applies to you.

The storage period of your data is defined
a) to the time necessary to fulfil the above-mentioned purposes and in any case for no longer than 10 years from the termination of the relationship for the purposes referred to in points c/i above and for no longer than 2 years from the collection of the data for the purposes referred to in points c/ii, c/iii and d above. As data subject, by sending a registered letter or email to the data controller, you may assert the following rights
b) the right of access, referred to in Article 15 of the GDPR, to obtain confirmation as to whether or not personal data concerning you are being processed and if so, to obtain access to the personal data and information; in the event of a request for further copies of data, the controller and data processor reserves the right to charge you a reasonable fee based on administrative costs; the right of rectification, referred to in Article 16 of the GDPR, to obtain rectification of inaccurate personal data concerning you without undue delay
the right to erasure, referred to in Article 17 of the GDPR, to obtain the deletion of personal data concerning you without undue delay;
right to restriction of processing , referred to in Art. 18 of the GDPR, to obtain the restriction of processing; right to data portability , referred to in Art. 20 of the GDPR, to receive in a structured format personal data concerning you provided to a data controller and to transmit such data to another data controller without hindrance; right to object , referred to in Art. 21 of the GDPR, to object at any time to the processing of personal data concerning you pursuant to Art. 6 , para. 1(e) or (f), including profiling on the basis of these provisions. c) the right to withdraw consent, for the cases provided for in the GDPR, at any time without affecting the lawfulness of the processing based on the consent given prior to the revocation;
d) The right to lodge a complaint with a supervisory authority, in ITALY Garante della Privacy PIAZZA DI MONTE CITORIO n. 121 00186 ROMA mail garante@gpdp.it
e) Nature of the provision of data and consequences of refusal to reply
The provision of data for the purposes set out in point c/i above is compulsory, likewise, in view of the legitimate purposes pursued as set out in point d above, the provision of data must be consented to; in their absence, our organisation cannot guarantee the provision of services and the fulfilment of your expectations. Without the need for express consent, the processing of such data may be carried out by the Authorities, by insurance companies for the provision of insurance services, by professional firms also for the management of litigation
as well as to those subjects to whom communication is obligatory by law for the fulfilment of the aforementioned purposes. These subjects will process the data in their capacity as autonomous data controllers. Your data will not be disseminated. On the other hand, the provision of data for the purposes referred to in c/ii and c/iii above is optional. Taking into account the reasonable expectations of the parties for the purposes. You may therefore decide not to provide any data or to subsequently refuse to process data already provided: in this case, you will not be able to receive newsletters, commercial communications and advertising material relating to the services offered and make use of the internet connections via our public WIFI/LAN network as well as a series of advanced services on our institutional website. You will, however, continue to be entitled to the services referred to above c/s
f) It is your right not to be subject to a decision based solely on automated processing
referred to in c/ii and c/iii above, including profiling which produces legal effects concerning you or which affects you in a similar significant way. Therefore, the data subject may decide to receive only communications by traditional means or only automated communications or neither.

date 25/05/2018
Data Controller
PTS di Pasqual Tiziano e Pasqual Simone snc Via Altinate, 67 – 30016 Jesolo VE P.IVA. 04599320274.

info@hotelaltinate.it – Tel/Fax +39 0421.362380