Notice for Hotel Guests

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679 – HOTEL GUESTS

Pursuant to the applicable legislation on the protection of personal data (EU Regulation No. 679 of 2016), we wish to inform you that the processing of your personal data is carried out fairly and transparently, for lawful purposes and safeguarding your privacy and your rights.

Processing is also carried out with the aid of electronic means for the following purposes:

• Personal data of a common nature (identification and contact data: first name, surname, e-mail, telephone number, address, tax code, VAT number, date and place of birth), booking information, requested services, any illnesses, intolerances, health status in the case of services requiring such information, and payment data: for acquiring and confirming your booking of accommodation services and ancillary services, and for providing the requested services. As these processing activities are necessary for the establishment of the contractual agreement and its subsequent execution, your consent is not required, except where special categories of data, so-called sensitive data, are provided. The provision of data is mandatory. In the event of refusal to provide personal data, we will not be able to confirm the booking or provide the requested services. Processes relating to your stay will cease upon your departure; however, some of your personal data may or must continue to be processed for the purposes and in the manner indicated in the following points due to legal obligations and/or with your consent. Such data may be disclosed to external companies/external professionals cooperating with the company in carrying out these activities, credit institutions, and companies managing the company’s IT services.
• Personal identification data and identity documents: to comply with the obligation established by the “Consolidated Law on Public Security” (Article 109 of Royal Decree No. 773 of 18 June 1931), which requires us to communicate the personal details of accommodated guests to the Police Headquarters for public security purposes, according to the procedures established by the Ministry of the Interior (Decree of 7 January 2013). The provision of data is mandatory and does not require your consent; if you refuse to provide such data, we will not be able to accommodate you at our establishment. The data acquired for this purpose are not retained by us unless you provide consent for their retention as provided in point 4.
• Identification, administrative, fiscal and payment data: to comply with current administrative, accounting and tax obligations. For these purposes, processing is carried out without the need to obtain your consent. The data are processed by us and by our authorized personnel and are disclosed externally only in compliance with legal obligations, to external companies/external professionals cooperating with the company in carrying out such activities, public bodies and authorities, and institutions. The provision of data is mandatory. In the event of refusal to provide the data necessary for the above-mentioned obligations, we will not be able to provide the requested services. The data acquired for these purposes are retained by us for the period established by the relevant legislation (10 years, and longer in the event of tax assessments).
• Contact data for sending you promotional messages and updates regarding rates, events and offers available at the establishments of the Data Controller. For this purpose, subject to obtaining your consent, your data will be retained for a maximum period of 24 months and will be disclosed only to external companies/consultants cooperating in the sending of such promotional messages or managing the related IT platforms. You may withdraw your consent at any time as indicated below. The provision of data is optional. In the event of refusal to provide the data, we will not be able to provide you with the requested services.
• Video surveillance images: for the protection of persons, property and company assets through a video surveillance system covering certain areas of the premises, identified by the presence of appropriate signage. Your consent is not required for this processing, as it pursues our legitimate interest in protecting persons and property against possible assaults, thefts, robberies, damage, acts of vandalism, and for fire prevention and workplace safety purposes. Recorded images are deleted after 24/48 hours, except during public holidays or other periods when the business is closed, and in any case no later than one week. They are not disclosed to third parties, except to Group companies or external companies responsible for technical recording and data hosting activities, and where it is necessary to comply with a specific investigative request from judicial authorities or law enforcement authorities or for the legitimate exercise of the rights of the data subjects.

Processing activities are carried out within the European Union. In the event of any transfer of data to third countries, the Company shall adopt all necessary measures required by Articles 44 et seq. of the GDPR.

We would also like to inform you that the European Regulation grants you certain rights, including the right to access and rectify your data, as well as the right to erasure, restriction of processing, objection to processing, and the right to data portability, where applicable (Articles 15 to 22 of EU Regulation No. 679 of 2016). You may also lodge a complaint with the supervisory authority, according to the procedures established by the applicable legislation (www.garanteprivacy.it).

For any further information, including information regarding Data Processors, and to exercise the rights granted to you under the European Regulation, you may contact the Data Controller:

PH HOTEL S.R.L., VAT No. IT03021560218, Via Monte Tondo 4, 39100 Bolzano (BZ), Italy.

E-mail: privacy@phhotel.it - Tel.: +39 04711800161