INFORMATION ON THE PROCESSING OF PERSONAL DATA
(pursuant to EU Regulation 679/2016 and Legislative Decree 196/2003 and subsequent amendments)
Pursuant to EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 (abbreviated as GDPR) and of Legislative Decree 196/2003 and subsequent amendments concerning personal data protection, we inform you that:
The Data Controller provided by the Customer Cosmopolitan Hotels S.p.A., with registered office in Tirrenia (PI) Largo Belvedere n.26, tax code and VAT number 01924430505 (hereinafter referred to as "the Holder").
Personal data are processed in full compliance with EU Regulation 679/2016 and Legislative Decree 196/2003 and subsequent modifications and integrations
Purpose of the treatment. All data provided by the Customer (or "the Interested Party") will be used for the sole purpose of following up his requests or for the execution of a contract of which the interested party is a party and may be disclosed to third parties only in the case where this is necessary for this purpose, or with the explicit consent of the interested party.
In particular, the treatment will be performed in execution of:
1. Contractual obligations, such as the supply of goods and services to guests (ex: reservations for stays, bookings in beauty and wellness departments);
2. Legal obligations, such as invoicing, obligatory accounting records and registrations, communications to the requesting authorities;
3. Communications to banks and similar institutions, for the collection of receivables and for other activities related to contractual obligations.
For the processing of data for such purposes, the Client's consent is not necessary as the processing is necessary for the execution of a contract for which the Customer is a party or for the execution of pre-contractual measures adopted at the Customer's request (Article 6, paragraph 1 , letter b) of the Regulations), as well as, where applicable, to fulfill a legal obligation (Article 6, paragraph 1, letter a) of the Rules).
Additional purposes for which consent is required. The processing of data may also take place for the following purposes:
4) "Contact" page. The data collected by this website on the "contact" page, subject to the explicit consent of the interested party, will be used exclusively to meet your requests and will not be used for other purposes, even after your request.
5) Marketing communications. We may submit to the Customer's attention advertising material, catalogs, newsletters, direct mailing, price lists and anything else related to the activity of the Owner, as well as to keep the Customer updated on initiatives and promotional offers. Marketing communications will be sent (via e-mail or mail or telephone) only if the user has expressly consented to these operations pursuant to art. 7 of EU Regulation 679/2016.
6) Collection of candidacies and Curriculum Vitae. We may collect spontaneous applications by filling in the form on this site or by specific search and selection posts, published on websites, in local or national press, or advertised through other means of communication. information, including through the transmission (post, fax, e-mail) of personal data and professional experiences organized in the form of curriculum vitae. The collection only concerns personal data that are processed within the limits strictly relevant to the purposes indicated below.
The data subject should not, therefore, transmit sensitive or particular data, or data that, pursuant to art. 9 of the 2016/679 EU Regulation, are suitable to reveal the racial and ethnic origin, political opinions, religious or philosophical convictions, union membership, as well as data related to health or sexual life or sexual orientation of the person. The interested party must not also transmit judicial data, or data that, pursuant to art. 4 lett. e) of Legislative Decree no. 196/2003, are suitable to disclose the measures referred to in Article 3, paragraph 1, letters a) to o) and r) to u), of the D.P.R. November 14th 2002 n. 313, on the subject of criminal records, the register of administrative sanctions depending on the offense and the related pending charges, or the status of defendant or suspect under articles 60 and 61 of the criminal procedure code.
The sending to the owner of their data, if not made through the aforementioned form that provides for the release of specific consent, must take place after viewing this information on this site, according to the following formula (or equivalent formula) "According to the Regulation EU 2016/679, having read the information provided by " Cosmopolitan Hotels S.p.A.“ on the website "www.chgroup.eu", I agree that the same treats my data for the purposes and with the methods specified in the information itself ".
Treatment. The processing of data will be carried out by staff appointed by the Controller with procedures, technical and it tools to protect the confidentiality and security of Customer data and consists in their collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, dissemination, cancellation, destruction thereof including the combination of two or more of the aforementioned activities.
Strict operating procedures and appropriate technical and organizational security measures are in place to prevent any access, modification, deletion or unauthorized transmission of such personal information.
Retention period. These data will be kept for the time strictly necessary to provide the requested services to the Customer and will in any case be eliminated as a result of the Customer's request, without prejudice to further conservation obligations established by law. From the moment of termination of the contract and / or the expiry of the statutory deadlines for data retention, these will be destroyed in such a way as not to make the reconstruction of the data possible.
The criterion for determining the applicable retention period is to preserve the personal information subject of this information for the time:
necessary for its purpose;
necessary for the commercial relationship with the user;
accepted by the user;
required by law.
The data provided by the interested party, through specific consent pursuant to art. 7 of EU Regulation 679/2016, for marketing purposes will be retained for the period of 2 years, as per the Provision of the Guarantor of February 24, 2005. At the end of this period, unless renewal of consent, the data will be deleted.
The data provided by the interested party, through specific consent pursuant to art. 7 of EU Regulation 679/2016, to speed up subsequent check-ins, within the "contacts" page or related to the collection of spontaneous applications will be kept for the period of 5 years, a term deemed appropriate in relation to the purpose of said processing and of the type of structure. At the end of this period, the renewal of consent will be required, failing which the data will be deleted.
Recipients. Within the scope of its activity and for the purposes indicated above, the Data Controller may communicate the Data of the Interested party to the other companies of the Group or to the Parent Company Cosmopolitan Hotels S.p.A., for the sole purpose of managing the requests of the Data Subject.
Furthermore, the Data Controller may use services rendered by third parties that operate on behalf of the Data Controller and according to its instructions, as data controllers. These are subjects that provide the Owner with processing or instrumental services (ex. services for the operation of the platform) or in any case, provide a service that is strictly and necessarily linked to the activity of the Owner: tax consultants; public and private bodies, including in relation to inspections or audits; subjects that can access the data by law; external companies supplying goods or services. The interested party may request a complete and updated list of the persons nominated responsible for the treatment by contacting the contact indicated below.
The data of the interested party will not be disclosed.
The data may be transferred within the European Union, where the Data Controller or its suppliers are based or have their own servers. Data will not be transferred outside the European Union
Rights of the interested party. The interested party has the right, at any time, to exercise against the Data Controller:
the right of access (Article 15 GDPR); the right to request the rectification of data concerning him (Article 16 of the GDPR); the right to obtain the cancellation of their data (Article 17 of the GDPR); the right to obtain the processing limitation (Article 18 of the GDPR); the right to object to the processing (Article 21 of the GDPR) and the right to data portability (Article 20 of the GDPR).
In case of rectification or deletion or limitation of the data, the Controller will communicate any changes to the recipients to whom the data are transmitted (Article 19 of the GDPR).
The interested party also has the right not to be subjected to any automated processing that produces legal effects that affect him or that significantly affects his person (art, 22 GDPR).
In any case, the interested party may contact the Guarantor or the Judicial Authority.
The contact details of the Data Controller are as follows: name, Cosmopolitan Hotels S.p.A., Address, Largo Belvedere, 26 – 56128 Tirrenia (PI) , telefon +39 05037031 e-mail, firstname.lastname@example.org
Information updated at 4th June 2018