In accordance with the current legislation and the provisions of art. 13 of EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 concerning the protection of individuals regarding the processing of personal data, as well as of the free movement of such data (hereinafter "Regulation"), we inform you that the Data Controller of information supplied by you is Edilcavour sas (hereinafter, the 'Holder' or 'Edilcavour'), which is the legal representative pro tempore, with registered office in Alba (CN), via Garibaldi n. 192, tax code and VAT number 02658240045, e-mail firstname.lastname@example.org.
The computer systems and computer programmes used to operate the site collect some personal data of which transmission is implicit in the use of Internet communication protocols (e.g. IP addresses or domain names of computers used by users who connect to the site , parameters related to the operating system and the computer environment of the user, etc.).
Although this is information that is not collected to be associated with identified individuals, by their nature they could, through processing and association with data held by third parties, allow users to be identified.
This data may be used for the sole purpose of obtaining statistical information not associated with any user identification data on the use of the site and also to check its correct functioning, and therefore this data will be deleted immediately after processing.
The data could be used to ascertain responsibility in case of hypothetical computer crimes against the site; with the exclusion of this eventuality, the data will be deleted after the time necessary for the provision of the services illustrated on the site.
Data provided voluntarily by the user
No personal data of the user is required for the consultation of the site.
However, any contact with Hotel Casa Pavesi or the sending of optional, explicit and spontaneous messages, e-mails or traditional post to the Hotel Casa Pavesi addresses, indicated on the website, entail the subsequent acquisition of the address and e-mail of the sender or the relative telephone number, necessary to respond to requests, as well as any other personal data included in the relative communications.
- to follow the requests of the user and provide the service (e.g. to manage the bookings made by you);
- to evaluate and improve services and to develop new ones;
- to fulfil legal obligations and/or to comply with orders from public authorities, including judicial authorities;
- to send newsletters and/or commercial communications to you from Hotel Casa Pavesi, exclusively upon release of the relative consent, and this data may be disclosed to third parties only if this is necessary for this purpose.
The processing of data for the aforementioned purposes (except for the possible sending of newsletters and/or commercial communications) does not necessarily require your consent, since the processing is configured, in such cases, as necessary for the implementation of a contract of which you are a party to or for the implementation of pre-contractual measures taken upon your request to fulfil a legal obligation or, again, to pursue a legitimate interest of the Data Controller or third parties (Article 6, paragraph 1, letter b), c) , f) of the Regulations).
The processing will be carried out with manual and / or computerized and telematic tools with organizational and processing criteria strictly related to the purposes themselves and however in such a way as to guarantee the security, integrity and confidentiality of the data.
This data is kept for the time strictly necessary to provide the requested service to the user and is eliminated immediately thereafter, without prejudice to further legal conservation obligations. Your information will not be disclosed.
Within the area of activity and for the aforementioned purposes, the Holder may use services rendered by third parties, as data controllers, operating on his behalf and according to his instructions. These are, for example, subjects who provide processing or instrumental services. Further information on this subject may be requested from the contacts indicated below.
Data will not be transferred outside the European Union.
At any time, the Data Controller will have the right to exercise the rights established by current legislation, including the right
• to receive confirmation of the existence of your personal data and to access its content;
• to update, modify and/or correct your personal data;
• to request cancellation, to transform into anonymous form, to block data processed in violation of the law or to limit processing;
• to oppose the processing for legitimate reasons;
• to receive a copy of the data supplied by you and to request that such data be transmitted to another Data Controller,
by sending a specific request to the e-mail address email@example.com.
This information will be subject to updates. The Data Controller therefore invites Users who wish to know how to process their personal data to visit this page on a regular basis.
Nevertheless, the Data Controller is solely and exclusively responsible for the content of its sites and cannot be held responsible for the content of third-party sites with which an authorized link exists, as it does not exercise any control over them.
Information in accordance with art. 13 of Regulation (EU) 679/2016 on the processing of personal data of the interested party
In accordance with art. 13 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on data protection (hereinafter "Regulation" or "GDPR"), in relation to the processing of your personal data, Edilcavour s.a.s. (hereinafter referred to as "Edilcavour" or the "Data Controller"), whose identity and contact details are indicated below,
communicates to the interested party,
1. Identity and contact details of the Data Controller.
The Data Controller in accordance with arts. 4 and 24 of the Regulation is:
Edilcavour s.a.s., which is the legal representative pro tempore, with registered office in Alba (CN), via Garibaldi n. 192, tax code and VAT number 02658240045, e-mail firstname.lastname@example.org.
2. Purpose of the processing to which the data is destined and legal basis of the processing.
The personal data that you have given to the undersigned controller will be processed exclusively for the purposes related to the realization of the subject of the contract being stipulated or already in existence with the Controller, in compliance with the provisions indicated in art. 13 of the Regulation. For "purposes related to the realization of the subject of the contract" must mean any data processing operation related to the management, administration and fulfilment of the contractual relationship in question. The legal basis of the processing for the aforementioned purposes is art. 6 (1) (b) of the GDPR ("processing is necessary for the execution of a contract of which the interested party is party to or for the implementation of pre-contractual measures adopted at the request of the same").
In the context of the present purposes, the processing is also carried out for the fulfilment of specific legal obligations concerning the management of the contractual relationship (for example, accounting and/or fiscal). The legal basis for processing the aforementioned purposes is art. 6, paragraph 1, letter c) of the GDPR ("the processing is necessary to fulfil a legal obligation to which the data controller is subject to").
3. Particular categories of personal data
If, in the execution of the contract or in order to fulfil specific legal obligations concerning the management of the contractual relationship, the undersigned controller should need to have also data that fall within the specific categories of personal data in accordance with art. 9 of the Regulation (in particular, personal data revealing "the racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a person, data on health or sexual life or sexual orientation of the person") these categories of data may be processed only with your free and explicit consent.
The legal basis of the processing of the data provided by you belonging to the aforementioned special categories of personal data in accordance with art. 9 of the Regulation will be represented, in this case, by your specific consent in accordance with art. 9, paragraph 2, letter a), of the Regulation ("the data subject has given his explicit consent to the processing of such personal data for one or more specific purposes").
4. Data processing mode.
In relation to the aforementioned purposes, the processing of your personal data will be done by manual, computerized and telemetric tools for the mere fulfilment of the purposes themselves and, in any case, in order to guarantee their security and confidentiality, in compliance with the provisions of art. 32 of the Regulation on security measures and by persons specifically authorized, in compliance with the provisions of art. 29 of the Regulation.
5. Prospective addressees and prospective categories of recipients of personal data.
The processing of personal data provided by you will be carried out by persons explicitly and specifically appointed by the controller, who act as managers (Article 28 of the Regulation) or as authorized persons (Article 29 of the Regulation) or as persons explicitly appointed for the processing of data in accordance with the provisions of the Regulation and the national regulations for compliance with the provisions of the GDPR. The data provided by you may also be processed by the Controller directly and can also be communicated to third parties if the said processing is functional to the obligations of law and the execution of the contract. For this purpose of communication, the data may be brought to the attention of companies or external professionals, the collaboration of which the Data Controller may use for the purposes indicated in this statement. The data may be communicated, in order to allow the fulfilment of contractual and legal obligations, to post offices, shippers and couriers for sending documentation, as well as to banking institutions for accounting management deriving from the execution of the contract, as well as to Public Administrations in accordance with the law, as well as to third parties for the supply of IT services or archiving services.
The personal data of the interested party are not subject to disclosure and the Data Controller will not disclose any information or make it available in any way to unspecified persons.
6. Transfer of personal data to a third country or to an international organization.
As a rule, no personal data of the interested party will be transferred to a third country outside the European Union or to International Organizations. Should this be necessary for the realization of the subject of the contract being stipulated or already in existence with the Controller, the latter undertakes to ensure that any eventual transfer takes place in compliance with the provisions set forth in Articles. 45 (on the basis of an appropriate decision by the Commission) and 46 (on the basis of the existence of appropriate guarantees), if applicable, or in any case in accordance with art. 49 of the Regulation.
7. Period of conservation of personal data.
The personal data being processed will be kept according to the provisions of art. 5, paragraph 1, let. e), of the Regulation in a way that allows identification of the interested party for a period of time not exceeding the achievement of the aforementioned purposes for which personal data are collected and processed.
Personal data are stored according to the following criteria: (a) for the time strictly necessary to achieve the "purposes related to the realization of the subject of the contract" for which they are processed and in any case for a period not exceeding 10 (ten) years ; (b) for the time strictly necessary for the fulfilment of legal obligations, regulations or instructions given by the Supervisory and Control Bodies.
At the end of the conservation period, your data will be deleted, or made anonymous.
8. Rights of the interested party.
In accordance with articles 15 and ss. of the Regulation, you, as the interested party, have the right to ask the Data Controller:
• access to your personal data;
• the correction or cancellation of the same or limitation of the processing concerning you;
• opposition to processing;
• the portability of data;
• if the processing is based on Article 6 (1) (a) or Article 9 (2) (a) of the Regulation, the withdrawal of consent at any time without prejudice to the lawfulness of the treatment based on the consent given before the revocation.
Without prejudice to any other administrative or judicial appeal, the interested party, who considers the processing that concerns him/her is in violation of the GDPR, has the right to lodge a complaint with a supervisory authority, with particular attention to the country in which he normally resides, works or the place where the alleged violation occurred in accordance with art. 77 of the Regulation (the Italian supervisory authority is the Guarantor for the protection of personal data).
To exercise the above rights, the interested party may contact the Data Controller at the addresses indicated in point 1 of this statement.
9. If the communication of personal data is a legal or contractual obligation or a necessary requirement for the conclusion of a contract; possible consequences of not communicating such data.
The communication of your personal data and the consequent processing by the Data Controller is necessary for the start-up, for the continuation and for the correct management of the relationship in question; this communication, therefore, must be understood as mandatory.
Your possible refusal to provide the requested personal data may cause, on the part of the Controller, the inability to perfect and manage the contractual relationship being stipulated or in existence.
10. Existence of an automated decision-making process, including profiling.
In accordance with art. 13, paragraph 2, letter f) of the GDPR, we inform you that the personal data collected will not be subject to any automated decision-making process, including profiling in accordance with art. 22, paragraphs 1 and 4 of the Regulation.
11. Processing of personal data for a purpose other than those for which they have been collected.
If the Data Controller intends to process your personal data further for a different purpose than that for which they were collected, before such further processing the Controller will provide the interested party information concerning this different purpose and any further relevant information referred to in art. 13, paragraph 2 of the Regulation.
The Data Controller