Privacy Policy

INFORMATION RELATING TO THE PRIVACY POLICY OF THE SITE

1. Dear user, we thank you for choosing to use our site. We are committed to protecting the privacy and security of your personal data. The information that is shared with us helps us to improve the quality of our site’s services. This Privacy Policy, pursuant to Regulation (EU) 2016/679 and of the lgs. 101/2018, describes the methods of processing the personal data of users who consult the website www.romanohotel.com. This information therefore has value for the purposes of art. 13 of Legislative Decree n. 196/2003, Code regarding the protection of personal data, amended by Legislative Decree 101/2018, and for the purposes of art. 13 of the EU Regulation n. 2016/679, relating to the protection of individuals with regard to the processing of personal data and the free circulation of such data, for those who interact with our site, which can be reached at the address corresponding to the home page www.romanohotel.com
2. However, this information does not concern other sites, pages or online services that can be reached via hypertext links published on our site (see paragraph IV) and referring to resources external to the romanohotel.com domain, with reference to which the user can manage the your settings and withdraw consent by visiting the related links directly and using the tools described in the individual privacy policies of third parties or by contacting them.
3. The purpose of this document is to provide information on the methods, timing and nature of the information that the data controller must provide to users when connecting to the web pages of our site www.romanohotel.com, regardless of the purpose of the connection itself. according to the Italian and European legislation in force.
4. The information may undergo changes due to the introduction of new rules; in this regard, we therefore invite the user to periodically check this page.
5. If the user is under the age of 14, also in accordance with the provisions of Legislative Decree 101/2018 and art. 8, c. 1 EU regulation 2016/679, will have to legitimize your consent through the authorization of parents or whoever has responsibility or protection for it. Our websites and applications are not directed to children under the age of 14 and we do not knowingly collect personal information directly from children under the age of 14. If the user believes that we are treating personal information relating to a minor in an inappropriate way, we ask him to promptly report it by contacting us.

DATA PROCESSING

1. Under current legislation, the data controller is the natural or legal person, public authority, service or other body which, individually or together with others, determines the purposes and means of the processing of personal data. It also deals with safety profiles. Following consultation of the website www.romanohotel.com, data relating to identified or identifiable natural and legal persons may be processed.
2. With regard to this website, the data controller is PETRA SRLS  – Piazza del Popolo n. 1 San Foca (LE) – P. IVA 05139820756
3. The data controller is the natural or legal person, public authority, service or other body that processes personal data on behalf of the data controller. Pursuant to Article 28 of EU Regulation no. 2016/679, the data controller for this site is Duilio Petrachi, email info@romanohotel.com.
4. If necessary, the data collected can be processed by the data controller or by subjects appointed and / or authorized by him.
5. The site deals with: hotel and restaurant

TYPES OF DATA COLLECTED

The website www.romanohotel.com collects the following general categories of data:

Information provided directly by the user

When the user uses the website www.romanohotel.com, he provides a series of information, which is necessary for the adequate analysis of requests and consequent provision of services, and allows him to act in accordance with legal obligations. Without these data, the data controller, the manager and the persons in charge may not be able to provide all the requested services.

It should be borne in mind that mainly the above data coincide with the data requested in the contact form. By way of example, this may include:

• Profile data (name, surname, date and place of birth, social security number, address, telephone number and profile picture …).
• Authentication information (eg. A photo of the identity document, passport or driving license …) or other authentication information.
• Payment information (e.g. bank account details or credit card data …) to facilitate payment processing.

Communications with the staff in charge of data collection and processing, with whom the data provided by the User in communications is collected.

Optional information

The user, in communicating with the data controller, the manager and the persons in charge, can choose to provide additional personal data to improve the experience and services. Such additional data will be processed on the consent of the interested party, where applicable.

By way of example, this may include:

• Additional profile data.
• Address book contact data.
• Other information (e.g. responses to surveys, participation in forums, communication with service personnel, comments).
• Location information.
• Information on the use and satisfaction of the site and services.Log data and information on the devices used.

Information relating to Payment Services

This site does not collect data relating to payments, but makes use of external services, which can be directly consulted, to obtain information relating to their specific privacy policy.

Place of storage

The Data is processed on the server and at the owner’s operating offices and in any other place where the parties involved in the processing are located, with the exception of data collected with cookies set by third parties / marketing / monitoring / profiling cookies, for to which reference is made to the next paragraph. This site uses an Aruba hosting provider service that allows us to make the website accessible. Therefore, the user’s data will also be hosted on the hosting provider’s data center, which will operate as a third party.

Retention period

The Data are processed and stored for as long as necessary for the purposes for which they were collected and in any case for a period not less than the duration connected to the navigation times of the site or contact with the site, and to the statistical surveys connected to it. The consent to the processing can be revoked at any time, as explained in paragraph VII.

COOKIES- PLUGIN- SOCIAL NETWORK-SERVICES

Cookies

The site www.romanohotel.com uses cookies to make the user’s browsing experience easier and more intuitive: cookies are small text strings used to store some information, which may relate to the user, his preferences or the device. access to the internet (computer, tablet or mobile phone) and are mainly used to adapt the operation of the site to the user’s expectations, offering a more personalized browsing experience and memorizing the choices made previously. A cookie consists of a reduced set of data transferred to the user’s browser from a web server and can only be read by the server that made the transfer. It is not executable code and does not transmit viruses. Cookies do not record any personal information and any identifiable data will not be stored. We use technical cookies on this site. By continuing to browse the site and accepting the privacy policy, the user accepts the use of cookies; otherwise he can abandon the navigation of the site. The use of these cookies is governed by the rules established by the third parties themselves. Therefore, users are invited to read the privacy policies and indications to manage or disable the cookies published directly on the related web pages.

The following are the types of cookies that the site mostly uses:

Strictly necessary cookies: for example authentication cookies, used to know if the user has logged in to the site or not.

Preference cookies: stores the preferences set by users such as account name, language, location and if the user has chosen to view the mobile version of a site.

Statistical cookies: collects information on how users interact with the website, including the pages that are visited the most, as well as other analytical data. These details are used to improve the performance of the website functions.

Cookies set by third parties / Marketing / monitoring / profiling cookies: used to target advertising to site visitors, as well as to monitor the number of visitors. They track visitor details such as the number of unique visitors, the number of times certain ads have been viewed, the number of clicks received by the ads, and are also used to measure the effectiveness of advertising campaigns by creating detailed User profiles. These types of cookies are set by third party networks and are generally persistent in nature. As specified above, the site uses different third-party applications and services to improve the visitor experience. Consequently, cookies can be set by third parties and used by them to track user activity. Third-party analytical cookies are used to detect information on user behavior on our site. The survey takes place anonymously, in order to monitor performance and improve the usability of the site. Third-party profiling cookies are used to create profiles relating to users browsing romanohotel.com in order to propose advertising messages in line with the choices made by the users themselves. With reference to cookies installed by third parties, in fact, the user can manage their settings and withdraw consent by visiting the relative link, using the tools described in the third party’s privacy policy or by contacting the same directly.

Plugin

A plugin, by way of example, is a non-autonomous program, which interacts with another program to expand or extend its original functionality. This site also incorporates plugins and / or buttons from sites and social networks, in order to allow easy sharing of content on said sites and on the user’s favorite social networks.

Google Inc. services

Third party services are also used on this site and in particular services of Google Inc .. These include Analytics, Search Console, Tag Manager.

By way of description, these are:

GOOGLE Analytics

This website uses GOOGLE Analytics. Google Analytics collects information on user visits such as IP address, browser type, time spent on pages and more. Google Analytics uses “cookies” to allow the website to analyze how users use the site. The information generated by the cookie on the use of the website by the User will be transmitted and stored on Google’s servers in the United States. Google will use this information for the purpose of tracking and examining the use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and Internet use. Google may also transfer this information to third parties where this is required by law or where such third parties process the aforementioned information on behalf of Google. Refusing to use cookies automatically prevents you from using all the features of this website. By using this website, the user consents to the processing of data by Google in the manner and for the purposes indicated above. Further information on the terms of use and privacy can be found in the Google Analytics terms of service and in the Google Analytics Privacy Policy.

GOOGLE SEARCH CONSOLE

This site uses Google Search Console, a web analytics service provided by Google Inc. (“Google”). The information generated by Google Search Console cookies on the use of the site by the user (search analysis, broken links, indexing, crawling errors and more) are anonymous and are used exclusively for site optimization. Further information on terms of use and privacy can be found in the Google Search Console terms of service and in the Google Search Console Privacy Policy.

GOOGLE TAG MANAGER

This site also uses Google Tag Manager. This service allows you to manage website tags via an interface. Tags are metadata that are used, for example, to analyze the behavior of traffic and visitors to a site or app, to understand the effect of online advertising and social channels, to set remarketing and preferences towards target groups and to test and optimize websites. For completeness and transparency about the tools used, it should be specified that Google Tag Manager only implements tags. This means that no cookies are used and, consequently, no personal data is recorded. Further information on terms of use and privacy can be found in the Google Tag Manager terms of service and in the Google Tag Manager Privacy Policy.

PURPOSE OF THE PROCESSING

1. Providing the requested services and managing customer relations. The provision of personal data is mandatory and refusal to provide them makes it impossible to carry out what is requested.
2. Fulfilling the requirements dictated by national and community regulations.
3. Ensuring safety goals (spam filters, firewalls, virus detection), recorded data may eventually include personal data such as the IP address, which could be used, in accordance with applicable laws, with the purpose to stop attempts of damage of the website or to other users (or in any case harmful activities or activities constituting a crime).

The aforementioned information is treated on the basis of the legitimate interests of the data controller.

The personal data collected for the aforementioned purposes could also be processed to carry out activities functional to the promotion and sale of products through the site and to carry out market and customer satisfaction surveys: the provision of data for these purposes is optional and for the processing of such data consent is required.

By granting consent to processing for marketing purposes, data subjects specifically take note of these promotional, commercial, and marketing purposes in the broad sense of the processing (including the consequent management and administrative activities) and expressly authorise them, once consent has been given based on the procedures envisaged, in accordance with the EU Regulation.

As required by art. 21 of the EU Regulation, we inform you specifically and separately that if personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him/her carried out for these purposes and that if the data subject objects to the processing for direct marketing purposes, personal data can no longer be processed for these purposes.

TRANSFER OF DATA TO NON-EU COUNTRIES

This website, as already clarified above, may share some of the data collected with services located outside the European Union area (for example with Google, Facebook, through social plugins and the Google Analytics service). The transfer is authorised on the basis of specific decisions of the European Union for which no further consent is required.

USER RIGHTS

Pursuant to the European Regulation 679/2016 (GDPR) and in compliance with the provisions of Legislative Decree Privacy No. 101/2018, the user can, according to the methods and within the limits established by current legislation, exercise the following rights:

• demanding confirmation of the existence of personal data concerning him/her (right of access).
• having information about the logic, methods, and purposes of the processing.
• requesting the updating, rectification, integration, cancellation, transformation into anonymous form, and blocking of data which have been processed unlawfully, including those no longer necessary for the pursuit of the purposes for which they were collected.
• in cases of consent-based processing, receiving his/her data, provided to the controller, and held by it, in a structured and readable form by a data processor and in a format commonly used by an electronic device, with the only cost of any support.
• the right to lodge a complaint with the Privacy Guarantor or the Judicial Authority.
• pursuant to Art. 2- terdecies of the Privacy Decree No. 101/2018, all rights (Article 15 to 22 of the EU Regulation) referring to personal data concerning deceased persons, can be exercised by those who have an interest of their own or act to protect the interested party, as his/her agent, or for worthwhile reasons of family protection.
• finally, more generally, to exercise all the rights that are recognized by the current provisions of the law.

Requests should be addressed to the data controller.

If the data are processed on the basis of legitimate interests, the rights of the data subjects are still guaranteed (except the right to portability, which is not provided for by the rules); in particular the right to object to the processing that can be exercised by sending a request to the data controller. It is possible to object to the processing of your personal data:

1. for legitimate reasons.
2. (Without having to justify the opposition) when the data are processed for commercial or marketing purposes.

All without prejudice to the limitations on the rights of the interested parties referred to in art. 2-undecies and 2-duodecies of Legislative Decree No. 101/2018.

APPEAL

If the user believes that his/her rights regarding the protection of personal data have been violated, he/she can lodge a complaint with the Privacy Guarantor pursuant to Art. 77 of the Regulation and Art. 141 of the code regarding the protection of personal data or appeal to the Judicial Authority pursuant to Art. 78 and 79 of the EU Regulation and pursuant to Art. 152 et seq. code regarding the protection of personal data.

OBLIGATIONS

In the case of a  PERSONAL DATA BREACH (DATA BREACH), i.e. a security breach that involves – accidentally or illegally – the destruction, loss, modification, unauthorised disclosure or access to personal data transmitted, stored or otherwise processed, the data controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.

The responsible of the data who becomes aware of a possible violation is required to promptly inform the supervisory authority so that he can take remedial action.

If the violation involves a high risk for people’s rights, the data controller will communicate the violation to all interested parties, using the most suitable channels, unless it has already taken measures to reduce its impact. The data controller, regardless of the notification to the Guarantor, will document all violations of personal data, for example by preparing a specific register. This documentation will allow the Authority to carry out any checks on compliance with the legislation.

Only personal data breaches that can have significant adverse effects on individuals, resulting in physical, material, or immaterial harm, should be reported.

The notification will contain the information provided for in Art. 33, par. 3 of Regulation (EU) 2016/679 and indicated in the attachment to Provvedimento del Garante del 30 luglio 2019 sulla notifica delle violazioni dei dati personali (doc. web n. 9126951).

SECURITY OF PROVIDED DATA

This website processes the data of the data subjects in a lawful and correct manner and adopts the appropriate security measures aimed at preventing unauthorised access, disclosure, modification, or unauthorised destruction of the data. The processing is carried out using IT and / or telematic tools, organisational and with logic strictly related to the purposes indicated. In addition to the owner, in some cases, categories of managers and agents involved in the corporate organization of the Site (administrative, commercial, marketing, legal, system administrators) or external subjects (such as third party, technical service providers, postal couriers, hosting providers, IT companies, communication agencies) may have access to the data.

Last update: 23/08/2022