Privacy Policy

EN

PRIVACY POLICY STATEMENT

pursuant to Art. 13 of EU Regulation 2016/679 ("GDPR")


  1. Data Controller and contacts

  2. Purposes of the processing, legal bases, storage period

    1. Viewing and browsing the website

    2. Site analytics

    3. Management of user request form (accesses)

    4. Verification, exercise, and/or defence of a right

  3. Optional nature of the provision of data and consequences of a refusal to provide data

  4. Recipients or categories of recipients

  5. Transfer of data abroad

  6. Rights of the data subject

  7. Changes

  8. Cookie Policy Statement

    1. What are cookies?

    2. Characteristics, purposes, legal bases, storage

    3. How to set your browser to prevent the setting of cookies


  1. DATA CONTROLLER AND CONTACTS

    The Data Controller is the party who decides for what purposes the Data Subject's data are to be processed, according to what legal basis, for how long, and to whom they can be transmitted.


    • The Data Controller is Xenia Hotellerie Solution S.p.A., with registered office in Guardiagrele (Chieti), Via Antonio Gramsci 79, VAT No. and Taxpayer Code 01691390692. For all matters concerning the processing of your personal data, you can contact the Data Controller by regular mail to the above address, or by sending an email to: info@xeniahs.com.

    • The Data Controller does not have to name a DPM (Data Protection Manager), since the legal requirements making it obligatory do not apply.


  2. PURPOSES OF THE PROCESSING, LEGAL BASES, STORAGE PERIOD

    A purpose is a reason for which we process your personal data. Below is a list of our purposes. Each and every purpose has one or more legal bases.


      1. Viewing and browsing the website

        Purpose: to permit a flawless website browsing experience.

        Legal basis: use of a service requested by the data subject, Art. 6.1.b) GDPR.

        Notes on the processing and storage period:

        • Viewing and browsing the website entail, for reasons intrinsic to the use of ICT protocols, an exchange of technical information between the Controller's ICT system and yours. The information transmitted consists, for example, of the following: operating system used, browser and its version, time of the request, information flow size.

          The data are immediately deleted at the end of the browsing session, unless they are necessary for the exercise or defence of rights (see below).


        Back

      2. Site analytics

        Purpose: statistical studies/analyses on aggregate or anonymous data that do not entail the processing of personal data.

        Legal basis: These are data that are rendered anonymous, and thus not subject to the legislation on the protection of personal data.

        Notes on the processing:

        • The Data Controller uses the Google Analytics service to collect aggregate data on the site's performance. See the section on analytic cookies below for more information.


      3. Management of user request form (accesses)

        Purpose: acknowledgment/fulfilment of direct request from user.

        Legal basis: contract, as per Art. 6.1.b) GDPR

        Notes on the processing and storage period:

        At the present time, the site supports:

        • requests for access to the reserved area. We only collect the data that are strictly necessary for permitting the authentication of users in order to allow them access to the reserved area.

          The personal data transmitted by filling in the above-said forms are used solely for the above-said purposes; they are not processed for marketing purposes, nor for profiling or any other purpose other than those indicated. They are not transmitted to third parties. For their processing, the Controller might rely on processors within its company organization. They are deleted once the customer's request has been met. The authentication logs are deleted at the end of the session.


      4. Verification, exercise, and/or defence of a right Purpose: defence of rights.

        Legal basis: legitimate interest, as per Art. 6.1.f) of the GDPR.

        Notes on the processing and storage period:

        • The Controller's legitimate interest is to exercise rights and defend itself both judicially (including pre-litigation) and extrajudicially with regard to third parties (including public authorities) and to data subjects.

        • The personal data collected for this purpose are kept for 10 years, as envisaged by the ordinary limitation period (Art. 2946 of the Italian Civil Code), except in the case of interruption of the limitation period.

  3. OPTIONAL NATURE OF THE PROVISION OF DATA AND CONSEQUENCES OF A REFUSAL TO PROVIDE DATA

    The decision to provide your personal data is optional and voluntary. The only consequence if you refuse to provide your personal data will be the impossibility for you to browse the website or for us to provide you with the services you request.


  4. RECIPIENTS OR CATEGORIES OF RECIPIENTS

    We will transmit the personal data collected through the website to:

    • hosting, housing, and cloud providers;

    • providers of information communication platforms or channels;

    • providers of remote payment services (where applicable);

    • consultants and professionals who assist us (also in legal and commercial matters, if necessary);

    • public and police authorities if it becomes necessary to involve them;

    • judicial authorities in the exercise of their functions when deemed necessary or when required by law;

    • persons authorized by the Controller to process the data who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (e.g. employees and consultants).


  5. TRANSFER OF DATA ABROAD

    We use back office services also located in other countries EU/EEA (Albania). This processing is carried out in compliance with the applicable legislation, through the recourse to legal guarantees, i.e. standard contractual clauses approved by the European Commission. You may obtain a copy of said clauses by contacting the Controller.

    Back

  6. RIGHTS OF THE DATA SUBJECT

    Rights: You may exercise the following rights: access, rectification, erasure ("right to be forgotten "), limitation, objection, and portability pursuant to Articles 15, 16, 17, 18, 20, and 21, of the GDPR.

    Complaint: You also have the right to lodge a complaint with the competent supervisory authority (for Italy: Garante per la protezione dei dati personali: Personal Data Protection Authority) for any violation of the legislation on the processing of personal data (GDPR).

    We do not engage in: automated decision-making or profiling activities.

    Withdrawal of consent: Consent may be withdrawn at any time, without any formalities. For example, you may always withdraw your consent to the newsletter; see above.


  7. CHANGES

    This Privacy Policy Statement is in effect from 25 May 2018 and replaces the previous version. We reserve the right to change or simply update its contents. Any variations will be binding from the moment they are published on the website. We therefore recommend that you consult this section regularly so you can be informed of the most recent and updated version of the Statement, and therefore keep up to date on the data collected and how the Controller uses them.

    Back

  8. COOKIE POLICY STATEMENT

    1. What are cookies ?

      Cookies are small text files stored on the user's device. They are temporary markers containing information that makes it possible to keep track of the user's activities, until the cookies are deleted. They may contain log-in information (which will therefore not have to be re-entered by the user every time, unless the specific cookie is deleted), the user's language preferences, the contents of their shopping cart, the information necessary for permitting communication between websites or for improving it, etc.

      Cookies can be used for purely technical purposes, and in that case no consent is required from the user; or they can be used for different purposes, typically for profiling and marketing, and in that case the user's consent is required.

      They may be either first-party cookies, i.e. cookies of this website's Data Controller, or third-party cookies, such as the cookies Google uses for its analytics.


      Back

    2. Characteristics, purpose, legal bases, storage


      1. Technical cookies:

        • Purpose: to permit the correct functioning and use of the website.

        • Legal basis: Art. 5 of Directive 2002/58/EC

        • Storage: session cookie, removed after the browser is closed;

        • NB: These cookies do not require consent. If technical cookies are disabled, the site could present functioning problems.


      2. Third-party analytic cookies (Google, with anonymization):

        • Purpose: statistical processing on the use of the website; for more information: https://policies.google.com/technologies/types?hl=it

        • Legal basis: data rendered anonymous, GDPR not applicable

        • Storage: https://policies.google.com/technologies/types?hl=it

        • NB: The anonymization procedure is described here: https://support.google.com/analytics/answer/2763052?hl=it


      3. Third-party profiling cookies

        • Third party: Adobe Systems Inc., website: https://typekit.com/about/

        • Third party's purpose and cookie policy statement: see https://www.adobe.com/privacy/policies/typekit.html

        • Legal basis: consent, as per Art. 13 of Directive 2002/58/EC

        • NB: As far as the third-party cookies are concerned, we are simply intermediaries. All decisions as to the processing purposes and methods are made by the third party, not by us. Likewise, the cookie policy statement indicated above has been drafted by the third party.

          • We limit our intervention to obtaining, as intermediaries, your possible consent for the third party to set third-party cookies on your device.

          • In particular, you give your consent to the setting of third-party cookies if: you click on "I accept " on the banner on the first page or if you perform any of the operations indicated on the banner.

          • You may withdraw your consent at any time. You must notify your intention to withdraw your consent directly to the third party.

          • It is, in any case, always possible to: delete the cookies stored on your device; set your browser to disable the setting of cookies (see details below); use third-party extensions to disable cookies, even selectively. It is recommended that you use open-source extensions.


            Back


    3. How to set your browser to prevent the setting of cookies


      It is possible to disable the setting of cookies through your browser settings. Below are links to the specific instructions for the main browsers: