Information notice pursuant to Articles 13 and 14 of EU Regulation 679/2016

This page is the “Privacy Policy” of this website. Its purpose is to explain how the personal data of users who interact with this website and use the services it provides are processed, and to provide the information required by Articles 13 and 14 of EU Regulation 2016/679.

This notice applies only to this website and not to other websites the user may visit through links on the pages of this website.

Regulation (EU) 2016/679 on the protection of personal data (hereinafter the “Regulation”) lays down rules on the protection of natural persons with regard to the processing of personal data and rules on the free movement of such data, and protects the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data.

Article 4(1) of the Regulation defines “Personal Data” as any information relating to an identified or identifiable natural person (hereinafter the “Data Subject”).

“Processing” means any operation or set of operations, whether or not by automated means, performed on Personal Data or on sets of Personal Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Article 4(2) of the Regulation).

Under Articles 12 et seq. of the Regulation, the Data Subject must also be informed of the relevant information concerning the Processing activities carried out by the Controller and of the rights of Data Subjects.

Data Controller
Hotel Fai SNC di Tonidandel Osvaldo
Via al Belvedere 11, 38010 Fai della Paganella (TN), Italy
Tel. +39 0461 583104
Email: info@hotelfai.it
VAT number: 00095090221

Purposes and legal bases of the processing
The user’s personal data will be processed for the following purposes and on the legal bases indicated below:
to conclude and correctly perform the contract to which the data subject is a party, or to take pre-contractual steps at the data subject’s request, for the information and/or services/products requested, including subscription to informative newsletters, and also to respond to requests sent by the data subject (information/products/services/newsletter subscription); the legal basis for this processing is Article 6(1)(b) of EU Regulation 2016/679;
to periodically send, by means of remote communication technologies (email, telephone, SMS, WhatsApp), commercial communications about the services, products and activities offered by the controller; the legal basis is consent, as provided for by Article 6(1)(a) of EU Regulation 2016/679;
to carry out retargeting activities and/or use the email address to identify social media profiles (Facebook, Instagram) for personalised marketing campaigns; the legal basis is consent, as provided for by Article 6(1)(a) of EU Regulation 2016/679;
to send emails with commercial and promotional information for the sale of our products/services of the same type as the data subject’s previous purchases, unless the data subject objects to such processing, which they may do at any time; the legal basis for this processing is the legitimate interest of the Controller, as provided for by Article 6(1)(f);
to respond to requests sent by the user by email and/or through the form on the website; the legal basis for this processing is Article 6(1)(b) of EU Regulation 2016/679;
to enable the website to be browsed and function properly and to ensure an adequate level of security, integrity and availability; the legal basis for this processing is the legitimate interest of the Controller, as provided for by Article 6(1)(f);
to analyse statistical data on aggregated or anonymous data in order to monitor the correct functioning of the Website, traffic, usability and interest; the legal basis for this processing is the legitimate interest of the Controller, as provided for by Article 6(1)(f);
to establish, exercise or defend a right in court; the legal basis for this processing is the legitimate interest of the Controller, as provided for by Article 6(1)(f);
to fulfil obligations laid down by law, by a regulation, by EU legislation or by an order of an Authority to which the Controller is subject; the legal basis for this processing is compliance with a legal obligation, as provided for by Article 6(1)(c).

Types of data
The Data necessary to pursue the purposes set out above will be collected and processed:

  • identification data
  • contact data
  • data relating to the contractual relationship
  • data relating to the data subject’s preferences and interests

Browsing data
The IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
This information is not collected in order to be associated with identified data subjects, but by its very nature it could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes the IP addresses or domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment.
These data are used solely to obtain anonymous statistical information on the use of the website and to check that it is working correctly, and they are deleted immediately after processing.
The data may be used to establish liability in the event of hypothetical computer crimes against the website.

Refusal to provide data
Apart from what is specified for browsing data, users/visitors are free to provide their personal data. Providing the Data is in some cases necessary, as refusal to provide it may prevent the conclusion or correct performance of the contract to which the Data Subject is a party and/or prevent compliance with the legal obligations to which the Controller is subject.
Providing Data for processing that requires consent is optional; failure to provide it will not prevent the use of the products/services offered by the Controller. Even where consent has been given, the data subject will still have the right to object subsequently, in whole or in part, to the processing of their personal Data for the purposes set out above, simply by sending a request to the Controller at the contact details indicated above.

Source of the data
The Data will be provided by the data subject or collected from third parties.

Processing methods
In accordance with Article 5 of the Regulation, the Personal Data being Processed will be:

  • processed lawfully, fairly and in a transparent manner in relation to the Data Subject;
  • collected and recorded for specified, explicit and legitimate purposes and subsequently processed in a manner compatible with those purposes;
  • adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
  • accurate and, where necessary, kept up to date;
  • processed in a manner that ensures an adequate level of security;
  • kept in a form which permits identification of the Data Subject for no longer than is necessary for the purposes for which they are processed.
  • Processing will be carried out using manual and/or IT and telematic tools, with organisation and processing logic strictly related to those purposes and in any case in such a way as to guarantee the security, integrity and confidentiality of the data, in compliance with the organisational, physical and logical measures provided for by the applicable provisions.

Communication of data
Personal data may be communicated to persons authorised to carry out the processing and to the external processors appointed by the controller (the full list of external processors is available from the Controller) responsible for managing the purposes set out above. Subject to your consent, the Data may also be communicated to third-party sponsor companies and/or commercial partners of the controller, who may use them for the purposes set out in point 3) of the “Purposes of the Processing” section above. In pursuing the purposes indicated above, the data may be communicated to other parties acting as independent controllers.

Dissemination of data
Personal data will not be disseminated.

Transfer of data abroad
For the purposes indicated above, Personal Data will be processed within the European Economic Area (EEA). Should they be transferred to third countries in the absence of an adequacy decision by the European Commission, the requirements of the applicable legislation on the transfer of Personal Data to third countries will in any case be observed, such as the Standard Contractual Clauses provided by the European Commission.

Data retention
In general, Personal Data will be kept for the time strictly necessary to pursue the purposes for which they were collected and Processed, including the retention period required by applicable legislation, and in any case for a maximum of 10 years from the end of the relationship with the Controller and for a maximum of 2 years for purposes requiring your consent, without prejudice to the Controller’s possible need to defend a right in court.

Rights of the data subject
Pursuant to Articles 15 to 21 of European Regulation 679/2016 and to the applicable national legislation, the Data Subject may, in the manner and within the limits provided for by the legislation in force, exercise the following rights:

  • to request confirmation of the existence of personal data concerning them (right of access);
  • to know their origin;
  • to receive them in an intelligible form;
  • to obtain information on the logic, methods and purposes of the processing;
  • to request their updating, rectification, integration, erasure, transformation into anonymous form, or the blocking of data processed in breach of the law, including data no longer
  • necessary for the purposes for which they were collected;
  • the right to lodge a complaint with the supervisory authority (Garante Privacy);
  • and, more generally, to exercise all the rights granted to them by the provisions of law in force.

The rights may be exercised by sending a request, without any formalities, to the Data Controller at the addresses indicated above.