Privacy Policy

PRIVACY POLICY UPDATE

Information provided pursuant to Articles 13-14 of GDPR 2016/679 (General Data Protection Regulation)

Dear Guests,

Pursuant to Article 13 of EU Regulation 2016/679 (hereinafter GDPR) and in relation to your personal data, which you have provided directly, we hereby inform you of the following:

1. Data controller.

The data controller is Xenia S.r.l., VAT number: 05478460875, with registered office in Catania on Via Gisira no. 40, which can be contacted at the email address info@asmundodigisira.com and on the telephone numbers +39 095/0978894, +39 391/1064020.

1. Category of data processed.

The data collected are those relating to the conclusion of the B&B contract, namely:

personal details, contact details (e-mail address, telephone number, place of residence), payment details (debit and/or credit card number) as well as those relating to promotional and marketing activities.

1. Purpose of the processing.

The data you provide will be used for the purpose of entering the B&B (Hotel) contract and may be disclosed to third parties only if necessary.

1. Methods of processing.

The processing is carried out through the following operations: collection, registering, organisation, storage, deletion, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data. Personal data will be processed both on paper and electronically and/or automatically, i.e. both manually and using IT systems. In any case, all appropriate procedures will be adopted to protect confidentiality, in compliance with current regulations. Adequate security measures will be used to ensure the protection, integrity and accessibility of personal data. The processing will be carried out by the Data Controller and/or Data Processor: Dr Briga Maria, born on 07/05/1980 in Agira (EN) with tax code: BRGMRA80E47A070G. Your data will not be disclosed within the scope of its activities and, for the purposes indicated above, the Data Controller may use services provided by third parties operating on behalf of the Data Controller and according to its instructions, as data processors. These are entities that provide the Data Controller with processing or instrumental services (e.g. IT services for the operation of the platform) or that in any case provide a service strictly and necessarily connected to the Data Controller’s activity: tax consultants; public and private entities, including in relation to inspections or audits; entities that may access the data pursuant to legal provisions; external companies supplying goods or services.

1. Rights of the data subject.

At any time, you may exercise, pursuant to Articles 15 to 22 of EU Regulation No. 2016/679, the right to:

1. request confirmation of the existence or otherwise of your personal data;
2. obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, where possible, the storage period;
3. obtain the rectification and erasure of data;
4. obtain the restriction of processing;
5. obtain data portability, i.e. receive them from a data controller, in a structured, commonly used and machine-readable format, and transmit them to another data controller without hindrance;
6. object to processing at any time, including in the case of processing for direct marketing purposes;
7. object to automated decision-making relating to natural persons, including profiling.
8. viii)request from the data controller access to personal data and the rectification or erasure of such data or the restriction of processing concerning him or her or to object to their processing, in addition to the right to data portability;
9. withdraw consent at any time without prejudice to the lawfulness of processing based on consent given prior to withdrawal;
10. lodge a complaint with a supervisory authority.

1. Consequences of failure to provide data.

Regarding personal data relating to the performance of the contract to which you are a party or to regulatory obligations (e.g. obligations relating to the keeping of accounting and tax records), failure to provide personal data will prevent the contractual relationship from being finalised. About personal data relating to promotional and/or marketing activities, failure to give consent will make it impossible to provide these services.

1. Data retention for contractual purposes.

Your personal data, processed for the purposes indicated above, will be retained for the duration of the contract and, subsequently, for the time during which the Company – Data Controller is obliged to retain it for tax and/or other purposes, as required by law or regulations. Personal, contractual and payment data will be kept for the time necessary to manage contractual/accounting obligations; personal data that is no longer necessary, or for which there is no longer a legal basis for its storage, will be irreversibly anonymised or securely destroyed.

1. Data retention for promotional and/or marketing purposes.

Your personal and contact details, if you have given your consent for the following services:

1. sending information/promotional material to the contacts you have provided;
2. communicating information about your stay to external parties;
3. storage of your data in the database, in order to facilitate future check-in operations;

will be stored for a period of 2 years for marketing purposes (Provision of the Data Protection Authority 24/2/2005) and for a period of 5 years in the case of storage.

1. Transfer of personal data to countries outside the European Union:

The data will not be transferred abroad, and no transfer to third countries outside the European Union is envisaged.

I, the undersigned, declare that I have received the above information.