Customer information under Regulation (EU) 679/2016 and the “Privacy Code” (Legislative Decree 196/2003) as amended by Legislative Decree 101/2018 and subsequent decrees relating to the protection of personal data processing.
In accordance with Article 13 of the Regulation (EU) 679/2016 (Regulation) and the Privacy Code (Legislative Decree 196/2003) as amended by Legislative Decree 101/2018 and subsequent decrees, hereinafter for the sake of brevity, Privacy, Starhotels S.p.A. (hereinafter “Starhotels”), as the Data Controller, hereby informs you that your personal data, and your or your underage children's special categories of personal data (Regulation Article 9), if any, provided by you shall be processed in a pertinent and transparent manner, and in compliance with the principles of lawfulness and necessity under the current governing
Purposes of the processing
The personal data shall be processed for institutional purposes associated with or useful for our Company's business, and therefore to:
a) perform the hotel accommodation service and related transactions, or one or more contractually agreed transactions;
b) comply with legal obligations of a tax, statutory, accounting and administrative nature;
c) meet internal operating and business needs of Starhotels, with respect to the service provided;
and, subject to your freely given, specific and unambiguous consent:
d) supply, by email (newsletter) or conventional mail, information and/or surveys regarding Starhotels products or services, marketing, advertising and promotional initiatives reserved to Starhotels customers and implemented by Starhotels or by subsidiaries, affiliates or other related parties;
e) carry out profiling activities through automated or online data processing in order to provide customized promotions based on the choices and habits of the user;
f) process the data of minors (in accordance with the applicable regulations) over whom you exercise parental authority, for the purpose of making reservations and registering at the hotel.
Legal basis of the processing
The legal basis of the data processing is the specific contractual relationship established and the freely given, specific and informed consent of the data subject.
Data processing method
The data will be processed with paper-based, electronic or telecommunication means, and with suitable security measures to safeguard the security and confidentiality of your personal data.
In observance of the proportionality and necessity principles, the data shall not be retained for longer than is strictly necessary for the purposes stated above, thus for the service offered or compliance with specific laws.
Recipients of personal data
The data collected will be processed exclusively for the purposes stated above and may be communicated to subsidiaries, affiliates or other companies associated with the Starhotels Group, either in Italy or abroad, exclusively for the management of the services offered to Starhotels customers. Using adequate security measures put into place by the Data Controller, your data and your child's/children's data may also be communicated to law enforcement agencies and other public and private parties to comply with legal, tax, administrative, financial and similar obligations. The data will not be disseminated in any case. You may exercise your rights, and those of your child/children, with the Data Controller at any time under Regulation Articles 15 and subsequent articles, i.e. you may obtain access and confirmation as to whether or not personal data concerning you are being processed, and obtain their communication in an intelligible form. You also have the right to obtain the updating, rectification, integration and erasure of the data. You have the right to object, wholly or in part, for legitimate reasons, to the processing of your personal data and that of your children even if pertinent to the purpose for which it is collected, and to the sending of advertising or direct sales materials and to the conducting of automated market research or business communications, by contacting the Data Controller, which shall provide, upon request, the complete and updated list of the Data Processors.
Mandatory and optional supply of data
Whereas consent is not required for processing personal data preordained to the performance of the contract and fulfillment of the legal obligations referred to in the "Purposes of the processing" section, points a), b) and c), please note that
- the supply of data for the purposes stated in points a), b) and c) above is optional, but necessary to perform the customer services, and the lack of consent could result in not allowing the service to be performed;
- the consent to processing for the purposes stated in point d) is freely given and optional, and the data subject may object at any time and in any event to such processing, easily and free of charge, by contacting the Data Controller, even by email, and obtain an immediate reply confirming the termination of such processing; notwithstanding the foregoing, refusal to supply the personal data requested could result in impossibility to be promptly updated on the new services offered by our company and to use some services and benefits reserved to Starhotels customers;
- the consent to processing for the purposes stated in point e) is freely given and optional, and the data subject may object at any time and in any event to such processing, easily and free of charge, by contacting the Data Controller, even by email, and obtain an immediate reply confirming the termination of such processing; notwithstanding the foregoing, refusal to supply the personal data requested could result in impossibility to obtain customized promotions based on the choices and habits of the user;
- the supply of data of minors (in accordance with the applicable regulations) and the consent to the processing of that data for the purposes stated in points a, b, and c) above from parties who exercise parental authority over such minors are mandatory because they are necessary for the performance of the contractually agreed services.
Rights of the data subject
The data subject may exercise his or her rights with the Data Controller under the Regulation, Articles 15 and subsequent articles, i.e. he or she may obtain confirmation as to whether or not personal data concerning him or her are being processed, and obtain their communication in an intelligible form.
The data subject shall also have the right to obtain the access, updating, rectification, integration, portability and erasure of the data and to impose limitations on their processing.
Moreover, the data subject shall have the right to object, wholly or in part, for legitimate reasons, to the processing of his or her personal data, even if pertinent to the purpose for which it is collected, for the sending of advertising or direct sales materials and for conducting automated market research or business communications, without prejudice to his or her right to lodge a complaint to the supervisory authority.
Those rights may be exercised by contacting the Data Controller, which shall provide, upon request, the complete and updated list of the Data Processors.
The requests shall be directed to the Data Controller.
Rights regarding deceased persons
In the hypotheses provided for in Articles 15 to 22 of the Regulation referring to personal data of deceased persons, the rights may be exercised by those who have a direct interest or are acting to protect the data subject in their capacity as authorized representative, or for family reasons deserving protection.
The requests shall be directed to the Data Controller.
Protection of the data subject
If the data subject considers that the rights he or she enjoys under the Privacy Code have been violated, he or she may either submit a complaint to the Privacy Authority or lodge an appeal with the judicial authorities.
Transfer of personal data
Starhotels may transfer personal data to a recipient in a third country or international organization if there is an adequate level of personal data protection; this condition may be considered satisfied when there is an adequacy decision by the Commission, or in the case of transfers referred to in Regulation Article 46, 47 or 49, there are appropriate safeguards and the means to obtain a copy of such data or where they have been made available.
The Data Controller is Starhotels S.p.A., whose administrative offices are in Florence - 50144, Viale Belfiore, 27. Tel. 055.36921 - fax 055.36924. e-mail: firstname.lastname@example.org