Policy pursuant to Art. 13 of EU Regulation 2016/679 for "I AM STAR"
Dear Customer,
pursuant to Article 13 of EU Regulation 679/2016 (hereinafter referred to as the GDPR – General Data Protection Regulation) and the applicable personal data protection legislation, Starhotels S.p.A. (hereinafter “Starhotels”) informs you about the processing of your personal data, which will be carried out in compliance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy and storage limitation.
Data Controller
Pursuant to Article 4(7) of GDPR 2016/679, the Data Controller is Starhotels S.p.A., with administrative offices in Florence - 50144, Viale Belfiore n. 27. Tel. 055.36921 - fax 055.36924. e-mail: privacy@starhotels.it
Data Protection Officer
Pursuant to Article 37 of GDPR 2016/679, STARHOTELS S.p.a. has appointed a company Data Protection Officer (DPO), who can be contacted at the following e-mail address: dpo@starhotels.com. Certified e-mail (PEC): starhotels_dpo@legalmail.it
Data Processors
Where necessary for the performance of its institutional activities, Starhotels will identify and formally appoint Data Processors, meaning, pursuant to Article 4(8) of the GDPR, “a natural or legal person, public authority, agency or other body which processespersonal data on behalf of the controller”. Data subjects may, at any time, request the Data Controller for the updated list of Data Processors.
Purpose and legal basis of the processing
Starhotels will process personal data in connection with the “I AM STAR” program, and this will apply only to customers enrolled in the program, for the following purposes:
a) managing the program enrolment process and issuing the credentials (user ID and password) for access to the reserved I AM STAR area on the website www.starhotels.com;
b) periodic communication and provision of the benefits (discounts, services, advantages) offered under the program, whether on an ongoing basis or occasionally for specific events;
c) communication of other advertising and promotional initiatives reserved exclusively for members of the I AM STAR program, carried out by Starhotels, by related, connected, controlled or affiliated companies, and by partners of Starhotels S.p.A., or by third parties engaged by Starhotels, via email, telephone, SMS, instant messaging, social media or other means of contact, including postal mail, as provided for in this notice and subject to the data subject’s consent.
d) profiling of members through analysis of the data provided, the services/products chosen, and the tastes, habits and preferences expressed by them, in order to offer advertising messages and/or commercial proposals in line with the choices made;
e) disclosure of data (e-mail, name, profile) to agencies and third-party companies such as social media platform providers, for the creation of custom audiences and lookalike audiences and the consequent sending of targeted advertising communications. Before disclosure, the data may be pseudonymised through hashing (SHA-256 algorithm or equivalent); the receiving platform will compare the resulting codes with its own users solely to identify the matches needed to build the advertising audience, for the purpose of preparing and sending targeted communications.
The purposes indicated will be pursued through the processing of your personal data, in compliance with the principles referred to above. The legal basis, i.e. the condition that makes the processing lawful, for pursuing the purposes indicated under letters a) and b), is the performance of contractual measures to which the data subject is a party and/or pre-contractual measures taken at the data subject’s request. As regards the purposes indicated under letters c), d) and e) – marketing/profiling/social media communications – the legal basis is the explicit consent given by the data subject in the specific section of the enrolment form published on the website or in the forms available at the property (Article 6(1)(a) of the GDPR). Consent for these processing activities is optional.
Categories of data processed and nature of provision
To pursue the purposes described, the following categories of personal data may be processed:
- so-called “common” data (e.g. personal details, contact details – e.g. e-mail, telephone, browsing data, tastes and preferences of members).
Providing the data is optional; therefore, the data subject must give express consent to the processing of the data. Once given, the data subject may withdraw consent at any time, easily and free of charge, by contacting the Data Controller directly at the addresses given above. From that moment, Starhotels will cease such processing, but this will mean it will no longer be possible to receive timely updates on the new services offered by our company or to benefit from certain services and advantages reserved for Starhotels customers.
Withdrawal of consent does not affect the lawfulness of the processing based on the consent given before its withdrawal.
Data processing methods
Personal data will be processed using IT and paper-based tools by duly authorised, instructed and trained staff.
Starhotels guarantees the application of adequate security measures, suitable for reducing the risk to which the data may be exposed.
Data retention period (Data retention)
In compliance with the principles of proportionality and necessity, the data will be processed until the customer requests removal from the “I AM STAR” program.
Data relating to processing based on consent will be retained until such consent is withdrawn and, in any case, until the purposes described have been achieved.
Recipients and dissemination of personal data
The data collected will be processed solely for the purposes described above and, subject to the customer’s consent, may be disclosed to companies controlled by, affiliated with or otherwise connected to the Starhotels Group, both in Italy and abroad, solely for the purpose of managing the services offered to Starhotels customers under the “I AM STAR” program.
Furthermore, your data may be disclosed, always in compliance with adequate security measures, to public authorities and private parties for the fulfilment of specific legal obligations, including those of a tax, administrative and financial nature. Personal data will not be disseminated.
For the activities described above, the data may also be disclosed, subject to consent, to agencies (appointed as Data Processors pursuant to Article 28 of the GDPR) or companies operating social media platforms, which qualify as independent Data Controllers.
Place of processing and scope of data transfer
The data is processed at the premises of the Data Controller and of the Data Processors listed in the relevant register kept by the Controller.
Personal data will be processed within Italian territory or, in any case, within the European Union, and will not be transferred to non-EU countries or International Organisations.
Should a transfer become necessary during the course of the relationship, the Data Controller guarantees compliance with the provisions of Chapter V of the GDPR.
As part of the processing activities that involve disclosure to social media platforms, the data may be processed outside the European Economic Area. Data subjects are invited to consult the relevant information on the processing of personal data provided by such platforms.
Rights of the data subject
The Data Controller guarantees the exercise of the rights set out in Articles 15 et seq. of the GDPR, in particular:
1. Right of access;
2. Right to rectification;
3. Right to erasure (“right to be forgotten”);
4. Right to restriction of processing;
5. Right to data portability;
6. Right to object.
Where personal data relates to deceased persons, the above rights may be exercised, pursuant to Article 2-terdecies of Legislative Decree 101/2018, by anyone with a personal interest, or acting to protect the data subject as their representative, or for family reasons deserving of protection.
Requests concerning the exercise of these rights must be addressed to the Data Controller at: privacy@starhotels.it.
Automated processing and profiling
The Data Controller, within the limits and in compliance with the conditions set out above, carries out profiling activities for members, guaranteeing the application of adequate security measures.
Right to lodge a complaint and protection of the data subject
Finally, we remind you that if you believe your privacy rights have been violated, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), located at Piazza Venezia n. 11, 00187 - Rome, tel. (+39) 06.696771, e-mail: protocollo@gpdp.it, Certified e-mail (PEC): protocollo@pec.gpdp.it.
