1. 🥇 Identity and Contact Details of the Data Controller
The Data Controller responsible for the processing of personal data is APPARTAMENTI ANTEY SRL (hereinafter, the “Controller”).
- Registered Office: Frazione Ruvère 22 – 11020 Antey-Saint-André (AO)
- Contacts (email/PEC): info@maisondutata.it – appartamentiantey@pec.it
2. 🎯 Purposes, Legal Bases, and Retention Period
Your personal data is processed for the following purposes, based on the corresponding lawful conditions provided for by the GDPR (referred to as “Legal Bases”):
| Purpose of Processing | Legal Basis (Art. 6 GDPR) | Retention Period |
| A) Legal Obligations (e.g., communication of data to the Police Headquarters via the “Alloggiati Web” service pursuant to Art. 109 TULPS, fiscal and accounting requirements). | Legal obligation (Art. 6, par. 1, lett. c) | For the time mandated by law (e.g., 10 fiscal years, etc.). |
| B) Performance of the Accommodation Contract (managing the reservation, check-in, accessory services, charges, communications regarding the stay). | Performance of a contract (Art. 6, par. 1, lett. b) | For the entire duration of the contractual relationship and for the subsequent 10 years (ordinary statute of limitations). |
| C) Legitimate Interest for Security (e.g., use of cameras in common areas to protect property and guests). | Legitimate interest of the Controller (Art. 6, par. 1, lett. f) | Maximum 24/48 hours, subject to explicit requests from Judicial Authorities. |
| D) Direct Marketing (sending newsletters, promotions, special offers, and commercial communications via email/SMS). | Specific and express consent of the data subject (Art. 6, par. 1, lett. a) | Maximum 12 months from the date of consent/last contact, unless renewed. After this term, the data will be anonymized. |
3. ⚠️ Nature of Data Provision and Refusal
- The provision of data for purposes A (Legal Obligations) and B (Contract) is mandatory and necessary to use the hospitality services. Any refusal to provide such data makes it impossible to proceed with check-in and the provision of the stay.
- The provision of data for purpose D (Marketing) is optional (voluntary). Refusal does not affect the use of hospitality services.
4. 🤝 Recipients of the Data (Who receives your data)
Your data will not be disclosed to indeterminate parties, but may be communicated to the following subjects (referred to as “Recipients”):
- Public Security and Judicial Authorities (for legal obligations);
- Accountants or external tax consultants (for accounting compliance);
- Companies or IT consultants who manage the structure’s PMS (Property Management System), designated as External Data Processors (Art. 28 GDPR).
5. 🌍 Data Transfer outside the EU
Your data is processed using digital tools (e.g., Google Forms for consent collection) whose servers may be located outside the European Union (e.g., in the United States). The Controller guarantees that such transfer only takes place in the presence of appropriate safeguards, such as adherence to the EU-US Data Privacy Framework or the adoption of standard contractual clauses approved by the European Commission.
6. 👑 Your Rights (Art. 15-22 GDPR)
As a data subject, you are granted the following rights:
- Right of Access: Obtain confirmation as to whether or not your data is being processed and, where that is the case, access to the data.
- Right to Rectification: Obtain the correction of inaccurate data.
- Right to Erasure (“Right to be Forgotten”): Obtain the deletion of data (in cases provided for by law).
- Right to Restriction of Processing: Obtain the restriction of processing (in cases provided for by law).
- Right to Data Portability: Receive the data in a structured and readable format, and transmit it to another Controller.
- Right to Object: Object to processing based on legitimate interest or for marketing purposes.
You can exercise these rights by sending a request via email/PEC to the contacts indicated in point 1.
7. 🚨 Right to Lodge a Complaint
You have the right to lodge a complaint with the Supervisory Authority for the Protection of Personal Data (Piazza Venezia n. 11 – 00187 Rome, Italy) if you believe your rights have been violated.