INFORMATION ON PERSONAL DATA
RODHOTEL SRL based in Via Calzaiuoli 13, 50100 FLORENCE c.f and p.iva 01843640473 as Data Controller, informs you pursuant to art. 13 EU Regulation n. 2016/679 – GDPR – that your data will be processed in the manner and for the following purposes:
Type of data processed
The Data Controller processes personal data, called « identifiers » – for example: name, surname, social security number, address, telephone number, e-mail address, bank and payment details, etc. – communicated by you.
2. Purpose of the processing
Personal data « identification » are processed without your express consent to allow the execution of the contract between you and the Company (registration, invoicing, etc.).
The Data Controller will process « identifying » data, subject to your expressed and specific consent, for marketing purposes, by sending newsletters, commercial communications and / or advertising material, on products or services offered by the Data Controller.
3. Processing methods
The processing of personal data is carried out by means of the operations indicated in art. 4 n. 2) GDPR and more precisely: collection, registration, organization, conservation, consultation, processing, extraction, communication, cancellation and destruction.
The Data Controller will process personal data for the time necessary to fulfill the aforementioned purposes and in any case for no more than 10 years from the termination of the relationship and no later than 2 years from the collection of consent for the purposes of Marketing – sending commercial communications and / o advertising material on products and / or services offered by the Owner.
The processing is carried out with electronic and manual systems according to the principles of correctness, lawfulness and transparency required by law through technical and organizational security measures to guarantee an adequate level of security.
4. Access to data
Personal data may be made accessible for the purposes referred to in art. 2:
– to employees and collaborators of the Data Controller, in their capacity as persons in charge of processing;
– to third-party companies or other subjects – by way of example: parties that provide services for the management of the information system; professed in the context of assistance and advice; private parties directly involved in the performance of the service or legitimized to know the data according to the law, in their capacity as External Managers of the Treatment.
5. Communication of data
The collected data will not be disseminated; without the need for express consent – art. 6 lett. b) and c) GDPR – the Data Controller may communicate personal data for the purposes referred to in art. 2 a: Inspection bodies, judicial authorities, as well as to those subjects to whom the communication is mandatory by law and / or for the execution of the mandate. These subjects will process the data in their capacity as independent data controllers.
6. Data transfer
Personal data are stored in paper archives located at the company’s headquarters and on servers located within the European Union.
In any case, it is understood that the Data Controller, if necessary, will have the right to move the servers even outside the EU. In this case, the Data Controller hereby ensures that the transfer of non-EU data will take place in accordance with the applicable legal provisions, subject to the stipulation of the standard contractual clauses provided by the European Commission.
7. Nature of the provision of data and consequences of refusal to reply
The provision of personal identification data is mandatory and essential and, failing that, we can not guarantee the service contractually required.
The provision of data for the purposes of marketing and advertising is, however, optional: it can therefore decide not to give consent for such purposes or to subsequently deny the possibility of processing data already provided.
In the latter case, you will not receive newsletters, commercial communications and advertising material relating to the Services offered by the Data Controller.
However, it will continue to be entitled to the various services falling within the scope of the art. 2.
8. Rights of the interested party
In relation to the processing of personal data you are entitled:
-to be informed about: data and headquarters of the Data Controller; the purposes and methods of processing; data and headquarters of the Data Processor;
-to obtain, by the Data Controller or the Data Processor, without delay:
1) confirmation of the existence of a treatment of his personal data and their communication in an intelligible form;
2) the deletion of your personal data when: I) the same are no longer necessary with respect to the purposes for which they were collected, II) the consent has been revoked and there is no other legal basis for processing, III) the data are been treated in violation of the law, IV) the interested party has opposed the processing and there is no legitimate overriding reason to proceed to the same treatment V) the owner is subject to the legal obligation to delete personal data;
3) updating, rectification or, if interested, integration of data;
4) the attestation that the operations referred to in numbers 2) and 3) have been brought to the attention, also with regard to their content, of those to whom the data have been communicated or disseminated, except in the case where such fulfillment it proves impossible or involves a use of means manifestly disproportionate to the protected right;
– to oppose for reasons connected with his particular situation, to the processing of personal data concerning him, pursuant to art. 6, paragraph 1, points e) or f);
– to oppose the processing of personal data concerning you, for the purposes of direct marketing;
– to propose a complaint to a supervisory authority;
– to receive, in a structured and legible format, from an automatic device the personal data concerning him and to transmit such data to another Data Controller without impediments by the Owner to whom he originally provided them. In exercising its rights with regard to the portability of data, the data subject has the right to obtain the direct transmission of personal data from one Data Controller to another, if technically feasible;
– not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects that affect it or which can have a similar impact on its person.
– to revoke the consent at any time without prejudice to the lawfulness of the treatment based on the consent given prior to the revocation.
The Holder provides a copy of the personal data being processed; in case of further copies requested by the interested party, the Holder may charge an expense contribution based on the administrative costs actually incurred.
9. How to exercise rights
You may exercise the above rights at any time by sending to the attention of the Data Controller:
– a registered letter A.R. at RODHOTEL SRL Via Calzaiuoli 13, 50100 FLORENCE
– an e-mail address: email@example.com
10. Responsible Holder and Distributors
The data controller is RODHOTEL SRL Via Calzaiuoli 13, 50100 FLORENCE. The updated list of data processors and data processors is kept at the registered office of the Data Controller.