Privacy Policy

1. Data Controller

The data controller is:

2. Purpose of processing

Personal data collected through the online check-in form is processed exclusively for:

• complying with legal obligations related to the registration of guests with the competent authorities;
• managing arrival, check-in, and stay procedures at the property;
• organizing guest reception and all communications necessary for the stay.

3. Additional purposes – Requests for information and booking of experiences

If the guest requests information, expresses interest in, or books experiences, guided tours, or other additional services that may be offered, personal data may also be processed for:

• providing information about available experiences and services;
• handling booking requests or contact inquiries related to additional services;
• organizing and confirming any activities requested by the guest;
• communicating with the guest regarding the organizational details of the requested service.

4. Disclosure to third parties for additional services

If the guest requests or books experiences or services provided, in whole or in part, by external providers, certain personal data strictly necessary may be shared with such providers solely for the purpose of organizing and delivering the requested service.

Such disclosure will take place only to the extent necessary and in compliance with applicable regulations.

5. Legal basis for processing

The processing of personal data related to check-in is based on the fulfillment of legal obligations to which the data controller is subject, pursuant to Article 6(1)(c) of the GDPR.

With regard to any requests for information, bookings of experiences or additional services, processing may be based on the performance of pre-contractual measures taken at the data subject’s request and/or on the performance of the requested service.

6. Data collected

The data collected may include, depending on the guest’s role in the booking and the requested service:

• First and Last Name
• date of birth;
• place of birth;
• nationality;
• residential address;
• type of identity document;
• number of identity document;
• contact details voluntarily provided for information requests or service bookings;
• any additional information strictly necessary for registration or for organizing the requested services.

7. Processing methods

Data is processed using electronic tools and, where necessary, in paper form, with appropriate security measures in place to protect it against unauthorized access, disclosure, alteration, or destruction.

8. Data recipients

Personal data may be disclosed exclusively to parties whose knowledge is necessary for the purposes outlined above, including:

• Public Security Authorities and other competent bodies as required by law;
• any technical or IT service providers involved in managing the form and the website, strictly to the extent necessary;
• any external providers of experiences or additional services requested by the guest;
• altri soggetti nei casi espressamente previsti dalla normativa vigente.

9. Data retention

Personal data will be retained for the time strictly necessary to fulfill legal obligations and, in any case, no longer than the period required by applicable law or necessary to protect the rights of the data controller.

10. Provision of data

Providing the data required for check-in is mandatory for staying at the property, as it is necessary to comply with legal registration obligations. Failure to provide such data may make it impossible to proceed with check-in.

Providing data for requests for information or bookings of experiences and additional services is optional; however, failure to provide such data may make it impossible to process the request.

11. Data subject’s rights

The data subject may exercise, within the limits set out in Articles 15–22 of the GDPR, the following rights:

• access to their personal data;
• correction of inaccurate or incomplete data;
• cancellation, where applicable within the limits of legal obligations;
• restriction of processing in the cases provided for by applicable law;
• objection, where applicable;
• to lodge a complaint with the competent supervisory authority.

12. Data transfers

Personal data will not be disclosed. Any processing carried out through digital tools or third-party services will be managed in compliance with applicable regulations and, where necessary, with appropriate data protection safeguards.