Information on personal data processing

“Albergo Maddalena sas” with registered office at Viale Dante 307, 47838 Riccione, VAT No./Tax Code: 01491210405, as Data Controller of personal data, pursuant to and by effect of EU Regulation 2016/679, hereinafter the “GDPR”, hereby notifies that the aforementioned legislation provides for the protection of data subjects with regard to the processing of personal data and that such processing shall be based on the principles of lawfulness, fairness and transparency and the protection of privacy and rights. 
Personal data shall be processed in accordance with the legislative provisions of the above legislation and the confidentiality obligations provided therein.

Purposes of data processing:

Service provision: personal data shall be processed to respond to any requests that may be received via any forms filled in, including those available on the website, or to requests received by email.

Legal basis:

the legal basis of data processing is contractual in nature, within the terms and conditions in which data processing is provided for in response to a request for information followed by a reply.

Marketing - newsletter subscription service: in particular, data shall be processed, subject to consent being freely granted, to allow for receipt of newsletters, following the inputting of an email address in the box containing information regarding newsletter subscription, or checking/ticking the box indicating “newsletter subscription” on a form.

Legal basis: The legal basis for processing is consent granted by the data subject.

Compulsory or optional nature of data provision:

Conferring data is optional with regard to the aforementioned purposes of service provision. Failure to complete the required fields or any fields marked with an asterisk, means it is impossible to continue with the requests for information; any refusal to allow data processing does not compromise continuation of the relationship or the accuracy of data processing itself. 
For marketing purposes, consent is voluntary, separate and optional. Failure to grant consent does not affect site browsing or the provision of the services requested.

Data processing methods:

personal data shall be processed by primarily electronic means such as:

• by means of electronic computers using software systems managed by third parties;
• by means of electronic computers using directly managed or programmed software systems;
• temporary processing in aggregated anonymous form.

All data processing shall be carried out in compliance with the methods set out in Articles 6 and 32 of the GDPR and by adopting the appropriate security measures.

Communication:

personal data shall be communicated exclusively to subjects that are competent and duly appointed to provide the services necessary for correct management of the relationship, with a guarantee of protection of data subject rights. 
Personal data shall be processed only by personnel expressly authorised by the Data Controller and more specifically, by personnel appointed to maintain and update the website and, should it prove necessary, by personnel appointed to carry out marketing communication.

Recipients

Any other technical subjects who need to be aware of the data in order to perform their task, such as guaranteeing correct execution of the newsletter subscription request.

Third countries:

personal data shall not be communicated to non-EU countries.

Disclosure:

personal data shall not be disclosed in any way.

Data retention period

Please be informed that, in compliance with the principles of lawfulness, purpose limitation and data minimisation, pursuant to Article 5 of the GDPR, the retention period for personal data is established for a period of time not exceeding fulfilment of the purposes for which they were collected and processed, and in compliance with the time frame for correct provision of the services requested.

Data Controller:

pursuant to applicable legislation, the Data Controller is “Hotel Maddalena sas”, with head office at Viale Dante 307, 47838 Riccione, VAT no./Tax Code: 01491210405, in the person of its legal representative pro tempore. 
The data subject has right to obtain from the Data Controller, the erasure (possible right to be forgotten), limitation, updating, rectification and portability of personal data and to object to its processing, as well as, in general, to exercise all the rights provided for by Articles 15, 16, 17, 18, 19, 20, 21 and 22 of the GDPR, where applicable with respect to the purposes of data processing.

EU Regulation 2016/679: Articles 15, 16, 17, 18, 19, 20, 21 and 22 - Rights of the Data Subject

1. The data subject has the right to obtain confirmation as to whether or not any personal data concerning him or her exist, even if not yet recorded, and communication of such data in intelligible form. 
2. The data subject has the right to be informed on: 
a. the origin of the personal data; 
b. the purposes and methods of processing; 
c. the logic applied in the event of processing carried out with the aid of electronic instruments; 
d. the identity of the Data Controller, the managers and the representative appointed pursuant to Article 5, paragraph 2; 
e. the subjects or categories of subjects to whom the data may be communicated or who may learn about the data as appointed representative in the territory of the state, managers or agents. 
3. The data subject has the right to obtain: 
a. the updating, rectification or, when interested in so doing, integration of data; 
b. the cancellation, transformation into anonymous form or blocking of data processed in breach of the law, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed; 
c. confirmation to the effect that the operations in points a) and b) have been notified, also in relation to their content, to those to whom the data were communicated or disclosed, unless this requirement proves impossible or involves a manifestly disproportionate effort compared to the right being protected; 
d. data portability. 
4. The data subject has the right to object, in whole or in part: 
a. for legitimate reasons, to the processing of personal data concerning him or her, even if pertinent to the purpose of collection; 
b. to the processing of personal data concerning him or her for the purpose of sending advertising or direct sales material or for conducting market research or commercial communications.

Consent
Procedure for obtaining data subject consent

Data subject consent to receive the newsletter shall be recorded (IP address, email, date and time) by ticking the box below insertion of the email, or after checking/clicking on the appropriate box, and pressing “send”/ “ok”. Such consent shall be stored to prove it has been provided and to allow the data subject to unsubscribe at any time, in addition to all the other rights mentioned above.