Privacy Policy and Terms and Conditions

In accordance with the above-mentioned legislation, data processing will be based on the principles of fairness, lawfulness, transparency, and protection of your privacy and rights.
HOTEL AL BORDUCAN, registered office SANTI SRL, with registered office at Via Beata Caterina Moriggi 43 – 21100 Varese (VA), as Data Controller, hereby informs you, pursuant to Articles 13 and 14 of GDPR 2016/679, that your data will be processed in the manner and for the purposes set out below.

OBJECT OF THE TREATMENT

The Data Controller processes personal, identifying, and non-sensitive data (in particular, name, surname, tax code, VAT number, email address, mobile telephone number – hereinafter, “personal data” or “data”) communicated to him.

PURPOSE OF THE PROCESSING

The legal basis for the processing of your personal data is your consent and is carried out for the following purposes:

• > to allow the sending of newsletters and/or mailing lists, for communications, event organization and any additional Services requested;
• > to fulfill pre-contractual, contractual and tax obligations (VAT tax registration, etc.) arising from existing relationships;
• > to fulfill obligations established by law, by a regulation, by community legislation or by an order of the Authority;
• > to exercise the Data Controller’s rights, such as the right to defense in court.
• > to allow the sending of communications via messages from the broadcast list of the WhatsApp chat 0332 220567.
• Furthermore, the provision of Mandatory Data is necessary for SANTI SRL to execute the E-commerce Contract; said Mandatory Data will be necessary for SANTI SRL to process the User’s request and to satisfy the related legal, administrative, accounting, and tax obligations. Failure to provide such Mandatory Data will make it impossible to establish and/or continue the relationship.

METHODS OF TREATMENT

Personal data is processed using the operations indicated in Article 4 of the GDPR 2016/679 and Article 4(2) of the GDPR, specifically: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure, and destruction of data. Therefore, personal data is subject to both paper-based and electronic and/or automated processing.

DATA ACCESS

The data may be made accessible for the purposes set out in Articles 2.A) and 2.B):
– to employees and collaborators of SANTI SRL, of which the Data Controller is a member, in their capacity as persons in charge and/or internal data processors and/or system administrators;
– to SANTI SRL, of which the Data Controller is a member (for example, for support in the feasibility study of the client’s project, for technical project management activities, for the storage of personal data, etc.).

DATA COMMUNICATION

Without express consent (Article 6, letters b) and c) of the GDPR), the Data Controller may still communicate the data for the purposes referred to in Article 2.A) to supervisory bodies, judicial authorities, and all other entities to whom communication is required by law for the fulfillment of the aforementioned purposes. Your data will not be disclosed.

DATA TRANSFER

Personal data will be managed and stored on servers located within the Data Controller’s and/or Data Processor’s premises.
The data will not be transferred outside the European Union. In any case, it is understood that the Data Controller, should the need arise, will have the right to relocate the server. In such an event, the Data Controller hereby ensures that the data transfer will be carried out in compliance with legal provisions.

NATURE OF THE DATA PROVISION AND CONSEQUENCES OF REFUSAL TO RESPOND

Please note that, given the purposes of the processing as described above, the provision of data is mandatory and failure to provide it, or its partial or incorrect provision, may result in the inability to complete registration, enrollment in various courses, communications, WhatsApp messages, updates, and fulfill contractual obligations as set forth in the stipulated contract.

RIGHTS OF THE INTERESTED PARTY

As a data subject, you are granted the rights set forth in Article 15 of the GDPR, specifically the rights to:
a) obtain confirmation of the existence or otherwise of personal data, even if not yet recorded, and their communication in an intelligible form;
b) obtain the following information:

• of the origin of the personal data;
• of the purposes and methods of processing;
• of the logic applied in case of processing carried out with the aid of electronic instruments;
• of the identifying details of the owner, managers and the designated representative pursuant to art. 3 paragraph 1, GDPR 2016/679;
• of the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them in their capacity as designated representative in the territory of the State, managers or persons in charge;

c) obtain:

• the updating, rectification or, when necessary, integration of the data;
• the deletion, transformation into anonymous form or blocking of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;
• certification that the operations referred to in letters a) and b) have been brought to the attention, including with regard to their content, of those to whom the data have been communicated or disseminated, except in the case in which such fulfillment proves impossible or involves the use of means manifestly disproportionate to the right protected;

d) to object, in whole or in part:

• for legitimate reasons to the processing of personal data, if they are not relevant to the purpose of the collection;
• to the processing of personal data for the purpose of sending advertising material through the use of automated calling systems without the intervention of an operator, by email and/or through traditional marketing methods by telephone and/or paper mail.
• sending messages from the broadcast list of the WhatsApp chat 0332.220567; to refuse, simply write the word “STOP” in the chat.

Please note that the data subject’s right to object, set out in point b) above, for direct marketing purposes via automated means extends to traditional means, and that the data subject may exercise the right to object even partially. The data subject may decide to receive communications only via traditional means, only automated communications, or neither type of communication.
Where applicable, the rights set forth in Articles 16-21 of the GDPR (right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object) as well as the right to lodge a complaint with the Supervisory Authority are also available.

HOW TO EXERCISE YOUR RIGHTS

You may exercise your rights at any time by sending a document via registered mail to SANTI SRL, Via Beata Caterina Moriggi 43 – 21100 Varese (VA) or by email to info@broducan.com. If you wish to opt out of receiving messages via WhatsApp chat (0332.220567), simply write the word “STOP” in the chat.

MINORS

The data collected by the Data Controller is not intended for minors under 18, and the Data Controller does not intentionally collect personal information relating to minors. If information on minors is inadvertently recorded, the Data Controller will promptly delete it upon request.

DURATION OF TREATMENT

Personal data is retained for the entire duration of the relationship with SANTI SRL and in the event of revocation and/or other termination of the relationship.
The Data Controller will process personal data for the time necessary to fulfill the aforementioned purposes and, in any case, for no longer than 10 years after termination of the relationship.

OWNERS, MANAGERS AND APPOINTEES

The Data Controller is HOTEL AL BORDUCAN, company name SANTI SRL.

The updated list of data controllers and processors is kept at the Data Controller’s headquarters.