Information for Data Subjects on the Processing of Personal Data
Information for data subjects on the processing of personal data pursuant to Article 13 and Article 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “Regulation”).
In connection with the operation of the Valmare Italia website, the handling of enquiries, the management of reservations, the provision of accommodation, compliance with legal obligations, marketing communication and the operation of the website, your personal data are processed. Personal data are processed transparently, securely and only to the extent necessary for the relevant purpose of processing.
The Regulation requires that, when collecting data, the data subject be provided in particular with information on the identity of the controller, the purposes of processing, the legal basis, recipients, retention period and the rights of the data subject. All such information is provided in the text below.
A. Identification of the Controller by Location
The Valmare Italia website offers accommodation in several locations in Italy. The controller of the personal data of the data subject is, depending on the specific location, accommodation or reservation, the relevant entity responsible for providing accommodation in that location.
If the data subject submits an enquiry through the website, makes a reservation or communicates in relation to specific accommodation, their personal data are processed primarily by the controller responsible for the given location or accommodation.
Tuscany – Podere Val d’Orcia / Val d’Orcia
Controller:SOCIETA’ AGRICOLA PODERE VAL D’ORCIA SRL
Via Val d’Orcia 4
53047 Sarteano / SI / Italian Republic
VAT ID / VAT: 01431600525
SDI Code: WY7PJ6K
E-mail: to be completed
Telephone: to be completed
Sardinia – Costa Domus / Costa Paradiso
Controller:Sekera Milan
Via Littu Di Zoccaru, 50
Loc. Costa Paradiso /SS/ Italian Republic
VAT ID / VAT: 02995930902
SDI Code: WY7PJ6K
E-mail: to be completed
Telephone: to be completed
If an enquiry or reservation concerns multiple locations, the personal data of the data subject may, to the extent necessary, be disclosed to the relevant controllers, accommodation managers or persons responsible for communication with guests and reservation management.
If the data subject submits a general enquiry without selecting a specific location or accommodation, their personal data are processed for the purpose of handling the enquiry and may subsequently be forwarded to the relevant controller depending on which location or accommodation the communication concerns.
For the purposes of this document, the term “controller” always refers to the relevant controller according to the selected location, specific accommodation or reservation, unless the context indicates otherwise.
The controller is not obliged to appoint a Data Protection Officer pursuant to Article 37 of the Regulation. In the event of any questions concerning the processing of personal data or the exercise of the rights of the data subject, the relevant controller may be contacted using the contact details provided for the respective location.
B. Data Subject
For the purposes of the Regulation, a data subject means any identified or identifiable natural person whose personal data are processed. In the case of the services provided by us, this usually includes persons interested in accommodation, accommodated persons and guests.
The controller obtains personal data either directly from you, the data subject, or from third parties — intermediaries and booking platforms through which you booked the accommodation.
C. Legal Basis for the Processing of Personal Data
Where the legal basis is consent: The data subject has the right to withdraw their consent at any time, in particular by sending a request to the controller’s e-mail address, by sending a written request to the registered office address of the controller, or by another appropriate and demonstrable method. Withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal.
Where the legal basis is a contract: The provision of personal data is, in this case, a contractual requirement. Failure to provide personal data may make it impossible to conclude and perform the contractual relationship.
Where the legal basis is the law: The provision of personal data is, in this case, a legal requirement. The data subject is obliged to provide personal data, and failure to provide such data makes it impossible for the controller to properly fulfil obligations arising from the relevant generally binding legal regulations.
Where the legal basis is legitimate interest: In this case, the provision of personal data is necessary to achieve the purpose pursued by the controller.
D. Principles of Personal Data Processing
The controller strictly respects the principles of processing personal data of data subjects and their privacy, is responsible for complying with them and is able to demonstrate such compliance, ensuring in particular that personal data are:
- processed lawfully, fairly and transparently;
- collected for specified, explicit and legitimate purposes;
- adequate, relevant and limited to the extent necessary to achieve the relevant purpose of processing;
- accurate and, where necessary, kept up to date;
- kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
- processed in a manner that ensures appropriate security of personal data.
E. Transfer of Personal Data
The controller does not actively intend to carry out cross-border transfers of personal data of data subjects to third countries outside the European Economic Area (EU, Iceland, Norway and Liechtenstein).
In the event of a transfer of personal data of data subjects to a third country or an international organisation, the controller undertakes to inform data subjects in advance of the existence or absence of an adequacy decision by the European Commission.
In connection with the use of booking platforms, in particular Booking.com, Airbnb and Expedia, personal data may be transferred to third countries outside the European Economic Area, to the extent determined by the terms and conditions of the respective platform.
F. Rights of Data Subjects
Data subjects have the following rights in relation to the processing of personal data under the Regulation:
Right of Access
The data subject has the right to obtain confirmation from the controller as to whether personal data concerning them are being processed and, where that is the case, the right to access such personal data.
Right to Rectification
It is in the controller’s interest to process only up-to-date personal data concerning the data subject; therefore, we ask data subjects to actively exercise their right to complete incomplete personal data and to correct inaccurate personal data.
Right to Erasure
The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, where one of the grounds set out in Article 17 of the Regulation applies and, at the same time, there is no reason to refuse the request.
Right to Restriction of Processing
The data subject has the right to obtain from the controller the restriction of processing of personal data where one of the cases referred to in Article 18 of the Regulation applies.
Right to Data Portability
Where the processing of personal data is carried out by automated means and the legal basis for the processing of personal data is the consent of the data subject or the performance of a contract, the data subject has the right to receive the personal data concerning them in a structured, commonly used and machine-readable format.
Right to Object and Automated Individual Decision-Making
The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them which is carried out for the purposes of the legitimate interests pursued by the controller.
Right to Lodge a Complaint
The data subject has the right to lodge a complaint with a supervisory authority. For the territory of the Italian Republic, the supervisory authority is:
Garante per la protezione dei dati personaliPiazza Venezia 11
00187 Rome
Italian Republic
Website: https://www.garanteprivacy.it/
E-mail: protocollo@gpdp.it
The above rights may be exercised by the data subject by sending a request to the e-mail address of the controller, by sending a written request to the address of the controller, or in person at the registered office address of the controller.
The controller shall provide the data subject, without undue delay, with information on the measures taken in response to the data subject’s request, no later than one month from receipt of the request. This period may, where necessary, be extended by a further two months.
G. Purposes of Personal Data Processing and Legal Bases for Processing
The controller processes personal data of data subjects for the following purposes and on the basis of the relevant legal bases under the Regulation:
1. Statutory Records and Reporting Obligations
Processing of guests’ personal data for the purpose of complying with legal obligations, in particular maintaining records of accommodated persons and fulfilling reporting obligations towards public authorities, such as the police, municipal and tax obligations.
Categories of personal data: in particular identification data, name, surname, date of birth, identity document details, permanent residence address, nationality and stay-related data.
Legal basis: compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR Regulation.
Personal data are provided to the Italian public security authorities (Polizia di Stato) through the Alloggiati Web system in accordance with applicable Italian regulations.
2. Contractual and Invoicing Purposes
Processing of personal data for the purpose of concluding and performing the accommodation contract, including the issuance of accounting and tax documents.
Categories of personal data: identification and contact details, name, surname, address, e-mail, telephone number, invoicing details and data on the service provided, period of stay, price and number of persons.
Legal basis: performance of a contract pursuant to Article 6(1)(b) of the GDPR Regulation and compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR Regulation.
Personal data may be provided to the controller’s accounting, tax and legal advisers. The data are retained for the duration of the contractual relationship and subsequently for a period of 10 years from the end of the accounting year in which the service was provided.
3. Reservation and Communication Process
Processing of personal data when handling reservations, communicating with guests and ensuring the provision of accommodation services.
Categories of personal data: identification and contact details, name, surname, e-mail, telephone number, reservation details, period of stay, number of persons, guest requests and communication data.
Legal basis: performance of a contract and pre-contractual measures pursuant to Article 6(1)(b) of the GDPR Regulation and the legitimate interest of the controller pursuant to Article 6(1)(f) of the GDPR Regulation.
Personal data may, to the extent necessary, be disclosed to booking platforms Booking.com, Airbnb, Expedia and providers of IT and communication services.
4. Marketing Communication
Processing of personal data for the purpose of sending marketing offers and information about services, for example by e-mail or newsletter, solely on the basis of the consent granted by the data subject.
Categories of personal data: identification and contact details, in particular e-mail, name and surname.
Legal basis: consent of the data subject pursuant to Article 6(1)(a) of the GDPR Regulation.
Personal data are not provided to third parties for this purpose, with the exception of technical providers of marketing tools. The data are processed until the data subject withdraws their consent, but for no longer than 2 years from the last interaction of the data subject with the controller.
5. Cookies and Analytical Tools
Processing of data through cookies to ensure the functioning of the website, its improvement and analytical purposes.
Legal basis: consent of the data subject pursuant to Article 6(1)(a) of the GDPR Regulation, or the legitimate interest of the controller in the case of necessary cookies pursuant to Article 6(1)(f) of the GDPR Regulation.
More information is provided in the separate cookie policy, which is available at the relevant link.
Within the above-mentioned purposes of processing, the controller does not carry out automated decision-making, including profiling, which would produce legal effects concerning the data subject or similarly significantly affect them within the meaning of Article 22 of the Regulation.