Privacy Policy

INFORMATION NOTICE – Prospective Customer Data –   CSH s.r.l., with registered office at Via Carlo Freguglia 10 – 20122 Milan, VAT No. 02698040355, manages hotel facilities through the following two wholly owned subsidiaries: (i) Mantova Gestioni Alberghiere s.r.l. – Hotel La Favorita – with registered office in Mantua, Via S. Cognetti De Martiis, 1, hereinafter “MGA s.r.l.”, and Alessandria Gestioni Alberghiere s.r.l. – Hotel Diamante – with registered office in Spinetta Marengo, Alessandria, Viale della Valletta, 180, hereinafter “AGA s.r.l.”. With regard to the processing of data collected within the scope of the above-mentioned activities, CSH, AGA and MGA act as Joint Controllers pursuant to Article 26 of GDPR 679/2016; in this capacity, the Joint Controllers hereby inform you pursuant to Article 13 of EU Regulation No. 2016/679 – GDPR – that your data will be processed in the following manner and for the following purposes:

1. Subject of the Processing

The Joint Controllers process personal data, namely “identification” data – such as: first name, last name, tax code, address, telephone number, email address, etc. – received during informational exchanges with the hotel facilities (e.g. trade fairs, conferences, quotation requests via email, booking requests via email, website or third-party channels, fax, telephone, social media, etc.).

2. Purpose of the Processing

Your personal data will be processed, subject to your specific and express consent, for the purpose of sending you newsletters, commercial communications and/or advertising material relating to products or services offered by the Joint Controllers via email, post, SMS and/or telephone contact. Your data will be shared among the Joint Controllers: CSH s.r.l., Mantova Gestioni Alberghiere s.r.l. and Alessandria Gestioni Alberghiere s.r.l., companies belonging to the same corporate group.

3. Processing Methods

Your personal data is processed through the operations referred to in Article 4 no. 2) GDPR, namely: collection, recording, storage, consultation, use, deletion and destruction. Your personal data is processed both in paper form and electronically and/or through automated means. With regard to Marketing purposes – sending commercial communications and/or advertising material concerning products and/or services offered by the Joint Controllers – the latter, following the collection of your original consent through the signing of this notice, will process your personal data until your explicit withdrawal of consent, which may be exercised through the specific link included at the bottom of the newsletters periodically sent by the Joint Controllers. In the absence of an explicit withdrawal of consent, such consent shall be deemed renewed. The Processing shall in any case be carried out in accordance with the principles of fairness, lawfulness and transparency and by means of tools and procedures aimed at preventing the risk of loss, unauthorized access, unlawful use and disclosure.

4. Access to Data

Your personal data may be made accessible for the purposes referred to in Article 2: – to employees and collaborators of the Joint Controllers, in their capacity as persons authorized to process data; – to third-party companies or other entities – by way of example: professional firms, consultants, etc. – carrying out outsourced activities on behalf of the Joint Controllers, in their capacity as Data Processors.

5. Disclosure of Data

Without the need for express consent – pursuant to Article 6 letters b) and c) GDPR – the Joint Controllers may disclose your personal data, for the purposes referred to in Article 2, to Supervisory Authorities, Judicial Authorities, as well as to those parties to whom disclosure is mandatory by law and/or necessary for the execution of the mandate. Such parties shall process the data in their capacity as independent Data Controllers. Your data will not be disseminated.

6. Data Transfer

Your personal data is stored in paper archives located at the premises of MGA s.r.l. and AGA s.r.l., respectively in Mantua and Alessandria, as well as on servers located within the European Union. It is understood that, where necessary, the Joint Controllers may transfer the servers and archives outside the EU. In such cases, the Joint Controllers hereby ensure that any transfer of data outside the EU will be carried out in compliance with applicable legal provisions, subject to the execution of the standard contractual clauses provided by the European Commission.

7. Nature of Data Provision and Consequences of Refusal to Provide Data

The provision of data for Marketing and advertising purposes is optional: therefore, you may decide not to give your consent for such purposes or subsequently deny the processing of data already provided. In the latter case, you will not be able to receive newsletters, commercial communications and advertising material relating to the Services offered by the Joint Controllers.

8. Source of Personal Data

Your data has become available to the Joint Controllers through the activities already referred to in Article 1 above.

8. Withdrawal of Consent

The consent originally provided may be withdrawn at any time by communicating such intention to the Joint Controllers using the contact details referred to in Article 10 below. Any processing carried out prior to such withdrawal shall remain valid and lawful.

9. Rights of the Data Subject

With regard to the processing of personal data, you have the right: -to be informed about: the identity and registered office of the Joint Controllers; the purposes and methods of processing; the identity and registered office of the Data Processor; -to obtain from the Joint Controllers or the Processor, without delay: 1) confirmation as to whether or not personal data concerning you is being processed and communication in intelligible form of such data and their origin, as well as the purposes upon which the processing is based; 2) the deletion of personal data concerning you when: i) such data is no longer necessary for the purposes for which it was collected, ii) consent has been withdrawn and there is no other legal basis for processing, iii) the data has been processed unlawfully, iv) the data subject has objected to the processing and there are no overriding legitimate grounds for continuing the processing v) the Joint Controllers are subject to a legal obligation requiring the deletion of personal data; 3) the updating, rectification or, where interested therein, integration of the data; 4) certification that the operations referred to in points 2) and 3) have been notified, including their content, to those to whom the data has been communicated or disclosed, unless this proves impossible or involves a manifestly disproportionate effort compared to the protected right; – to object, on grounds relating to your particular situation, to the processing of personal data concerning you pursuant to Article 6(1)(e) or (f); – to object to the processing of personal data concerning you for direct marketing purposes; – to lodge a complaint with a supervisory authority; – to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit such data to another Joint Controller without hindrance from the Joint Controller to whom the data was originally provided. In exercising the right to data portability, the data subject has the right to obtain the direct transmission of personal data from one Joint Controller to another, where technically feasible; – not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. The Joint Controllers shall provide a copy of the personal data undergoing processing; in the event of further copies requested by the data subject, the Joint Controllers may charge a fee based on the actual administrative costs incurred.

10. Methods for Exercising Rights

You may exercise the above rights at any time by contacting at least one of the Joint Controllers: – by registered mail with return receipt addressed to Alessandria Gestioni Alberghiere s.r.l. (AGA s.r.l.), with registered office in Alessandria, Spinetta Marengo, Viale della Valletta no. 180, or to Mantova Gestioni Alberghiere s.r.l. (MGA s.r.l.), with registered office in Mantua, Via S. Cognetti De Martiis, 1; – by email to amministrazione@hotellafavorita.it or amministrazione@hoteldiamantealessandria.it – by using the specific link included at the bottom of the emails received in order to unsubscribe from communications, promotions, etc.

11. Joint Controllers and Data Processor

The Joint Controllers are CSH s.r.l., with registered office at Via Carlo Freguglia 10 – 20122 Milan, VAT No. 02698040355, Alessandria Gestioni Alberghiere s.r.l. (AGA s.r.l.), with registered office in Spinetta Marengo, Alessandria, Viale della Valletta 180, and Mantova Gestioni Alberghiere s.r.l. (MGA s.r.l.), with registered office in Mantua, Via S. Cognetti De Martiis, 1. The updated list of Data Processors is kept at the offices of MGA s.r.l. and AGA s.r.l.. * CONSENT   By ticking the appropriate box, you declare: – that you have read the above Information Notice; – that you have read the entire text; – that you have understood its content. Given the above:

• You consent to the processing of your data for Marketing purposes – sending commercial communications and/or advertising material relating to products and/or services offered by the Joint Controllers;
• You consent to receiving communications from the Reception Desk;

or You consent to the processing of your special categories of personal data for the purpose of handling the procedures related to your requests for information and/or stays.