This statement contains the indication of the rules and directives followed by travelroma hotels regarding the processing of personal data of users of the website www.whitehotel.com
Since the website operates and is hosted in Italian territory, the information and data concerning the website users will be processed by travelroma hotels in compliance with the Italian regulations implementing the European Parliament and Council directives 95/46/EC and 2002/58/EC, that is, in accordance with Legislative Decree no. 196 of June 30, 2003 and subsequent amendments and integrations.
1. Purpose and methods of data processing
travelroma hotels informs users that the collected data will be used solely for the purposes specified below and to keep users updated on news, promotions, contests, and activities of travelroma hotels in general.
Apart from communications and disclosures made to fulfill legal obligations, the data may be communicated within Italy and/or abroad to:
- credit institutions
- debt collection companies
- credit insurance companies
- commercial information companies
- professionals and consultants,
- insurance companies
- private laboratories and public bodies appointed by us for conducting tests and analyses
- for direct marketing activities, including sending newsletters, MMS or SMS messages, or others
- for informational activities;
- for creating professional profiles of customers or consumers
- for market research or other research aimed at improving our products or services.
The collected data may be processed in electronic, magnetic, telematics, or paper form, and will always be protected by appropriate security systems that are constantly updated and stored in a safe and controlled environment.
2. Data provision and consequences of any refusal
Providing the data is optional, except in cases where the collected data must be used to execute a contract or a service requested by the user. In such cases, refusal by the data subject to provide the data will result in the inability of travelroma hotels to fulfill the received request.
3. Data processors and scope of dissemination
The personal data entered by the user will be known and used by the employees of travelroma hotels and/or its foreign subsidiaries solely for the purpose of carrying out activities that constitute the reason for which the data were collected (e.g., for the execution of sales or service contracts or for the sending of newsletters). The data may be communicated to other controlling, controlled and/or affiliated companies of the travelroma hotels group in Italy, the European Union, or non-EU countries, provided that the legislation of the destination or transit country ensures an adequate level of protection for individuals. Adequacy will be assessed by comparing the systems of the foreign country with the Italian one.
Data may also be communicated to providers of electronic communication services, banks, financial intermediaries, credit institutions, other financial bodies, centralized IT system operators (e.g., risk centers, fraud detection, etc.), insurance companies, consultants, and professionals who assist travelroma hotels in credit recovery and dispute management, companies providing packaging, shipping and delivery services for purchases, or organizing the mailing of correspondence and commercial information, research entities, or non-profit associations or foundations.
4. Rights of the data subject
The data controller and processor of the collected data is travelroma hotels, located at Via Monte Baldo, 2 - 37062 Villafranca (VR), to which the data subjects may write to exercise the rights provided by Article 7 of Legislative Decree 196/2003, namely to:
- obtain information on the origin of personal data, the purposes and methods of processing, the logic applied in case of processing using electronic tools; the details of the data controller, subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it;
- obtain the update, rectification, or integration of the data, the deletion, anonymization, or blocking of data processed in violation of the law, including those not required to be retained for the purposes for which the data were collected or subsequently processed, and the confirmation that the operations requested have been communicated, including their content, to those to whom the data were communicated or disseminated, except in cases where such compliance is impossible or involves the use of disproportionate means compared to the protected right;
- object, for legitimate reasons, to the processing of personal data concerning them, even if relevant to the purpose of collection, or to the processing of personal data for the purpose of sending advertising material, direct sales, market research, or commercial communication.
Article 7. Right of access to personal data and other rights (Legislative Decree 196/2003)
- The data subject has the right to obtain confirmation of the existence or non-existence of personal data concerning them, even if not yet recorded, and their communication in intelligible form.
- The data subject has the right to obtain the indication:
a) the origin of the personal data;
b) the purposes and methods of processing;
c) the logic applied in case of processing using electronic tools;
d) the identification details of the controller, the processors, and the representative designated under Article 5, paragraph 2;
e) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it as designated representative in the State territory, processors, or agents.
- The data subject has the right to obtain:
a) the update, rectification, or, when necessary, the integration of the data;
b) the deletion, anonymization, or blocking of data processed in violation of the law, including those not necessary to be retained for the purposes for which the data were collected or subsequently processed;
c) the confirmation that the operations mentioned in items a) and b) have been communicated, including their content, to those to whom the data were communicated or disseminated, except when such compliance is impossible or involves the use of disproportionate means compared to the protected right.
- The data subject has the right to object, in whole or in part:
a) for legitimate reasons to the processing of personal data concerning them, even if relevant to the purpose of collection;
b) to the processing of personal data for the purpose of sending advertising material, direct sales, market research, or commercial communication.
Article 13. Information (Legislative Decree 196/2003)
- The data subject or the person from whom the personal data is collected must be informed in advance, either orally or in writing, regarding:
a) the purposes and methods of processing the data;
b) whether the provision of data is mandatory or optional;
c) the consequences of any refusal to respond;
d) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it as processors or agents, and the scope of dissemination of the data;
e) the rights under Article 7;
f) the identification details of the data controller and, if designated, the representative in the State territory under Article 5 and the processor. When the controller has designated multiple processors, at least one of them must be indicated, including the communication network site or the ways in which the updated list of processors is available. If a processor has been designated for responding to the data subject regarding the exercise of rights under Article 7, the responsible person must be indicated.
- The information provided under paragraph 1 also contains the elements required by specific provisions of this code and may exclude elements already known to the person providing the data or whose knowledge may hinder the performance of functions carried out by a public subject for state defense or security purposes or for crime prevention, detection, or repression.
- The Garante may establish simplified methods for the information provided, especially for telephone assistance services and public information.
- If the personal data is not collected from the data subject, the information under paragraph 1, including the categories of data processed, must be provided to the data subject at the time of data registration or, when their communication is required, no later than the first communication.
5. The provision of paragraph 4 does not apply when:
- a) the data is processed based on a legal obligation, a regulation, or EU law;
- b) the data is processed for the purpose of defensive investigations under Law no. 397 of December 7, 2000, or, in any case, to assert or defend a right in judicial proceedings, provided that the data is processed exclusively for these purposes and for the period strictly necessary to achieve them;
- c) informing the data subject requires the use of means that the Garante, prescribing appropriate measures, deems manifestly disproportionate to the protected right, or it is, in the judgment of the Garante, impossible.
