Processing of personal data — Reg. (EU) 2016/679 (GDPR)
This privacy policy describes how the personal data of users visiting biancaducale.it and of those who come into contact with our accommodation facility are processed. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and Italian Legislative Decree 196/2003 as amended (the Privacy Code). Processing is carried out in accordance with the principles of lawfulness, fairness, transparency, data minimisation and security.
The Data Controller is:
Albergo Panoramic S.r.l.
Registered office: Lungomare Trieste, 66 — 30021 Caorle (VE), Italy
VAT no.: 02891410272
Email: info@biancaducale.it
Certified email (PEC): hotelpanoramic.it@pec.it
The Controller has not appointed a Data Protection Officer (DPO), as the legal requirements under Article 37 GDPR do not apply. For any matter relating to the processing of data, you may contact the Controller directly at the details above.
The Controller processes the following categories of personal data:
First name, surname, email address, telephone number. Collected through the contact and quote request forms, or provided voluntarily via email, chat or WhatsApp Business. Any data relating to minors is provided by parents or those exercising parental responsibility.
IP address, browser type, operating system, pages visited, date and time of access. Collected automatically by the IT systems during browsing. Approximate geolocation data possibly provided by the browser.
Email address provided voluntarily to receive promotional communications and updates about the facility.
Data relating to the booking and stay: arrival and departure dates, room type, number of guests, special requests. Guests' identification data and identity documents, collected at check-in to comply with the obligations under Article 109 of the Italian Consolidated Public Security Act (R.D. 773/1931) and transmitted electronically to the competent Police Headquarters via the Alloggiati Web portal within 24 hours of arrival (within 6 hours for stays not exceeding 24 hours). These data are processed without the need for consent, as necessary to comply with a legal obligation (Art. 6(1)(c) GDPR).
When the user voluntarily provides, in the notes fields of the website forms, via email, chat or telephone, information such as allergies, food intolerances, specific dietary needs, disabilities or accessibility requirements, such information constitutes special category data under Article 9 GDPR (health-related data). This data is processed solely to organise and personalise the stay according to the needs communicated (for example, assigning an accessible room or noting a dietary requirement). The legal basis is the explicit consent of the data subject pursuant to Article 9(2)(a) GDPR, which is deemed given by voluntarily providing such information for the stated purpose. Users are invited to communicate only the data strictly necessary to meet their needs. This data is not used for any other purpose and is kept only for as long as necessary to manage the stay.
First name, surname, credit/debit card details, expiry date, type. Payment data is processed directly by specialised external providers (e.g. the booking engine and payment providers) acting as independent controllers or processors. The Controller does not store complete payment card data.
Data collected through cookies and similar tools. For details, please refer to the website's Cookie Policy.
Images recorded by video surveillance systems that may be present in common areas and at the entrance, for the purpose of safety of persons and property.
Personal data is processed for the following purposes and on the following legal bases:
Responding to requests sent via the website forms, email or messaging. Legal basis: performance of pre-contractual measures requested by the data subject (Art. 6(1)(b) GDPR).
Confirming and managing the booking, organising check-in and check-out, providing the requested services and assistance during the stay. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Meeting needs communicated voluntarily (allergies, intolerances, disabilities, accessibility). Legal basis: explicit consent of the data subject (Art. 9(2)(a) GDPR).
Sending promotional communications and updates about the facility. Legal basis: consent of the data subject (Art. 6(1)(a) GDPR), revocable at any time.
Fulfilment of tax, accounting, administrative and public security obligations, including communications to the authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
Analysis of website use through analytics tools and, where activated, marketing and remarketing activities through third-party tools (e.g. Google, Meta). Legal basis: user consent pursuant to Art. 6(1)(a) GDPR and the ePrivacy legislation. Please refer to the Cookie Policy.
Protection of the safety of persons and property. Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR).
Processing is carried out using IT and electronic tools and, where necessary, in paper form, adopting appropriate technical and organisational measures to ensure the security, confidentiality and integrity of the data, and to prevent unauthorised access, loss or unlawful use. Data is processed exclusively by personnel authorised and instructed by the Controller.
Data is kept for as long as strictly necessary for the purposes for which it is collected and in any case:
• information request data: up to 24 months
• booking and stay data: in accordance with legal obligations
• tax and accounting data: up to 10 years
• special category data (health): for as long as strictly necessary to manage the stay, after which it is deleted or anonymised
• marketing/newsletter data: until consent is withdrawn
• browsing data: as indicated in the Cookie Policy
• video surveillance images: normally no longer than 24-48 hours, except for specific needs
Data is not transferred to third parties for commercial purposes. It may be communicated to:
• authorised personnel of the Controller
• IT, hosting and website management service providers
• the booking engine provider
• payment providers
• tax, legal and administrative consultants
• analytics and marketing service providers (e.g. Google, Meta), only with prior consent
• public authorities in the cases provided for by law
These parties act as data processors, where appointed, or as independent controllers.
Some providers (e.g. Google, Meta) may process data in non-EU countries. In such cases, the transfer takes place in compliance with Articles 44-49 GDPR, by means of adequacy decisions of the European Commission or Standard Contractual Clauses.
Pursuant to Articles 15-22 GDPR, the data subject has the right to:
Obtain confirmation of the processing and a copy of their personal data.
Obtain the correction of inaccurate data or the completion of incomplete data.
Obtain the erasure of their data ("right to be forgotten"), in the cases provided for by law.
Obtain the restriction of processing in certain cases.
Receive their data in a structured format and transfer it to another controller.
Object to processing for reasons relating to their particular situation, including direct marketing.
Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Requests may be sent to info@biancaducale.it or by certified email (PEC) to hotelpanoramic.it@pec.it. The Controller responds within 30 days of receiving the request.
The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it), Piazza Venezia 11 — 00187 Rome, if they consider that the processing of their data infringes the GDPR.
Providing data for contractual purposes and legal obligations is necessary: failure to provide it makes it impossible to deliver the requested services. Providing data for marketing purposes and any communication of health-related data is optional.
Any profiling activities take place solely with prior consent and through digital marketing tools to personalise communications and content. The Controller does not carry out solely automated decision-making processes that produce legal effects on the data subject pursuant to Article 22 GDPR.
Data relating to minors is processed solely for purposes connected with the stay and legal obligations, on the basis of the information provided by parents or those exercising parental responsibility.
Where present, video surveillance systems in common areas and at the entrance operate for security purposes. A simplified notice is available via signs and an extended notice is available on request.
The website uses technical cookies necessary for its operation and, subject to consent, analytics and marketing cookies. For detailed information, please refer to the Cookie Policy.
This policy may be subject to changes to adapt to regulatory or organisational variations. The updated version is always available on the website, with an indication of the date of the latest update.