Request for availability and prices

Information regarding processing of personal data

Dear Customer,
Pursuant to the European Regulation No. 2016/679, entitled "General Data Protection Regulation (GDPR)", the company Parco Cartaromana S.r.l. with registered office in Ischia, Via Nuova Cartaromana, as "Data Controller", is required to provide some information regarding the use of personal data of the interested party.

1. Source of personal data
The personal data in our possession are collected directly from the interested party. All personal data are processed in compliance with the European Regulation (GDPR) and the confidentiality obligations that have always inspired our activity (art. 5).

2. Purpose of processing
The collection and processing of customer data (such as, for example, name, surname, address, identity document, VAT number, tax code, bank account details) is necessary for the following purposes:
a) to offer the requested hospitality and provide related services (e.g. booking of accommodation and ancillary services);
b) to fulfil the obligation provided for by article 109 of the Consolidated Law on public security (Testo unico delle leggi di pubblica sicurezza), approved by Royal Decree No 773 of 18 June 1931, which requires the structure to communicate to the Police Headquarters, for the purposes of public security, the details of the Customers accommodated, according to the methods established by the Ministry of the Interior (Decree of 7 January 2013). The provision of data is compulsory and does not require your consent. The data acquired for this purpose will not be stored by us, unless you give your consent to storage as provided for in paragraph 6.
c) to fulfil current administrative, accounting and tax obligations. For these purposes the processing is carried out without the need to obtain your consent. The data is processed by us and by our appointees, and is only communicated externally in fulfilment of legal obligations. The data acquired for these purposes are stored by us for the time prescribed by the respective regulations (10 years, and even longer in the case of tax inspections);
d) to protect persons, property and assets of the company through a video surveillance system of some areas of the structure, identifiable by the presence of appropriate signs. Your consent is not required for such processing, as it pursues our legitimate interest in protecting people and property against possible aggression, theft, robbery, damage, vandalism and for fire prevention and work safety purposes. The recorded images are deleted after 48 hours, except for public holidays or other cases of closure of the business, and in any case not after one week. They are not disclosed to third parties, except in the event of a specific investigative request by the judicial authorities or the judicial police.
e) to carry out promotional activities by offering the interested party news and information on new initiatives, offers, services etc. in the future.
Unlike the data for the purposes under letters b) and c), the provision of which is compulsory, the provision of data for the purposes under letter a) is optional, but a refusal to provide such data would make it impossible to manage relations with the interested party and consequently to provide the requested services; the provision of data for the purposes under letter e) is optional and the interested party shall have the right at any time to object, in whole or in part, to the processing of such data for the above-mentioned purposes.

3. Data processing methods
In relation to the aforementioned purposes, personal data are processed by means of printed or electronic tools in strict accordance with the aforementioned purposes and, in any case, in such a way as to ensure the security and confidentiality of the data.

4. Rights under Article 12
Finally, we would like to inform that Article 12 of the European Regulation grants the interested parties specific rights. In particular, data subjects may obtain from the controller confirmation as to whether or not personal data concerning them exist and that such data be made available in a structured, commonly used and readable format (art. 20). Interested parties may also request to know the origin of the data as well as the logic and purposes on which the processing is based (art. 13); to obtain the rectification (art. 16), cancellation (art. 17), transformation into anonymous form or blocking of data processed (art. 18) in violation of the law, as well as the updating, rectification or, where interested therein, the integration of data (art. 19); to oppose, for legitimate reasons, the processing of data (art. 21); not to be subjected to a decision based solely on automated processing, including profiling (art. 22).

5. Limitations referred to in Article 23
The law of the Union or of the Member State to which the controller or processor is subject may, by way of legislative measures, restrict the scope of the obligations and rights provided for in Articles 12 to 22 and 34 (Notification by the controller of a personal data breach to the data subject) and Article 5, in so far as the provisions contained therein correspond to the rights and obligations provided for in Articles 12 to 22, where such restriction respects the essence of fundamental rights and freedoms.

6. Consent referred to in Articles 7, 9 (Processing of special categories of personal data) and 18 (Right to restriction of processing)
The performance of certain activities by the structure in question requires the acquisition of specific consents, which may be revoked at any time, for processing such as:
a) to speed up the registration process in the event of your subsequent stays at our establishment. For this purpose, your data will be stored for a maximum of 24 months, and will be used when you are a guest again for the purposes mentioned above;
b) to perform the function of receiving messages and telephone calls addressed to you during your stay. Treatment will cease on your departure;
c) to send you our promotional messages and updates on our rates and offers. For this purpose, your data will be stored for a maximum of 24 months and will not be disclosed to third parties.