The following information is provided pursuant to art. 13 and 14 of Regulation (EU) 2016/679 – GDPR)
1. Introduction
The lawyer Valentina Remonato, as Data Protection Officer (DPO) designated by Hotel Villa Rosa S.r.l., pursuant to articles. 37 and following of Regulation (EU) 2016/679 (hereinafter "GDPR"), provides this information relating to the processing of personal data carried out in the exercise of its functions of guarantee, surveillance, consultancy and cooperation with the Guarantor Authority for the Protection of Personal Data.
The DPO carries out his duties independently, in compliance with the principles of impartiality and confidentiality, without receiving instructions from the Data Controller, as required by the art. 38, paragraph 3, of the GDPR.
2. Main definitions
Pursuant to art. 4 of the GDPR, it is specified that:
- Interested: the natural person to whom the data refers.
- Treatment: any operation or set of operations carried out with or without the aid of automated processes and applied to personal data.
- Controller: the subject who determines the purposes and means of the processing of personal data.
- Personal data: any information relating to an identified or identifiable natural person.
- Special data: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as genetic, biometric, health or sexual orientation data (art. 9 GDPR).
- Judicial data: data relating to criminal convictions or crimes (art. 10 GDPR).
3. Purposes and legal bases of the processing
The DPO processes personal data as part of its institutional functions for the following purposes:
- Carrying out verification, consultancy and support activities provided for by the articles. 37–39 GDPR, towards the Data Controller, employees and collaborators.
- Legal basis:
- The processing is necessary for the execution of a contract with the Data Controller of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same. This applies to the management of the mandate received and the necessary pre-contractual activities. (Article 6.1.b GDPR).
- fulfillment of a legal obligation to which the Data Controller is subject (art. 6, par. 1, letter c) GDPR) and processing necessary for the execution of a task of public interest (art. 6, par. 1, letter e) GDPR).
- Management of requests and communications relating to the exercise of the rights of interested parties pursuant to articles. 15–22 GDPR.
- Legal basis: fulfillment of legal obligations (art. 6, par. 1, letter c) GDPR) and legitimate interest of the Data Controller in ensuring the correct management of privacy compliance (art. 6, par. 1, letter f) GDPR).
- Support in managing reports, complaints or internal audits regarding privacy.
- Legal basis: fulfillment of legal obligations (art. 6, par. 1, letter c) GDPR).
- Awareness raising activities of company personnel on the principles of personal data protection.
- Legal basis: execution of a professional assignment and legal obligation of the Data Controller to guarantee awareness regarding data protection (art. 6, par. 1, letters b) and c) GDPR).
4. Types of data processed and Source
The DPO can deal with:
- Common data: name, surname, role, professional contact details (telephone, e-mail, company address);
- Particular or sensitive data, possibly contained in reports, audits or requests to exercise rights;
- Judicial data, if strictly necessary to ascertain violations for cooperation with the relevant public authority.
The data is processed in compliance with the principles of lawfulness, correctness, transparency, relevance and minimization.
The data is received by the Data Controller or directly by the interested party.
5. Treatment methods
The processing is carried out using IT, telematic and paper-based tools, with logic strictly related to the purposes indicated and in compliance with the appropriate technical and organizational measures pursuant to art. 32 GDPR, aimed at guaranteeing the security, integrity and confidentiality of data.
6. Recipients of the data
Personal data may be communicated to:
- The Controller
- Subjects formally authorized by the Data Controller (collaborators, employees);
- external professionals or consultants appointed by the DPO for activities strictly related to the exercise of his functions;
- suppliers of IT or communication services (e.g. website, certified e-mail, Email, cloud).
- the'Guarantor Authority for the Protection of Personal Data, in case of institutional cooperation or reporting;
The data is not subject to dissemination.
7. Transfer of data to third countries
Any transfers of personal data to non-EU countries will take place exclusively in compliance with the articles. 44 and following of the GDPR, ensuring compliance with the appropriate guarantees; a copy of the adequate guarantees can be requested by contacting the Data Controller and obtained in the event of transfer.
8. Data retention period
Personal data will be kept for the time necessary to carry out the functions of the DPO and, in any case, no longer ten years from the end of the assignment, unless otherwise provided by law or need for legal protection.
9. Nature of the provision
The provision of data is necessary to allow the DPO to fulfill its functions.
Failure to provide data may make it impossible to manage requests, complaints, communications or activities entrusted to the DPO regarding the protection of personal data.
10. Rights of the interested party
In accordance with the characteristics of the service provided to you, the rights provided for in the articles are recognized. 15 to 21 and more generally by the GDPR. In summary:
- right of access;
- right of rectification;
- right to erasure (right to be forgotten);
- right to limit processing;
- right to data portability;
- right to object (at any time, to the processing of personal data concerning you based on the condition of lawfulness of legitimate interest, unless there are legitimate reasons for the Controller to continue processing which prevail over the interests, rights and freedoms of the interested party or for the establishment, exercise or defense of a right in court);
- revoke consent where previously given, without prejudice to the lawfulness of the processing based on the consent given before the revocation;
- lodge a complaint with the Guarantor Authority (Guarantor for the protection of personal data). For further information you can consult the website of the Guarantor for the Protection of Personal Data: it.
11. Data controller and contact details
Hotel Villa Rosa S.r.l.
registered in the Brescia Company Register – VAT number, C.F. and no. subscriber: 03741690238
Share capital: €15,000.00 i.v.
Registered office: Lungolago Cesare Battisti n. 89, 25015 Desenzano del Garda (BS)
Tel. 39 030 9141974
E-mail: amministrazione@villarosahotel.eu
PEC: hotelvillarosasrl@legalmail.it
The Data Controller will take care of your request to exercise your rights and provide you, without unjustified delay and, in any case, at the latest within one month of receiving it, the information relating to the action taken regarding your request.
12. DPO and contact details
The Data Protection Officer (DPO) of Hotel Villa Rosa Srl is the lawyer. Valentina Remonato, with studio in Via Vittorio Emanuele II n. 38, Coccaglio (BS) – Italy.
- Tel. 39 338 8785457
- Email studiolegale@valentinaremonato.it
- PEC valentina.remonato@brescia.pecavvocati.it
The DPO guarantees maximum confidentiality on the identity of the subjects who contact him and processes personal data exclusively for the performance of his institutional functions, in compliance with the principles of proportionality, minimization and necessity established by the GDPR.