Privacy Policy

This policy describes how the personal data of users who visit the website www.villabalbi.it and interact with the services offered on it is processed, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable Italian legislation on the protection of personal data.

1. Data Controller

The Data Controller is Ecasa S.R.L. – Grand Hotel Villa Balbi, with registered office at Viale Rimembranza, 1 – 16039 Sestri Levante (GE), Italy.

VAT No.: 00166440990
Telephone: 018542941
Email: villabalbi@villabalbi.it

For any request regarding the processing of personal data, the Data Controller may be contacted using the details provided above.

2. Categories of data processed

The website may process the following categories of personal data:

• Browsing data: the IT systems and software procedures responsible for the operation of the website acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (for example IP addresses, browser and device type, pages visited, access times).
• Data provided voluntarily by the user: personal and contact data (for example first name, surname, email, telephone number) provided through the quote request, booking or contact forms.
• Booking data: information relating to the requested stay, submitted through the website forms or the connected booking systems.
• Cookies and tracking technologies: data collected through cookies and similar tools, as described in point 6 below.

3. Purposes of processing

Personal data is processed for the following purposes:

• to enable browsing of the website and ensure its proper functioning and security;
• to respond to requests for information, quotes and contact sent by the user;
• to manage booking requests and the related obligations;
• to comply with obligations laid down by law, regulations or European Union legislation;
• subject to consent, to carry out statistical analysis of the use of the website and marketing activities.

4. Legal basis for processing

The processing of data is based, depending on the purpose, on one of the following legal grounds:

• the performance of pre-contractual or contractual measures requested by the data subject (for example the handling of a quote or a booking);
• compliance with legal obligations to which the Data Controller is subject;
• the consent of the data subject, in particular for non-technical cookies and any marketing activities;
• the legitimate interest of the Data Controller in ensuring the security and proper functioning of the website.

5. Methods of processing

Data is processed using manual, IT and telematic tools, according to logic strictly related to the stated purposes and in any case in such a way as to guarantee its security and confidentiality, by means of appropriate technical and organisational measures to prevent unauthorised access, loss or unlawful disclosure of the data.

6. Cookies

The website uses technical cookies necessary for its operation and, subject to the user's consent, analytical and profiling cookies, including third-party cookies, among which tools managed via Google Tag Manager. The user can manage their preferences through the banner present on the website and through their browser settings.

For detailed information on the cookies used, please refer to the Cookie Policy.

7. Disclosure of data to third parties

Personal data may be disclosed to third parties acting as data processors or as independent controllers, to the extent necessary for the purposes indicated above. These include, by way of example:

• providers of booking and request-management services (for example the online booking platform used by the property);
• providers of the CRM and data-management services adopted by the property;
• providers of hosting, maintenance and technical support services for the website;
• providers of statistical analysis and marketing tools;
• authorities and public bodies, where required by law.

The data is not subject to dissemination.

8. Transfer of data to third countries

Some service providers (for example analytics tools and social networks) may involve the transfer of data outside the European Economic Area. In such cases, the transfer takes place in compliance with the safeguards provided for by Articles 44 et seq. of the GDPR, such as adequacy decisions or standard contractual clauses approved by the European Commission.

9. Retention period

Personal data is retained for the time strictly necessary to achieve the purposes for which it was collected and, subsequently, for the period imposed by legal obligations (for example in tax and administrative matters). Data processed on the basis of consent is retained until such consent is withdrawn.

10. Rights of the data subject

As a data subject, the user has the right, within the limits and under the conditions provided for by Articles 15 to 22 of the GDPR, to:

• access their personal data and request a copy of it;
• request the rectification of inaccurate data or the completion of incomplete data;
• request the erasure of data (right to be forgotten);
• request the restriction of processing;
• object to the processing;
• exercise the right to data portability;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, it is possible to write to villabalbi@villabalbi.it. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

11. Changes to this policy

The Data Controller reserves the right to modify or update this policy at any time, including as a result of regulatory changes. Changes will be published on this page and will take effect from the date of publication.

Last updated: [insert date]