Arco della Paranza 13A - Lignano Pineta (UD)




Arco della Paranza, 13/a – 33054 Lignano Pineta (UD) Italy – Tel./Fax +39.0431.422511


Personal data protection – Processing of customer data – Information and acquisition of consent

“The European Regulation n. 679 of 2016 “GDPR”, indicates that any processing of personal data must be grounded in a suitable legal basis. The basics of the processing are indicated in Article 6 and mainly coincide with those described in the Privacy Code law 193 of 2003 (including consent, fulfillment of contractual obligations or pre-contractual measures, legal obligations to which the holder is subject, prevailing legitimate interest of the owner or of third parties to whom the data are communicated, etc.).

As already provided by the Privacy Code, the European Regulation (Articles 13 and 14) requires that the data controller provides all the information regarding the processing of data in a concise, transparent, intelligible and easily accessible form, with a simple and clear language. The information is provided written or by other means, including, where appropriate, electronically. The regulation allows the use of icons to present the contents of the information in summary form, but only in combination with the extended information (article 12, paragraph 7).

The following points, adapted to the specific company reality, are aimed at informing the client or guest about the ordinary data processing performed by the accommodation:

Processing of data of clients or guests acquired by the hotel to confirm a booking of accommodation and ancillary services, and to provide these required services (this applies on general and contact details, tax code and / or VAT number, credit and debit card details provided as guarantee and / or balance, list of services and products requested and purchased, date of arrival and departure, etc.). These treatments are necessary for the definition of the contractual agreement and for its subsequent implementation. Therefore, it is necessary to inform the customer that his consent is not required for the processing of this type of data, except in the case where particular, so-called sensitive data are given. In case of refusal to provide personal data, all or some services cannot be provided. The client must be informed that the treatment will cease upon departure, but some of his personal data may continue to be processed for other purposes, which are to be specifically indicated as described below.

Processing of customer or guest data to fulfill the obligation set forth in the “Consolidated Law on Public Security Laws” (article 109 RD 18.6.1931 No. 773) which requires to communicate data to the Police Headquarters if requested. This is necessary for the purpose of public security, the of the clients accommodated according to the modalities established by the Ministry of the Interior (Decree of 7 January 2013) (general and details of the identification documents, date of arrival and nights of accommodation, relations of kinship, etc.). This provision of data is mandatory and the processing does not require the customer’s consent. In case of refusal to provide the requested data, the client cannot be hosted in the accommodation. The data acquired for this purpose will not be stored at the accommodation, unless the customer provides specific authorization.

Processing of data of customers or guests to comply with current administrative, accounting and tax obligations (general information and contact details, tax code and / or VAT number, credit and debit card details supplied to the balance, services and products purchased on the statements and in tax documents, etc.). The customer is informed that for such purposes the treatment is carried out without the need to acquire the customer’s consent. The customer is also informed that certain data might be communicated to third parties in compliance with legal obligations, and that in case of refusal to provide this data necessary for the above-indicated obligations, the requested services cannot be provided. Please note that for these purposes the data is stored at the accommodation in accordance to the respective regulations (usually 10 years, or more as in the case of tax assessments).

Processing of customer and guest data carried out to speed up registration procedures in case of subsequent stays (details of identification documents, contact details, etc.). To enable the processing of data for this purpose, the customer must express consent, which is revocable at any time. The company must establish a maximum term for the storage of such data, to be reported in the disclosure (2 years).

Data processing to perform the function of receiving messages and phone calls addressed to the customer during his stay (general information, presence at the accommodation, etc.). Even for this purpose, the customer’s consent is required. The client must be informed of the possibility of revoking the consent at any time and that the treatment will cease at the moment of departure.

Processing of customer and guest data to send promotional messages (general information, contact details, etc.). For this purpose, the customer must express consent as well, which is again revocable at any time. The company establishes a deadline for the storage of such data, to be reported in the disclosure (two years).

Data processing for the protection of people, property and company assets through a video surveillance system. Customers and guests should be informed if a video surveillance system is installed in some areas of the accommodation, which can be identified by the presence of appropriate signs, and if the images are recorded or not. It is also necessary to inform that consent is not required for this treatment, as it pursues the legitimate interest of the company to protect people and property with respect to possible aggressions, thefts, robberies, damage, acts of vandalism and for the purposes of fire prevention and of job security. In the event that the images are recorded, it is necessary to inform that they are canceled in the terms provided by the Guarantor (after 24 hours, except holidays or other cases of closure of the exercise, and in any case not more than a week) and that they are not subject of communication to third parties, except in the case in which it is necessary to adhere to a specific investigation request of the judicial or judicial police authorities.

In addition to the model of information, a model for the acquisition of consent at the arrival of the client (in case the accommodation intends to carry out the treatments that require consent) and a model of acquisition of consent to be included in the website in the case in which the accommodation intends to send the customer the newsletter or promotional offers.

Lignano Pineta, 20-05-2018

The direction

Raffaella Garfagnini