Privacy policy
PRIVACY NOTICE
Information Notice on the Processing of Personal Data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
1. Data Controller
The Data Controller of personal data is:
VARENNA HOLIDAYS SRL
Registered Office: VIA VENINI, 19
VAT Number: IT03754630139
Email: info@varennaholidays.it
Certified Email (PEC): varennaholidays@pec.it
Phone: +39 3347705848
(hereinafter referred to as the "Data Controller").
2. Categories of Personal Data Processed
The Data Controller may collect and process the following categories of personal data:
Identification Data
- first and last name;
- date and place of birth;
- nationality;
- identification document details;
- tax identification number (where required).
Contact Information
- email address;
- telephone number;
- residential or mailing address.
Booking Information
- stay dates;
- number of guests;
- booked accommodation;
- special requests;
- information necessary for the administrative management of the reservation.
Payment Information
Payments are processed through specialized third-party payment providers. The Data Controller does not store complete payment card details.
Browsing Data
The website's IT systems automatically collect certain technical information, including:
- IP address;
- browser type;
- operating system;
- date and time of access;
- pages visited.
3. Purposes of Data Processing
Personal data are processed for the following purposes:
A) Reservation Management
- handling availability requests;
- confirming reservations;
- managing guest stays;
- providing customer support.
Legal Basis: performance of pre-contractual and contractual obligations pursuant to Article 6(1)(b) GDPR.
B) Compliance with Legal Obligations
- registration of guests with public security authorities;
- mandatory communications to competent authorities;
- tax and accounting compliance;
- management of tourist tax obligations.
Legal Basis: compliance with a legal obligation pursuant to Article 6(1)(c) GDPR.
C) Security and Protection of Rights
- fraud prevention;
- management of disputes and legal claims;
- protection of the company's assets and legal interests.
Legal Basis: legitimate interests pursued by the Data Controller pursuant to Article 6(1)(f) GDPR.
D) Marketing Activities (Subject to Consent)
- sending offers and promotions;
- newsletters;
- commercial and marketing communications.
Legal Basis: consent of the data subject pursuant to Article 6(1)(a) GDPR.
Consent may be withdrawn at any time.
4. Disclosure of Data to Competent Authorities
In accordance with applicable public security and tourism statistics regulations, guest data may be communicated to:
- the Italian Ministry of the Interior through the "Alloggiati Web" system;
- the competent Police Headquarters (Questura);
- the relevant municipalities;
- regional authorities responsible for tourism statistics and visitor flow monitoring;
- ISTAT (Italian National Institute of Statistics) or other statistical bodies required by law.
Such disclosures are mandatory by law and do not require the consent of the data subject.
5. Use of Third-Party Providers and Platforms
For the provision of its services, the Data Controller may use third-party platforms and service providers, including:
- online booking systems;
- Property Management Systems (PMS);
- online check-in platforms;
- payment service providers;
- cloud service providers;
- email and newsletter service providers.
These entities act either as Data Processors or Independent Data Controllers in accordance with applicable data protection laws.
6. International Data Transfers
Where certain service providers are located outside the European Economic Area (EEA), personal data may be transferred in compliance with Articles 44 et seq. of the GDPR through:
- Adequacy Decisions adopted by the European Commission;
- Standard Contractual Clauses (SCCs);
- other safeguards permitted by applicable law.
7. Data Retention Period
Personal data shall be retained:
- for the duration of the contractual relationship;
- for the periods required by tax, accounting, and civil law obligations;
- for the period required under public security regulations;
- until consent is withdrawn for marketing purposes.
8. Rights of the Data Subject
Data subjects may exercise the rights provided under Articles 15 to 22 GDPR, including:
- right of access;
- right to rectification;
- right to erasure;
- right to restriction of processing;
- right to data portability;
- right to object to processing;
- right to withdraw consent.
Requests may be submitted to the Data Controller using the contact details provided above.
9. Complaint to the Supervisory Authority
Data subjects have the right to lodge a complaint with the competent Data Protection Supervisory Authority.
For Italy, complaints may be submitted to the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali):
10. Changes to this Privacy Policy
The Data Controller reserves the right to amend or update this Privacy Policy at any time.
Any changes will be published on the website and shall become effective upon publication.