Privacy Policy & Cookie Law for users visiting this website in accordance with Article 13 of Regulation (EU) 2016/679

WHY THIS INFORMATION

The following information regarding the use of cookies and the processing of personal data on this website is provided to the user/browser in compliance with the provision of the Guarantor for the protection of personal data and in accordance with Article 13 of EU Regulation 2016/679 for the protection of personal data.

In accordance with Regulation (EU) 2016/679 (hereinafter "Regulation"), this page describes the processing of user/browser personal data while using the services of the site, and the options for contacting and acquiring user personal data, in full compliance with Article 13 of EU Regulation 2016/679 for the protection of personal data, regarding users who access the following websites via electronic means:

https://www.grottagiustispa.com

This information does not concern other websites, pages, or online services accessible through hyperlinks that may be published on the sites but refer to resources external to the domains.

Following the consultation of the aforementioned sites, data relating to identified or identifiable individuals may be processed.

DATA CONTROLLER

The Data Controller is:

ITA Hotel Investments Holdco 2 S.à r.l.
Via Messina 38 Torre C, 20154 Milano – Italy
privacy@ihchotels.it
VAT ID: 03212990927

DPO (Data Protection Officer)

The owner has identified and appointed the Data Protection Officer, as required by Art 37 of the European regulation for the protection of personal data EU 2016/679, as required by paragraph 6, who can be contacted by email at dpo@schmidtconsulting.it.

CATEGORIES OF PERSONAL DATA AND PURPOSES OF THE PROCESSING

Data communicated by users

Sending messages, on the basis of the user’s free, voluntary, explicit choice, to the Controller’s contact addresses, or sending private messages to the Controller’s social media pages and profiles (where this option is available), and filling in and sending the forms made available on the Controller’s websites entail the acquisition of the sender’s contact information – which is necessary to provide a reply – as well as of any and all the personal data communicated in that manner.
Specific information notices will be displayed on the pages of the Controller’s websites that are used for providing certain services.

Navigation Data

The computer systems and software procedures used to operate this website acquire certain personal data during their normal operation, the transmission of which is inherent in the use of Internet communication protocols.

This category of data includes, by way of example but not exhaustively, IP addresses or domain names of computers and terminals used by users, the URI/URL addresses (Uniform Resource Identifier/Locator) of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters relating to the operating system and the user's IT environment.

These data, necessary for the use of web services, are also processed for the purpose of:

- obtaining statistical information on the use of services (most visited pages, number of visitors per time or day, geographical areas of origin, etc.);

- checking the proper functioning of the services offered.

Navigation data does not persist for more than the time strictly necessary and is deleted immediately after its aggregation (except when necessary for the detection of crimes by the judicial authorities).

Data Provided by the User

The optional, explicit, and voluntary sending of messages to the contact addresses of the Data Controller, as well as the completion and submission of forms on the website, entail the acquisition of the sender's contact data, necessary to respond, as well as all personal data included in the communications.

Specific information notices will be published on the Data Controller's websites pages dedicated to the provision of specific services.

Cookies and other tracking devices

This website uses cookies to ensure the correct use of the site's contents.

The site uses technical and session cookies (non-persistent) strictly limited to what is necessary for safe and efficient navigation of the site. The storage of session cookies on terminals or browsers is under the user's control. On the servers, at the end of HTTP sessions, information relating to cookies remains recorded in the service logs, with retention times strictly necessary for proper functioning.

Banner operation

The privacy management banner activated on this site does not allow any profiling cookies to be activated until the user has given their consent. If the user clicks the "I agree" button, all profiling cookies will be activated. If the user decides to click the "Personalize" button, they can customize their choices and decide which profiling cookies to activate. If the user clicks on the "Reject" button or the "X" in the top right of the banner, no profiling cookies will be activated.

The user's choices will be stored for six months through a technical cookie that will be installed on the device used by the user to access the site. It is essential to explain that if the user changes their device, for example, from a computer to a mobile phone, the choices cannot be transferred to the new device for technical reasons, and they will need to be selected again on the new device.

The user's choices can be changed at any time by accessing the control panel from the privacy control icon. The new configuration will last for six months.

The site uses cookies for third-party profiling as specified below.

Which cookies are installed on this site?

Google Tag Manager (Google Inc.)
Google Tag Manager è un servizio di gestione dei tag fornito da Google Ireland Limited. Dati Personali che vengono trattati: Dati di utilizzo; Strumento di Tracciamento. Luogo del trattamento: Irlanda –  Privacy Policy.

Video Vimeo

Vimeo è un servizio di visualizzazione di contenuti video gestito da Vimeo, LLC. Questo servizio serve per integrare tali contenuti nelle proprie pagine.

Luogo del trattamento: Stati Uniti - Privacy Policy

Akamai Content Delivery Network

Akamai è un servizio di hosting fornito da Akamai Technologies, Inc.

Luogo del trattamento: Stati Uniti - Privacy Policy

Google Analytics (Google Inc.)
Google Analytics è un servizio di analisi web fornito da Google Ireland Limited (“Google”). Google utilizza i Dati Personali raccolti per tracciare ed esaminare l’uso di questa Applicazione, compilare report sulle sue attività e condividerli con gli altri servizi sviluppati da Google. Google può utilizzare i  tuoi Dati Personali per contestualizzare e personalizzare gli annunci del proprio network pubblicitario. Questa integrazione di Google Analytics rende anonimo il tuo indirizzo IP. L'anonimizzazione funziona abbreviando entro i confini degli stati membri dell'Unione Europea o in altri Paesi aderenti all'accordo sullo Spazio Economico Europeo l'indirizzo IP degli Utenti. Solo in casi eccezionali, l'indirizzo IP sarà inviato ai server di Google ed abbreviato all'interno degli Stati Uniti. Dati Personali raccolti: Dati di utilizzo; Strumento di Tracciamento. Luogo del trattamento: Irlanda –  Privacy Policy – Opt Out.

Ve Interactive

Ve Interactive è un servizio di Remarketing e Behavioral Targeting fornito da Ve Global UK Limited. Questo servizio è usato per collegare l'attività di questo sito web con il network di advertising Ve Interactive.

Luogo del trattamento: Regno Unito - Privacy Policy

Facebook Remarketing

Facebook Remarketing è un servizio di Remarketing e Behavioral Targeting fornito da Facebook Ireland Ltd. Questo servizio è usato per collegare l'attività di questo sito web con il network di advertising Facebook.

Luogo del trattamento: Irlanda - Privacy Policy

Google Maps widget

Google Maps è un servizio di visualizzazione di mappe gestito da Google Ireland Limited. Questo servizio serve ad integrare tali contenuti all’interno delle proprie pagine.

Luogo del trattamento: Irlanda - Privacy Policy

Google reCAPTCHA

Google reCAPTCHA è un servizio di protezione dallo SPAM fornito da Google Ireland Limited.

L'utilizzo del sistema reCAPTCHA è soggetto alla privacy policy  secondo termini di utilizzo di Google.

Luogo del trattamento: Irlanda - Privacy Policy

How many types of cookies are there?

There are two fundamental macro-categories, with different characteristics:
technical cookies and profiling cookies.
Technical cookies are generally necessary for the website to function properly and to allow navigation;
without them the browser may not be able to view the pages correctly or to use some services. For example, a technical cookie is essential to keep the user connected throughout the visit to a website, or to memorize the settings of the language, display, and so on.
Technical cookies can be further divided into navigation cookies, which guarantee normal navigation and use of the website (allowing, for example, to make a purchase or authenticate to access restricted areas); analytics cookies, similar to technical cookies only when used to collect information, in aggregate form, regarding the number of users and their site-visiting behavior; functionality cookies, which allow the user to browse according to a series of selected criteria (for example, the language, the products selected for purchase) in order to improve the service provided.
Profiling cookies are designed to create profiles relating to the user and are usually used in order to send advertising messages in line with the preferences expressed by the user while surfing the net.

Cookies can also be classified as:
session cookies, which are deleted immediately when the browser is closed (for example, Internet Explorer, Safari, Google Chrome, etc.) persistent cookies, which - unlike session cookies - remain within the browser for a certain period of time. They are used, for example, to recognize the device that connects to the site, facilitating user authentication operations
first-party cookies, i.e. cookies generated and managed directly by the manager of the website on which the user is browsing
third-party cookies, which are generated and managed by parties other than the manager of the website on which the user is browsing (as a rule, by virtue of a contract between the website owner and the third party)

Information related to the management of personal data through social media platforms used by the Data Controller.

Regarding the processing of personal data carried out by the operators of the social media platforms used by the Data Controller, reference is made to the provisions found in their respective privacy policies. The Data Controller manages the personal data provided by users through dedicated pages on social media platforms, in order to manage interactions with users/customers (such as comments, public posts, etc.), always in accordance with current legislation.

LEGAL BASIS FOR THE PROCESSING

The personal data mentioned on this page are processed by the Data Controller in the execution of the services provided by the site and subsequently, if provided for by the site itself, by contractual or legal obligations and defense in court.

In cases where there are specific sections for newsletter subscriptions or marketing services, they will be managed by specific notices and the legal basis will be consent.

OPTIONALITY OF DATA SUPPLY

As provided by the decree of June 10, 2021, "Guidelines on cookies and other tracking tools," the website user is free to authorize or not authorize profiling cookies according to their free choice and will. In some cases, such as the Google reCaptcha cookie, blocking such profiling cookies prevents the submission of requests through data acquisition forms equipped with this tool.

If a problem arises with a non-functioning form due to cookie blocking, it can be resolved by reactivating cookies from the privacy settings. Alternatively, if one prefers to maintain the cookie block, the request can be sent via email.

In addition to information related to navigation data, users can freely decide whether to provide their personal data through request forms available on the sites or as indicated during contacts with the organization to request newsletters, informational material, or other communications.

Without such data, it will be impossible to fulfill the request.

LEGITIMATE INTEREST

The Controller does not make use of legitimate interest for the processing of personal data except for the protection of their own rights, namely, to establish, exercise, or defend a right before the courts.

PROCESSING METHODS

Personal data is processed with automated tools for the time strictly necessary to achieve the purposes for which they were collected.

Specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access.

DATA RECIPIENTS

The processing of personal data is carried out by authorized personnel or duly appointed data processors. The updated list of data processors or any autonomous data controllers can be requested from the Data Controller or the DPO.

DATA TRANSFER

The data will be transferred only within the EU. Some applications, such as, but not limited to, Google Analytics, ReCaptcha, and Facebook Pixel, may be transferred to the USA to companies that have obtained certification under the Data Privacy Framework.

DATA CONSERVATION PERIOD

The retention time of the user's choices relating to cookies is six months as required by the measures.

The time for retaining cookies changes depending on the type of belonging. For third-party profiling cookies, the specifics can be consulted directly on their relative sites.

DATA SUBJECT RIGHTS PURSUANT TO ART. 15 EU 2016/679

Data subjects have the right, in the cases provided for, to obtain from the Controller access to their personal data and the rectification or erasure of such data or the restriction of processing concerning them or to object to the processing (Arts. 15 and following of the Regulation). Opposition for marketing purposes is always possible and free of charge. Requests should be addressed to the Data Controller at the contact details provided at the beginning of this information.

RIGHT TO COMPLAIN

Data subjects who believe that the processing of personal data referred to them carried out through this site occurs in violation of what is provided by the Regulation have the right to lodge a complaint with the Guarantor, as provided for by Article 77 of the same Regulation, or to take action in the appropriate judicial venues (Article 79 of the Regulation).