Privacy Policy

PRIVACY NOTICE

pursuant to articles 13 and 14 of EU Regulation 2016/679

This Privacy Notice is intended to provide you with information regarding the processing of your personal data by Borgobrufa Srl pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”).

1. Who is the Data Controller and how can you contact it?

The Data Controller is Borgobrufa Srl, represented by its legal representative pro tempore (VAT No. 03899350544), with its registered office at Via del Colle 38, Loc. Brufa, 06089 Torgiano (PG), Italy.

E-mail: info@borgobrufa.it

Certified E-mail (PEC): borgobrufasrl@pec.it

2. How do we collect your personal data?

We may collect your personal data in the following circumstances:

• when you contact us directly through our website, by e-mail or by telephone in order to request information about our services;
• when you purchase one of our services or a voucher through our website;
• when you respond to our marketing campaigns by completing a response form, entering your details into an online form, or browsing our website;
• when your contact details are provided to us by a third party, provided that your prior consent has been obtained;
• when our business partners lawfully transfer your personal data to us;
• when you participate in one of our events;
• when you provide us with the personal data of a third party. In such case, you are responsible for ensuring that the relevant Data Subject has read this Privacy Notice in advance. If you are under the age of 18, please do not provide us with any personal data;
• when you purchase a product through our e-commerce platform.

3. What categories of personal data do we collect?

The following categories of personal data relating to you may be collected through the various services and communication channels described in this Privacy Notice:

1. a) Contact Data – name, address, telephone number and e-mail address.
2. b) Payment Data – payment details (such as credit card number, debit card number, IBAN, etc.).
3. c) Identification Data – details contained in an identification document (such as an identity card, passport, driving licence, etc.).
4. d) Interests and Preferences – information relating to your interests, including your preferred hospitality arrangements (such as whether you wish to be contacted by telephone during your stay, your preferred times for meals or beauty treatments, etc.) and the types of ancillary services in which you are interested, including restaurant services, wellness centre services and beauty treatments provided by us.
5. e) Other Personal Data – any personal data that you voluntarily provide for the sole purpose of enabling us to personalise the services we provide.
6. f) Website Usage Data – information relating to the manner in which you use our website, read or forward our communications, including data collected through cookies and other tracking technologies.
7. g) Account Data – information relating to your account when you access our website.
8. h) Images – images depicting you, collected through photographs and/or videos taken during events organised at our premises.
9. i) Health Data or Other Special Categories of Personal Data – information that you provide regarding certain physical conditions, such as food allergies or other health-related information, for the sole purpose of enabling us to provide you with a better service, for example by preparing dedicated meals or allowing you to use the wellness centre facilities or receive beauty treatments safely and comfortably.
10. j) Images Collected through the Video Surveillance System – images that may incidentally depict you and that are collected through the Company’s video surveillance system.

Accordingly, within the limits of the purposes and processing methods described in this Privacy Notice, both personal data and special categories of personal data may be processed.

For the purposes of this Privacy Notice, the term “personal data” shall be deemed to refer to all categories of your personal data, unless otherwise expressly specified.

3. What are the purposes and legal grounds for processing your personal data (purposes and legal basis for processing)?

The personal data collected will be processed for the purposes and on the legal grounds set out below.

Purpose

Categories (a) and (b): for the management of your contractual relationship with us or for the implementation of pre-contractual measures taken at your request (such as, for example, requests for information or quotations, or the provision of a service). In this case, you are free to provide your personal data; however, failure to provide such data will prevent us from establishing the aforementioned contractual relationship and from fulfilling your request.

Legal Basis for Processing

Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.

Purpose

Category (c): for communications required under public security legislation. Failure to provide the requested personal data will make it impossible for us to provide hotel accommodation services to you. Information relating to your country of origin may also be processed by us, following anonymisation, for the purposes of statistical analysis.

Legal Basis for Processing

Processing is necessary for compliance with a legal obligation to which the Controller is subject.

Purpose

Categories (d), (e), (f), (g), (h) and (i): subject to your specific consent, for the personalisation and enhancement of the services provided, with particular reference to restaurant services, wellness centre services and aesthetic treatments. Failure to provide the requested personal data will not prevent you from using such services; however, it will prevent us from personalising and enhancing them.

Legal Basis for Processing

Your consent.

Purpose

Categories (d), (e), (f), (g) and (h): subject to your specific consent, the carrying out (and subsequent use) of surveys and contacting you, using the contact details provided by you, in order to assess the quality of the service provided to you and your level of satisfaction. These activities will, in any event, be carried out in a limited manner and restricted in scope, in keeping with the discretion and privacy standards of our establishment. Failure to provide the requested personal data will not prevent you from using the service; however, it will prevent us from assessing your level of satisfaction and from improving the service.

Legal Basis for Processing

Your consent.

Purpose

Categories (a), (d) and (e): subject to your specific consent, for sending you promotional offers or communications relating to events organised by us or by our commercial partners. These activities will, in any event, be carried out in a limited manner and restricted in scope, in keeping with the discretion and privacy standards of our establishment. Failure to provide your consent will prevent us from contacting you in relation to our initiatives.

Legal Basis for Processing

Your consent.

Purpose

Category (j): images collected through the video surveillance system.

Legal Basis for Processing

Pursuit of the legitimate interest of the Data Controller, aimed at safeguarding the company’s assets. In the event of a request for the disclosure of images by the Judicial Authority or the Police Authorities, the legal basis for processing is compliance with a legal obligation.

Purpose

Categories (a) and (b): if you wish to purchase goods and services provided by third parties displayed within Borgobrufa, your personal data will be communicated to the aforementioned third parties for invoicing purposes. In this case, you are free to provide your personal data; however, failure to provide such data will prevent us from fulfilling your request.

Legal Basis for Processing

Processing is necessary for the performance of a contract to which you are a party and for compliance with a legal obligation.

5. What is “Soft Spam”

We hereby inform you that, pursuant to Article 130, paragraph 4 of the Privacy Code (Legislative Decree No. 196/2003, as subsequently amended), Borgobrufa S.r.l. may use the e-mail address provided by you in connection with a previous stay or with a request for information regarding our services, in order to offer you products, services and performances similar to those requested and/or purchased by you.

Should you no longer wish to receive such communications, you may notify Borgobrufa S.r.l. at any time by sending an e-mail to privacy@borgobrufa.it or by using the link provided in the e-mail communications received by you. In such event, Borgobrufa S.r.l. will immediately cease sending such communications.

6. How is your personal data processed?

Your personal data will be processed using manual, IT and electronic means suitable to ensure its security and confidentiality, and will be carried out by personnel who have been duly instructed to comply with the applicable legislation.

In addition to cases where it is necessary to contact you for requirements related to the management of your stay with us, where you consent to the processing of your personal data for the purposes referred to in Section 4, you may be contacted by e-mail, SMS or through any equivalent electronic means, or by postal mail or telephone call through an operator, using all contact details provided by you. Should you prefer to be contacted only through one or more of such contact details, you may expressly request this by contacting us at the e-mail address privacy@borgobrufa.it.

7. To whom do we disclose your personal data?

Your personal data may be transferred to:

Recipients of personal data

Internal authorised personnel specifically instructed pursuant to Article 29 of the GDPR.

Purpose: Operational management of the activities.

Recipients of personal data

Third-party companies providing support services for the company’s activities, or professionals, with some of whom specific agreements have been entered into pursuant to Article 28 of the GDPR.

Purpose: Support in the management of activities. Invoicing.

Recipients of personal data

Bodies and/or Authorities that may be legally authorised or appointed.

Purpose: Compliance with legal obligations.

Your personal data may also be disclosed whenever necessary to comply with requests from the Judicial Authority or Public Security Authorities. The data collected will under no circumstances be disseminated.

No transfers of personal data outside the European Union take place, including for the use of “cloud” services.

8. Data retention period (criteria for determining the retention period)

The table below sets out the indications (or criteria for determining) the retention period of personal data:

Purpose

Categories (a) and (b) (contract)

Retention period: For the entire duration of the contractual relationship and subsequently for 10 years (ordinary limitation period).

Purpose:

Category (c) (Public Security communications)

Retention period: For the period prescribed by law.

Purpose:

Categories (d), (e), (f), (g), (h) and (i) (service improvement)

Retention period: Until the end of the service or stay.

Purpose:

Categories (d), (e), (f), (g), (h) and (i) (satisfaction assessment)

Retention period: 4 years from the date of collection, due to the possibility, which frequently occurs in practice, of further interactions with you, without prejudice to your right to amend and/or withdraw the consent provided at any time.

Purpose:

Categories (d), (e), (f), (g), (h) and (i) (marketing)

Retention period: 4 years from the date of collection, due to the possibility of further interactions with you, without prejudice to your right to amend and/or withdraw the consent provided at any time.

Purpose:

Category (j) (images)

Retention period: 72 hours.

9. What are your rights?

You may exercise, at any time, the rights provided for under Articles 15 to 22 of the GDPR and, in particular:

• the right to be informed about the purposes and methods of processing your personal data;
• the right of access to your personal data;
• the right to obtain a copy of your personal data;
• the right to request the rectification, updating or completion of your personal data;
• the right to request the erasure, anonymisation or blocking of personal data processed in breach of applicable law;
• the right to object, in whole or in part, to any processing carried out through automated decision-making processes, including profiling;
• the right to withdraw your consent at any time;
• the right to request the restriction of processing of your personal data.

10. Means of exercising your rights

You may exercise your rights by sending an e-mail to privacy@borgobrufa.it.

We will respond to your requests within 30 days from receipt thereof, unless particular circumstances apply, in which case a response may take up to 60 days.

You may withdraw your consent to marketing activities by following the instructions provided in any marketing e-mail or by contacting the e-mail address privacy@borgobrufa.it.

Should you believe that your rights have been infringed, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) using the procedure indicated on the website www.garanteprivacy.it.

This privacy notice may be subject to changes. Therefore, we recommend that you regularly check the privacy section available at the following link: https://www.borgobrufa.it/privacy-policy/