PRIVACY NOTICE FOR CLIENTS AND SUPPLIERS IN ACCORDANCE WITH GDPR 679/2016

CLICK HERE FOR THE PRIVACY NOTICE FOR PROPERTY OWNERS IN ACCORDANCE WITH GDPR 679/2016

This privacy notice is issued by Emma Villas S.p.A. pursuant to Article 13 of Legislative Decree No. 196 of June 30, 2003, “Personal Data Protection Code,” and Article 13 of GDPR 679/16 “European Regulation on the Protection of Personal Data.”

Data Controller

The data controller for personal data is Emma Villas S.p.A., headquartered at Via Antonio Bertoloni 8, 00197 Rome (RM).
The Controller can be contacted at the following email address: [email protected]

Data Protection Officer (DPO)

Emma Villas S.p.A. has appointed a Data Protection Officer (DPO) who can be contacted at: [email protected]

Source of Data

The personal data processed are those provided directly by the data subject during the registration process of their account with Emma Villas.

Purpose of the Processing

• Manage bookings
• View quotations, including historical ones
• Verify invoices and payments
• Manage consent preferences
• Create a wishlist
• Access documents generated by Emma Villas
• Access the Service Catalog
• Purchase additional services and/or insurance

The same data may be used to complete a new booking, if requested, along with the additional data required for the reservation but not included in the account registration dataset.

With prior consent, telephone contact details may be used through instant messaging systems to request or receive information regarding the ongoing stay.

Furthermore, such data and user preferences may, with consent, be used for profiling purposes to conduct market research and offer personalized promotions.

Data Recipients

Personal data processed by the Controller will remain confidential and will not be disseminated in any form, including disclosure or simple consultation. However, they may be communicated to employees of the Controller and to certain external parties who collaborate with them.

They may also be shared, to the extent strictly necessary, with third parties who, for the purpose of issuing orders or requests for information and quotations, must provide goods and/or perform services.

Finally, they may be disclosed to entities authorized to access them by virtue of laws, regulations, or EU legislation.

Based on job roles and duties, certain employees have been authorized to process personal data within their competence and in accordance with the Controller’s instructions. Such communication of data will take place in accordance with EU Regulation 679/16 (GDPR).

Data Transfer

No transfer of personal data to third countries or international organizations is envisaged.

Emma Villas S.p.A. reserves the right to use cloud-based services; such providers will be selected only if able to guarantee compliance with Italian and European privacy regulations.

Data Retention

The personal data referred to above will be entered into company archives and retained in accordance with legal requirements, and where applicable, until modification or deletion is requested by the data subject.

Emma Villas S.p.A. retains and processes personal data for the time necessary to fulfill the stated purposes, also in accordance with the guidelines of the Italian Data Protection Authority. Subsequently, personal data required for administrative and commercial purposes will be retained for the period established by civil and tax law.

Rights of the Data Subject

The data subject has the right to:

• Right to Information
  To receive clear and transparent information about the processing of their personal data and their source.
• Right of Access
  To request and obtain a copy of their personal data being processed, along with details regarding purposes, recipients, retention criteria, and any transfers to third countries.
• Right to Rectification
  To have inaccurate personal data corrected or incomplete data completed.
• Right to Erasure (Right to be Forgotten)
  To request the removal, even partial, of their personal data, for example when it is no longer necessary for the purposes for which it was collected.
• Right to Restriction of Processing
  To request that data processing be temporarily suspended, for instance when contesting the accuracy or lawfulness of the processing.
• Right to Data Portability
  To receive their personal data in a structured, commonly used, and machine-readable format, and to transmit them to another controller, where technically feasible.
• Right to Object
  To object to the processing of their personal data for reasons related to their legal and/or personal situation.
• Right Not to Be Subject to Automated Decision-Making
  To not be subject to decisions based solely on automated processing, including profiling, that produce legal effects or significantly affect them personally.

Additionally, the data subject may:

• Request confirmation of the existence of their personal data (Right of Access)
• Know the origin of such data
• Receive intelligible communication thereof
• Obtain information about the logic, methods, and purposes of processing
• Request updating, rectification, integration, deletion, anonymization, or blocking of data processed in violation of the law, including data no longer necessary for the purposes for which they were collected
• Where processing is based on consent, receive their data in a structured, machine-readable format at the sole cost of any medium used
• Lodge a complaint with the Supervisory Authority (Garante Privacy)
• Exercise all other rights granted by applicable laws

The data subject may exercise these rights by sending a registered letter to the Controller or via PEC (or standard email if certified mail is unavailable), specifying the subject of the request and attaching a valid identity document.

Consent and Withdrawal

Pursuant to Article 23 of Legislative Decree 196/2003 (as amended) and Article 6 of GDPR 679/16, the data subject may withdraw consent at any time.

However, certain processing operations may be lawful and permitted even without consent, if necessary for the performance of a contract, compliance with a legal obligation, or the pursuit of a legitimate interest.

Complaints

The data subject has the right to lodge a complaint with the supervisory authority of their country of residence (Italian Data Protection Authority – Garante Privacy) if they believe their data have been improperly processed.

Refusal to Provide Data

The data subject may refuse to provide personal data to the Controller. However, providing such data is necessary for proper and efficient management of the contractual relationship. Therefore, refusal to provide data may compromise, in whole or in part, the contractual relationship itself.

Automated Decision-Making

Emma Villas S.p.A. does not perform any automated decision-making processes based on personal data obtained through contracts with clients and suppliers.

Privacy Notes and Additional Details

Iubenda Privacy Policy Details
European Online Dispute Resolution Platform