Privacy Policy for Customers – GDPR
Dear Customer,
pursuant to the current legislation on the protection of personal data (EU Regulation no. 679 of 2016), we wish to inform you that the processing of your personal data is carried out correctly and transparently, for lawful purposes and protecting your privacy and your rights.
By continuing to use our services, you consent to the processing of your personal data by Criba Rooms di Tedone Christian Via Vittorio Veneto, 24 – Palese (Ba), in accordance with the applicable law and the provisions of the Privacy Policy, Regulation (EU) 2016/679.
The information is provided pursuant to Regulation (EU) 2016/679 – Personal Data Protection Code to those who interact with our web services accessible electronically at the address: www.cribarooms.it (hereinafter referred to as the “Site”).
The information is provided only for the Site and not for other websites that may be consulted by the user via links. Visitors are advised that requests for quotes involve the processing of personal data.
Data Processed:
With reference to the needs arising from the management and administration of its services necessary for the correct performance of the activity, as well as to fulfill legal obligations, the Company processes the following personal data:
General information (name, surname, date of birth, nationality, residence, marital status, etc.) including the data of the identification documents necessary for the registration of guests at the police station
General information or other data relating to the spouse and other family members provided by the customer during check-in
Tax information (tax code, VAT number, address of residence and registered office necessary for invoicing)
Email, telephone number voluntarily provided during navigation on the site, during registration for newsletters, directly at check-in
Criba Rooms di Tedone Christian Via Vittorio Veneto, 24 – Palese (Ba) collects, stores and uses personal data in the following ways:
Directly during the stay in the hotel, subject to the customer’s authorization.
Online during navigation on the Site or use of our services, subject to the authorization provided by the user.
The contact and identity data are collected, stored and used directly by: Criba Rooms di Tedone Christian Via Vittorio Veneto, 24 – Palese (Ba) for the purpose of registering the identity document with the state police and to contact the customer in case of need. The authorization is signed directly and personally by the customer.
We use navigation data, cookies and data voluntarily provided to us by users only for the purposes for which they were collected. In some cases, such data may be communicated, processed and/or archived with the help of third-party companies, a list of which can be found in the relevant section of this policy.
Log files and similar – For security reasons, and in order to comply with specific legal obligations, the technical connection data of users are recorded in text files that are stored on our server in order to monitor the correct functioning of the site and protect our systems from possible cyber attacks. Other software present on our systems could perform similar operations for purposes related to IT security.
Site access statistics – We use Google Analytics for purely statistical purposes to measure the traffic of our website. In order to guarantee the privacy of users, we have activated the anonymity of IP addresses, which prevents Google Analytics from recording this personal data of yours within its system.
Third-party widgets – Some pages of the site may contain tools provided by third parties such as videos, elements taken from social networks and other remote functions. These tools can interact with the user’s system by sending cookies.
Purpose of Processing
Personal data provided voluntarily to the staff of the facility or within the appropriate forms are processed:
to acquire and confirm your booking of accommodation services and ancillary services, and to provide the requested services. Since these are necessary treatments for the
definition of the contractual agreement and for its subsequent implementation, your consent is not required, except in the case in which particular data, so-called sensitive data, are provided. In the event of refusal to provide personal data, we will not be able to confirm the booking or provide you with the requested services. The processing will cease upon your departure, but some of your personal data may or must continue to be processed for the purposes and with the methods indicated in the following points;
to fulfill the obligation set forth in the “Consolidated Law on Public Safety” (Article 109 of Royal Decree 18.6.1931 no. 773) which requires us to communicate to the Police Headquarters, for public safety purposes, the personal details of guests staying in accordance with the procedures established by the Ministry of the Interior (Decree of 7 January 2013). The provision of data is mandatory and does not require your consent, and in the event of refusal to provide them, we will not be able to host you in our facility. To fulfill this purpose, the data relating to your personal details and the copy of your identity document will be retained in accordance with the provisions of the aforementioned regulations and for any checks by public safety authorities;
to fulfill current administrative, accounting and tax obligations. For these purposes, processing is carried out without the need to acquire your consent. The data is processed by us and our representatives, and is communicated externally only in compliance with legal obligations. In case of refusal to provide the data necessary for the above-mentioned fulfillments, we will not be able to provide you with the requested services. The data acquired for these purposes are retained by us for the time required by the respective regulations (10 years, and even longer in the case of tax audits);
to speed up the registration procedures in the event of your subsequent stays at our facility. For this purpose, after obtaining your consent, which can be revoked at any time, your data will be retained for a maximum period of 2 years, and will be used when you are our guest again for the purposes set out in the previous points;
to carry out the function of receiving messages and telephone calls addressed to you during your stay. Your consent is required for this purpose. You may revoke your consent at any time. The processing will cease upon your departure;
to send you our promotional messages and updates on rates and offers. For this purpose, after obtaining your consent, your data will be retained for a maximum period of 2 years and will not be disclosed to third parties. You may revoke your consent at any time;
for the purposes of protecting people, property and company assets through a video surveillance system in certain areas of the facility, identifiable by the presence of special signs. Your consent is not required for this processing, as it pursues our legitimate interest
in protecting people and property against possible attacks, thefts, robberies, damage, acts of vandalism and for fire prevention and workplace safety purposes. The recorded images are deleted after 24 hours, except on holidays or other cases of business closure, and in any case no later than one week. They are not communicated to third parties, except in the case of having to comply with a specific investigative request from the judicial authority or the judicial police.
to be able to process specific user requests automatically and/or manually (for example, to respond to contact requests sent through the appropriate forms)
if authorization is provided, to send information and commercial offers, including from third parties to whom the Data Controller will be able to communicate the personal data provided by you.
if authorization is provided, to collect data and information in general and in particular on your orientations and/or preferences.
Processing methods
The data are collected according to the indications of the Privacy Code, with particular attention to the minimum security measures provided for by Regulation (EU) 2016/679) with regard to their processing using computerized, manual and automated tools with logic strictly related to the purposes indicated above and in any case in such a way as to guarantee the security and confidentiality of the data themselves.
Optional provision of data
The provision of personal data by you is absolutely optional; however, any refusal to enter them on the page dedicated to registration for the purposes of providing the Service makes it impossible to use the Service offered on the website.
The provision of your personal data is optional for commercial and profiling purposes and any refusal to give consent has no consequences on the provision of the Service.
Data provided voluntarily by the user
The optional, explicit and voluntary sending of electronic mail to the addresses indicated on this Site entails the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data entered.
Personal data is also collected when registering on the site and, with the consent of the interested user, when requesting quotes from the Site. Registration is required, with the creation of a username and password, to access some areas of the Site. The collection of personal data, marked with an asterisk, in the registration form or during the use of the services, is necessary to allow the user to access the features of the Site indicated at the time of registration. The personal data will be stored with the user’s consent to allow him/her to access previously filled out quotes and/or the reserved area of the portal again. The provision of this data is optional, but refusal to provide it makes it impossible for the user to obtain registration on the Site and use the services reserved for registered users.
Furthermore, the personal identification and contact data voluntarily provided during registration on the Site or in the use of some of the services offered therein, may, with the specific and separate consent of the interested party, be transmitted to some selected partners for their commercial and marketing initiatives, with automated and/or non-automated tools.
The contact details provided to Criba Rooms di Tedone Christian Via Vittorio Veneto, 24 – Palese (Ba) may be used, with the consent of the interested user, to send the user promotional information regarding its own and/or third-party services and/or products, with automated tools (email, SMS, fax) and/or non-automated tools (paper mail, telephone with operator), without prejudice to the possibility for the user to oppose the sending of such communications at any time.
The email address provided when requesting a quote will be used by Criba Rooms di Tedone Christian Via Vittorio Veneto, 24 – Palese (Ba), with the explicit consent of the interested party, to send the user commercial information regarding its services similar to those offered and requested by the user when requesting a quote, without prejudice to the possibility for the user to oppose the sending of such communications at the time of data collection and at any time thereafter. It is possible to refuse to receive further commercial or marketing communications at any time by sending the request email to info@cribarooms.it
Finally, all data (provided voluntarily, as well as navigation data) could be processed to pursue a legitimate interest of the owner or a third party, to assert and defend a right in court.
When an interested user voluntarily registers by indicating his/her email address, he/she can expressly request to receive periodic newsletters. Unsubscribing is
permitted at any time by contacting Criba Rooms di Tedone Christian Via Vittorio Veneto, 24 – Palese (Ba) (writing to info@cribarooms.it).
To make a reservation, you must provide your contact details. You must enter specific contact details (specify mandatory fields here) and booking data (e.g. Period of stay). We also save the date and time of the reservation. Additional information (specify optional fields here) is not mandatory. The information provided on our website, including notes, is personally identifiable information and is processed and used by us to ensure the processing of the reservation and the provision of the requested service. We also use your data to provide you with information relevant to the reservation or during your stay. The personal data collected at the time of booking will be forwarded to the following third parties:
Insight srl – Via Chiusa, 1 84046, Ascea (SA) Italy
Hoau SRL – Via S.Rocco, 40 – 65029 Torre de’ Passeri (PE) (Hoau privacy policy)
Stripe Inc. 510 Townsend Street San Francisco, CA 94103, USA (Stripe privacy policy)
WhatsApp Inc. 1601 Willow Road Menlo Park, California 94025 (Whatsapp privacy policy)
We would also like to inform you that the European Regulation recognizes certain rights, including the right of access and rectification, or cancellation or limitation or opposition to processing, in addition to the right to data portability, if and to the extent applicable (articles 15 to 22 of EU Regulation no. 679 of 2016). You can also lodge a complaint with the supervisory authority, according to the procedures established by current legislation.
Owner and Data Controller:
Following the simple consultation of this Site, data relating to identified or identifiable persons may be processed: the “owner” of their processing is Criba Rooms di Tedone Christian Via Vittorio Veneto, 24 – Palese (Ba) – email: info@crubarooms.it
The data will be processed by Suites di Fabiana Fusaro through persons in charge belonging to the Marketing or Commercial, Administration, Legal, System Administration and Programming areas, also depending on the purpose to be achieved, possibly based on the request of the interested party.
Data storage:
The data that we process directly are stored within our systems located at Criba Rooms di Tedone Christian Via Vittorio Veneto, 24 – Palese (Ba)
The data relating to the booking service are stored and managed by third-party companies Insight srl, Booking.com, Expedia.com, Airbnb.com and other booking portals.
Duration of processing
The data is processed for the time necessary to perform the service requested by the user, or required by the purposes described in this document. The user can always ask for the interruption of specific treatments (for example, cancellation from the newsletter service) or the complete cancellation of their data.
Some data may be retained even after cancellation for the period required to fulfill legal obligations, unless it is necessary to retain them further to defend or assert a right or to fulfill any further legal obligations or orders of the authorities.
Rights of the interested party
We remind you that, at any time, you retain the right to obtain information from the joint controllers about the personal data concerning you, the origin of the same, the purposes and methods of processing; you also retain the right to request the updating, rectification, integration, cancellation, transformation into anonymous form or blocking of personal data, processed in violation of the law, including those whose retention is not necessary in relation to the purposes for which the data were collected and/or subsequently processed.
The subjects to whom the above-mentioned personal data refer (so-called “interested parties”), have the right to exercise their rights according to the methods and within the limits established by the current privacy legislation. In particular, the interested party is recognized the following rights:
access: the interested party has the right to ask whether or not data processing concerning him or her is in progress and, if so, has the right to know such data.
rectification: the interested party can ask to rectify or integrate the data that he or she has provided us or in any case in our possession, if inaccurate.
cancellation: the interested party can ask for his or her data to be deleted, if they are no longer necessary for the purposes for which they were collected or in the
event of withdrawal of consent, opposition to processing, in the event of unlawful processing, or if there is a legal obligation to delete;
limitation: the interested party can ask for the limitation of the processing of his or her personal data, when one of the conditions set out in art. 18 of the GDPR applies; in this case, your data will not be processed, except for storage, without your consent, except as explicitly stated in the same article in paragraph 2.
opposition: the interested party may object at any time to the processing of his/her data carried out on the basis of our legitimate interest, unless there are legitimate reasons for us to proceed with the processing that prevail over his/hers, for example for the exercise or our defense in court.
portability: the interested party may ask to receive his/her data, or to have them transmitted to another owner indicated by him/her, in a structured, commonly used and machine-readable format.
Furthermore, pursuant to art. 7, par. 3, GDPR, we inform you that you can exercise your right to withdraw consent at any time, without prejudice to the lawfulness of the processing based on the consent previously given.
To exercise your rights, for cancellation, rectification, integration you can contact info@cribarooms.it
Legal basis of the processing
For some processing, the consent of the interested party is not required.
In particular, there is no possibility of giving or denying consent regarding the recording of log files, the measurement of site access statistics and the sending of cookies strictly necessary for the functioning of the website. In all these cases, in fact, there is a legitimate interest on the part of Criba Rooms di Tedone Christian in the correct functioning of its online activity.
For the registration of identity documents at the police station of belonging. This processing is necessary to fulfill the legal obligation.
Consent is not required in the event of data transmission by the customer for the execution of a reservation or pre-contractual obligations.
In all other circumstances, the processing is based on the consent of the interested party who is free to give it or not. The consent of the interested party is essential for marketing purposes such as, for example, sending commercial information by email.
Browsing data
The computer systems and software procedures used to operate the sites acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.
This information is not collected to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes the IP addresses or domain names of the computers used by users who connect to the Site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user’s IT environment. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the Site and to check its correct functioning. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the Site.