Phi Hotel Ambra | Hotel nel Centro di Pescara

Dear User,

on this page you will find information on how your personal data are managed through our website. We provide this policy not only to comply with the legal obligations on personal data protection set out in Regulation (EU) 2016/679 (hereinafter “GDPR” or “Regulation”), but also because we believe that the protection of personal data is a fundamental value of our business, and we want to give you all the information that may help you protect your privacy and control how your data are used in relation to your browsing experience on our website.

DATA CONTROLLER AND CONTACT DETAILS

The Data Controller is the party that makes decisions regarding the means and purposes of the processing. The Data Controller is Xenia Hôtellerie Solution S.p.A. Società Benefit, with registered office in Guardiagrele (CH), Italy, via Antonio Gramsci, no. 79, VAT No. and Tax Code 01691390692. For any matter concerning the processing of your personal data, you may contact the Data Controller by ordinary post at the above address or by writing to the e-mail address privacy@xeniahs.com.

DATA PROTECTION OFFICER (“DPO”)

Xenia Hôtellerie Solution S.p.A. Società Benefit has appointed a Data Protection Officer, who can be contacted at the following addresses: e-mail: dataprotection@sintab.it, certified e-mail (PEC): dataprotectionsintab@pec.it, for any information concerning the processing of personal data.

PURPOSES OF PROCESSING, DATA PROCESSED, LEGAL BASES, MANDATORY OR OPTIONAL NATURE OF PROVIDING DATA, RETENTION PERIOD

The purpose is the reason why we process your personal data. Below you will find the list of purposes. Each purpose “rests” on one or more legal bases.

Website display and browsing

Purpose: to enable correct browsing of the website and, in the event of cybercrime, to establish any liability.

Data processed: IP addresses, domain names, URIs and browsing data. These data are acquired by the IT systems responsible for the operation of this website.

Legal basis: the data are processed on the basis of the need to provide users with the tools required to visit the website and access the features made available. The legal basis is that provided for by Article 6(1)(f) of the GDPR: the legitimate interest of the Data Controller (consisting in ensuring the correct operation of its IT systems and in investigating possible offences, where applicable also on the basis of a legal obligation).

Mandatory or optional nature of providing data: providing the data is essential in order to visit the website and access its various features.

Notes on processing and retention period: displaying the Website and browsing within it involve, for reasons inherent in the use of IT protocols, an exchange of technical information between the Data Controller's IT system and that of the user. The information transmitted includes, for example: the operating system used, the browser and its version, the time of the request and the size of the data flows. Browsing data are retained for the time strictly necessary for the purposes indicated above, unless it is necessary to establish liability in the event of cybercrime.

Website analytics

Purpose: statistical research and analysis on aggregated or anonymous data aimed at measuring the correct functioning of this website.

Legal basis: these are anonymised data to which personal data protection legislation does not apply (they do not make it possible to trace, identify or make the user identifiable).

Mandatory or optional nature of providing data: providing the data is essential in order to visit the website and access its various features.

Notes on processing: the Data Controller uses the Google Analytics 4 service to collect aggregated data on the website's performance. Please see the analytics cookies section for further information.

Booking management

Purpose: to manage the booking and the request for related ancillary services and products, and to respond to any enquiries.

Data processed: identification data (such as, for example, first name, surname, date of birth, etc.) and contact data (such as, for example, e-mail address, telephone number, etc.) or any other data provided by the user.

Legal basis: performance of a contract to which the data subject is party or performance of pre-contractual measures taken at the data subject's request, Article 6(1)(b) of the GDPR.

Mandatory or optional nature of providing data: providing the data is at your discretion, but it is essential in order to manage the booking. Failure to provide the personal data will therefore make it impossible to complete and carry out the room booking and the purchase of ancillary services and products.

Notes on processing and retention period: the data processed in connection with booking management are retained for the time strictly necessary to carry out the activities and purposes indicated above. Specifically, a retention period of 10 years applies, in line with the time limits set by tax law and the limitation period for possible legal action.

Purchase of gift vouchers

Purpose: to manage the purchase of the gift voucher, issue it and send it to the recipient indicated by the purchaser, enabling the recipient to use it.

Data processed: identification data (such as, for example, first name, surname) and contact data (such as, for example, e-mail address) of the purchaser and of the voucher recipient, as well as any personal message.

Legal basis: performance of a contract to which the data subject is party, Article 6(1)(b) of the GDPR, for the purchaser's data; legitimate interest of the Data Controller, Article 6(1)(f) of the GDPR, for the recipient's data, consisting in fulfilling the purchased voucher and delivering it to the recipient.

Mandatory or optional nature of providing data: providing the purchaser's and the recipient's data is essential in order to issue and send the voucher. Failure to provide the personal data will therefore make it impossible to complete the purchase.

Notes on processing and retention period: the recipient's data are not collected from the recipient directly, but are provided by the purchaser. The data processed in connection with the voucher purchase are retained for the time strictly necessary to carry out the activities and purposes indicated above. Specifically, a retention period of 10 years applies: for the purchaser's data, in line with the time limits set by tax law and the limitation period for possible legal action; for the recipient's data, solely in line with the limitation period for possible legal action.

Assistance with purchased services and products

Purpose: to provide assistance with bookings and purchased services/products; to resolve malfunctions and irregularities.

Legal basis: performance of a contract to which the data subject is party or performance of pre-contractual measures taken at the data subject's request, Article 6(1)(b) of the GDPR.

Mandatory or optional nature of providing data: providing the data is essential in order to request and provide assistance.

Notes on processing and retention period: the data processed in connection with the management of assistance requests are retained for the time strictly necessary to carry out the activities and purposes indicated above. Specifically, a retention period of 5 years from the last intervention (interaction aimed at providing assistance) applies.

Management of user request forms – contacts

Purpose: responding to or fulfilling a direct request from the user (for example, by voluntarily sending messages or e-mails to the Phi Hotels contact details indicated on the website, which entails the subsequent acquisition of your first name and surname and any other personal data included in the related communication).

Data processed: identification data (such as, for example, first name, surname, etc.) and contact data (such as, for example, e-mail address, telephone number, etc.) or other data provided by the user in their requests.

Legal basis: performance of a contract to which the data subject is party or performance of pre-contractual measures taken at the data subject's request, Article 6(1)(b) of the GDPR.

Mandatory or optional nature of providing data: providing the data is at your discretion, but it is essential in order to follow up on the user's requests.

Notes on processing and retention period: only the data strictly necessary to respond to the contact request are collected. The personal data transmitted by filling in the contact form are used exclusively for the purpose described above; they are not processed for marketing or profiling purposes, nor for any purpose other than those indicated. They are not disclosed to third parties. They are deleted once the user's request has been fulfilled.

Recruitment – management of job applications

Purpose: management of applications received and selection of staff for the possible establishment of an employment or collaboration relationship.

Data processed: identification data (such as, for example, first name, surname, tax code, etc.), contact data (such as, for example, e-mail address, telephone number, address of residence and/or domicile, etc.), data relating to work experience and education.

Legal basis: performance of a contract to which the data subject is party or performance of pre-contractual measures taken at the data subject's request, Article 6(1)(b) of the GDPR.

Mandatory or optional nature of providing data: providing the data is at your discretion, but it is essential for Xenia S.p.A. SB to assess your application.

Notes on processing and retention period: the CVs submitted are used exclusively for recruitment purposes. If the candidate is not hired, they are retained for a period of 12 months. If the candidate is hired, the CV will be retained for the entire duration of the employment relationship. CV data are not disclosed to third parties. They may be processed by data processors engaged by the Data Controller within its business organisation.

Newsletter subscription – direct marketing

Purpose: sending, by automated means of contact (e-mail and chatbot), advertising material, newsletters, promotional and commercial communications relating to products and/or services and/or events, as well as carrying out market research, statistical analysis and customer satisfaction surveys.

Data processed: e-mail address.

Legal basis: your data are processed on the basis of your express consent, Article 6(1)(a) of the GDPR.

Mandatory or optional nature of providing data: providing the data is optional and at your discretion; any refusal to provide such data will make it impossible for the Data Controller to send you newsletters. You may also withdraw your consent at any time by clicking the link at the bottom of each communication or by sending a communication (by e-mail) to the Data Controller. Withdrawal of consent will not, however, affect the lawfulness of processing carried out up to that point on the basis of the consent previously given.

Notes on processing and retention period: data collected for marketing purposes (sending newsletters) are retained for a period of 24 months.

Establishment, exercise and/or defence of legal claims

Purpose: the need to establish, exercise or defend the rights of the Data Controller.

Legal basis: legitimate interest, Article 6(1)(f) of the GDPR.

Notes on processing and retention period: the legitimate interest of the Data Controller is to exercise its rights and defend itself both in court (including at the pre-litigation stage) and out of court against third parties (including public bodies) and against data subjects. Personal data collected for this purpose are retained for 10 years, in line with the ordinary limitation period (Article 2946 of the Italian Civil Code), unless the limitation period is interrupted.

RECIPIENTS OF THE DATA

The data are processed by staff authorised by Xenia S.p.A. SB (pursuant to Article 29 of the Regulation) or by suppliers specifically appointed as Data Processors (pursuant to Article 28 of the Regulation), who act on the instructions of the Data Controller.

For online payments, the data required for the transaction are disclosed to the payment service provider.

The complete and up-to-date list of data processors may be requested from the Data Controller at the addresses indicated above.

METHODS AND PLACE OF PROCESSING

The processing connected with the web services of this website takes place in Europe.

Personal data are processed mainly by automated means. Specific security measures are in place to prevent data loss, unlawful or incorrect use and unauthorised access.

COOKIE POLICY

For further information on cookies, please visit the Cookie section of the Website to view the Cookie Policy, which should be read together with this policy.

RIGHTS OF THE DATA SUBJECT

You can exercise the rights granted to you by the GDPR in relation to your personal data by writing to privacy@xeniahs.com. We undertake to respond to your request as quickly as possible and in any event within one month of receiving it. In certain cases, we will ask you for a copy of an identity document where it is necessary to verify your identity in relation to your request. In particular, you may exercise the following rights:

Right of access, that is, the right to know whether personal data concerning you are being processed and, if so, to obtain a copy of those data and to be informed of: the source of the data, the categories of personal data processed, the recipients of the data, the purposes of the processing, the existence of automated decision-making (including profiling), the data retention period and the rights provided for by the GDPR;
Right to rectification or completion of your data;
Right to erasure of personal data where such data are no longer necessary for the purposes for which they were collected, or where we are no longer authorised to process them;
Right to restriction of processing of personal data in the following cases: i) you have contested the accuracy of the personal data. You may request restriction of processing for the period necessary to verify the accuracy of the data; ii) we are no longer authorised to process the data and, instead of having them erased, you may ask us to restrict their use; iii) where the personal data we hold, although no longer necessary for the purposes for which they were collected, are required by you for the establishment, exercise or defence of legal claims;
Right to data portability, that is, the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, as well as the right to request that such data be transmitted to another controller;
Right to withdraw consent, for processing based on consent;
Right to object at any time to the processing of your personal data based on our legitimate interest.

You also have the right to lodge a complaint with the competent data protection supervisory authority if you believe that the processing of your data infringes the provisions of the GDPR.

We reserve the right to update the content of this page periodically. We invite you to consult this policy regularly so that you are kept informed of any changes made since your last visit.

Cookie Policy of the website: https://www.phi-hotels.com/cookie-policy

Feel Welcome

Book now