HOTEL MARINA
INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA
pursuant to Article 13 of EU Regulation 2016/679 (GDPR)
Website: www.hotelmarinajesolo.it
In compliance with the provisions of EU Regulation 2016/679 (hereinafter “GDPR”), Hotel Marina provides the following information regarding the processing of personal data of users who visit the website and/or use the hotel’s services.
This information notice is provided pursuant to Article 13 GDPR and refers to data collected through the website, contact forms, online bookings, email, as well as during check-in and throughout the stay at the facility.
1. DATA CONTROLLER
The Data Controller of personal data is:
Hotel Marina
R.G.A. SRL Company
Via Dante Alighieri no. 18
30016 Jesolo (VE)
VAT Code / Tax Code: 03096200278
Email: info@hotelmarinajesolo.it
Tel.: 0421380038
2. TYPES OF DATA PROCESSED
2.1 Navigation data
The IT systems responsible for the operation of the website automatically acquire certain information whose transmission is implicit in the use of Internet protocols:
IP address of the user’s device
Browser type and operating system parameters
Name of the Internet service provider (ISP)
Date, time and duration of the visit
Referring and exit web page
Pages visited and number of clicks
Such data are used solely for the purpose of obtaining anonymous statistical information on the use of the site and to ensure its correct functioning. The data could be used to ascertain liability in the event of computer crimes.0
2.2 Data voluntarily provided by the user
Filling in contact forms, subscribing to the newsletter, making online bookings or sending emails to the indicated addresses involves the collection of the following data:
Personal data: name, surname, date of birth, nationality;
Contact data: email address, telephone number, postal address;
Booking-related data: stay dates, room type, number of guests, special requests;
Payment data: credit/debit card details, processed securely through PCI DSS certified payment gateways;
Identity document data: document number and type, place and date of issue (collected at check-in in compliance with legal obligations);
Any special requirements: dietary preferences, allergies or intolerances, accessibility needs — processed as special categories of data pursuant to Article 9 GDPR, only with explicit consent.
2.3 Data collected during the stay
Pursuant to Article 109 of Royal Decree 18 June 1931, no. 773 (Consolidated Public Security Laws — T.U.L.P.S.) and subsequent amendments, the hotel is required to collect and transmit to the Police Headquarters of Venice the personal details of all guests via the “Alloggiati Web” online portal of the State Police, within 24 hours of arrival (or within 6 hours for stays not exceeding 24 hours). The transmitted data include:
Full personal details: name, surname, gender, date and place of birth, nationality, citizenship;
Type and number of identity document;
Date of arrival and expected duration of stay.
2.4 ISTAT tourist flows — Veneto Region
Pursuant to Article 13, paragraph 5, of Regional Law Veneto 11/2013, the hotel is required to periodically communicate to the Veneto Region aggregated statistical data on tourist flows (arrivals and overnight stays by origin) through the regional ROSS1000 portal. Such data are transmitted in aggregated and anonymised form; they do not involve the communication of personal identifying data of individual guests to third parties.
3. PURPOSES AND LEGAL BASES OF PROCESSING
Personal data are processed for the following purposes, each with its own legal basis pursuant to Article 6 GDPR:
Management of bookings and contractual relationship – Art. 6(1)(b) GDPR (performance of a contract):
Processing and confirmation of bookings, provision of requested hotel services, management of check-in and check-out, invoicing.
Compliance with legal obligations – Art. 6(1)(c) GDPR (legal obligation):
Transmission of guest data to the Police Headquarters (Art. 109 T.U.L.P.S. and Ministerial Decree 7 January 2013), tax and accounting obligations (Art. 2220 Civil Code, Presidential Decree 633/1972, Presidential Decree 600/1973), communication of tourist flows to the Veneto Region (Art. 13 L.R. 11/2013), application of tourist tax.
Marketing and promotional communications – Art. 6(1)(a) GDPR (consent, prior and specific):
Sending newsletters, promotional offers, information on events, post-stay feedback and review requests. Consent is optional and may be withdrawn at any time without affecting the lawfulness of prior processing. Withdrawal does not affect the use of hotel services.
Security and video surveillance – Art. 6(1)(f) GDPR (legitimate interest of the Controller in protecting the safety of guests, employees and property):
Common areas of the hotel (reception, entrances, parking areas, pool areas) are subject to video surveillance. Images are stored for a maximum of 48 hours via automatic deletion, in compliance with the guidelines of the Italian Data Protection Authority (Video Surveillance Guidelines, General Provision 8 April 2010, doc. web 1712680, and EDPB Guidelines 3/2019). Longer retention periods, however not exceeding 7 days, may be applied only in the presence of specific and documented security needs. For areas where employees transit, installation of systems is subject to the guarantees provided by Article 4 of Law 20 May 1970, no. 300 (Workers’ Statute). Appropriate signage, indicating the Data Controller and Processor and the retention period, is displayed near the cameras.
Customer service and complaint management – Art. 6(1)(b) GDPR (performance of contract) and (f) (legitimate interest):
Response to assistance requests and reports, protection of contractual rights.
4. COOKIES AND TRACKING TECHNOLOGIES
The website uses cookies and similar technologies. The reference legislation is Directive 2002/58/EC (e-Privacy), as implemented in Italian law, as well as the Guidelines of the Data Protection Authority on cookies (Provision of 8 May 2014 and subsequent indications).
Technical cookies (strictly necessary): essential for the proper functioning of the site and navigation. They do not require user consent.
Analytical cookies: used to collect aggregated information on website usage (e.g. Google Analytics with anonymised IP). They require user consent.
Profiling and marketing cookies: used to provide personalised content and advertisements based on user preferences. They require explicit consent.
For more information and to manage preferences, the Cookie Policy is available on the hotel website.
5. PROCESSING METHODS AND SECURITY MEASURES
Processing is carried out using electronic and/or paper-based tools, with organisational and logical measures related to the stated purposes. Data are processed by specially authorised and trained personnel, in compliance with the principles of minimisation and proportionality.
The Controller adopts appropriate technical and organisational measures pursuant to Article 32 GDPR, including: encryption of sensitive data, access control, periodic backups and system security updates. In the event of a personal data breach involving a risk to the rights and freedoms of individuals, the Controller will notify the Authority within 72 hours and, where appropriate, the data subjects, pursuant to Articles 33–34 GDPR.
6. DATA RECIPIENTS
Personal data may be communicated, within the strictly necessary limits for the stated purposes, to the following categories of recipients:
Police Headquarters of Venice, for legal obligations under Article 109 T.U.L.P.S.
Veneto Region (ROSS1000 portal), for statistical flow reporting pursuant to Article 13, paragraph 5, L.R. Veneto 11/2013
Municipality of Jesolo, for tourist tax collection
Banks and PCI DSS certified payment service providers, for payment processing
Online booking agencies — OTAs (e.g. Booking.com, Expedia etc.), within their respective agreements; OTAs act as independent data controllers for the data they collect
Tour operators and travel agencies
IT service providers, property management systems (PMS) and channel management systems, appointed as Data Processors pursuant to Article 28 GDPR
Tax, legal and labour consultancy firms
Email marketing service providers (e.g. Mailchimp), only with prior consent of the data subject and with adequate contractual safeguards
Judicial or administrative authorities, upon request and within legal limits
Data Processors appointed pursuant to Article 28 GDPR are bound by specific agreements. The updated list of Data Processors is available upon request at the hotel premises.
7. TRANSFER OF DATA TO THIRD COUNTRIES
Personal data are mainly processed within the European Economic Area (EEA). Some services used by the hotel (OTA platforms, digital marketing tools) may involve transfers to third countries. In such cases, transfers are carried out in compliance with Articles 44–49 GDPR, in particular through European Commission adequacy decisions or Standard Contractual Clauses (SCC). The Controller provides information on the safeguards adopted upon request.
8. RETENTION PERIODS
Personal data are stored for the time strictly necessary to achieve the purposes for which they were collected, in compliance with legal limitation periods and the principle of storage limitation (Article 5(1)(e) GDPR). Below are the specific periods per category:
Booking and stay data (accounting and taxation):
10 years from the last record, pursuant to Article 2220 Civil Code (accounting records, invoices and correspondence) and Presidential Decree 633/1972 (VAT registers).
Data communicated to the Police:
Digital receipts generated by the Alloggiati Web portal, certifying the transmission of guest data, must be stored for 5 years from entry (as required by sector regulations). Any copies of guest data must be deleted immediately after receipt of the transmission confirmation, in accordance with the guidelines of the Data Protection Authority (doc. web 1138725).
Video surveillance images:
Maximum 48 hours from recording, via automatic overwriting (in accordance with the General Provision on Video Surveillance of 8 April 2010). Longer periods — not exceeding 7 days — may be applied only in the presence of specific needs documented in the Records of Processing Activities (Article 30 GDPR).
Marketing data:
Until consent is withdrawn. In the absence of withdrawal and further interaction, data will be deleted within 24 months from the last interaction, to ensure the quality and relevance of communications.
Navigation data (system logs):
Up to 12 months from collection, unless required for investigation of computer crimes.
Information requests and contacts:
24 months from receipt of the request, in line with the processing purpose.
ISTAT statistical flows — Veneto Region:
Data are transmitted in aggregated and anonymous form. No deletion terms apply to personal identifying data, as no individual personal data are communicated.
9. NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL
Providing data marked as mandatory in booking forms, or required by law at check-in (Art. 109 T.U.L.P.S.), is necessary to comply with legal obligations or to perform the accommodation contract. Failure to provide such data will make it impossible to proceed with the booking or check-in.
Providing data for marketing purposes (newsletter, promotional offers) is entirely optional. Refusal or withdrawal of consent does not affect the use of hotel services.
10. RIGHTS OF DATA SUBJECTS
Pursuant to Articles 15–22 GDPR, you have the right to:
Access (Art. 15): obtain confirmation of whether data is being processed and receive a copy
Rectification (Art. 16): obtain correction of inaccurate data or completion of incomplete data
Erasure / “right to be forgotten” (Art. 17): obtain deletion of data where applicable
Restriction of processing (Art. 18): obtain restriction in applicable cases
Portability (Art. 20): receive data in a structured, machine-readable format and transmit it to another controller
Objection (Arts. 21–22): object to processing based on your particular situation, including profiling and/or automated decision-making under GDPR 2016/679, by contacting the Controller at the address in [mail].
You have the right, at any time, to request access, rectification, deletion, and restriction of processing of your personal data.
You also have the right to object at any time to the processing of your data (including automated processing, e.g. profiling) as well as to data portability.
Without prejudice to any other administrative or judicial remedy, if you believe that the processing of your personal data violates EU Regulation 2016/679, pursuant to Article 15(f) of the said Regulation.
Requests may be sent to the Data Controller at:
Email: info@hotelmarinajesolo.it
Post: Hotel Marina - Via Dante Alighieri no. 18, 30016 Jesolo (VE)
The Controller will respond within 30 days of receipt of the request (Article 12 GDPR). In case of complexity or a high number of requests, this period may be extended by an additional 60 days, with prior communication to the data subject.
You have the right to lodge a complaint with the Data Protection Authority and, with reference to Article 6(1)(a) and Article 9(2)(a), the right to withdraw consent at any time. Link to the Data Protection Authority website: http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524.
In the case of a data portability request, the Data Controller will provide you with personal data concerning you in a structured, commonly used and machine-readable format, without prejudice to paragraphs 3 and 4 of Article 20 of EU Regulation 2016/679.
11. RECORD OF PROCESSING ACTIVITIES
Hotel Marina maintains a Record of Processing Activities pursuant to Article 30 GDPR, containing information on purposes, categories of data, recipients, transfers to third countries and retention periods. The Record is available for inspection by the Authority upon request.
12. UPDATES TO THIS INFORMATION NOTICE
The Controller reserves the right to modify, update or supplement this information notice at any time, including due to regulatory changes or Data Protection Authority practices. Updated versions will be published on the hotel website with the revision date indicated. In the event of substantial changes concerning data processed with consent, the data subject will be informed and new consent may be requested.
