Privacy Policy

Sporting Hotel Salicone S.r.l., with registered office in Norcia (PG), Corso Sertorio n. 21 – 06046, C.F. e P.IVA 01800610543, manager of the restaurants Vespasia and Granaro del Monte 1850, as well as Palazzo Seneca, Casa Bianconi and BBNorciaCentro, in the quality of Data Controller (hereinafter, "Holder"), provides them below, in accordance with and for the effects of EU Regulation 2016/679 (hereinafter, "GDPR"), some information about the processing of personal data collected during the navigation of the website.

Personal data processed and source of data

As part of the subscription to the newsletter or the requests for information, the Data Controller processes personal data and contact details (e.g. name, surname, e-mail address).

As part of the navigation of the website and the booking page, the Owner processes navigation data such as IP addresses or domain names of the devices used and that connect, addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (good end, error, etc.) and other parameters related to the operating system and the user’s computer environment.

Purpose, legal basis of processing and nature of the contribution

As part of the restaurant’s booking activities, your data will be processed for the following purposes:

a) Allow browsing of the website and find any requests.

The legal basis of the processing is the execution of contractual commitments pursuant to Article 6(1)(b) of the GDPR.

b) Defence of the rights of the Owner in judicial and extrajudicial proceedings.

The legal basis for the processing of data is the pursuit of legitimate interest within the meaning of Article 6(1)(f) GDPR consisting in the protection of the interests and rights of the Data Controller.

The provision of personal data is necessary; therefore, any failure to provide the personal data required determines the impossibility of browsing the website or responding to requests for information. However, you may request to object at any time, with a reasoned request to the Data Controller, to the processing of personal data operated on the basis of legitimate interest, in accordance with and for the effects of Article 21 GDPR; your request, in this sense, will be subject to evaluation and feedback by the Data Controller.

c) Purpose of direct marketing of the Owner, with traditional and automated means of contact, consisting, for example, in the sending of commercial communications and advertising material, carrying out market research and investigations on the quality of the service provided and customer satisfaction with regard to all receptive structures and restaurants of the Owner.

The legal basis for the processing of data is the consent pursuant to art. 6, par. 1, letter a) GDPR and art. 130 D.Lgs. No 196/2003.

The provision of personal data for this purpose is optional, therefore, the possible failure to communicate the personal data requested does not result in the impossibility to conclude and execute the reservation of the room and the purchase of services and ancillary products, and your right to withdraw consent or object at any time to such processing, easily and for free, with the methods indicated in the "Rights of the data subject" section of this information and/or with those indicated within the promotional communications that will be sent to you from time to time.

Data recipients

The data may be communicated for the purposes indicated above to other subjects such as public authorities and law enforcement, law firms, accountants, etc. who will treat them as independent data controllers for their own purposes.. They may also have access to data:

the staff of the Owner, who is expressly authorized to process them, in accordance with the instructions given, pursuant to Articles 29 and 32(4) of the GDPR and 2-quatdeciesof Legislative Decree no. No 196/2003;
providers of services in favour of the Data Controller, appointed Data Processors, including for example and not exhaustive IT providers, etc. The updated list of Managers is available from the Owner.

Personal data are not subject to dissemination.

Data retention period

The personal data processed for the purposes indicated in subparagraphs (a) and (b) of paragraph 2 above shall be stored only for the time strictly necessary for the completion of the activities/finals described above and, in particular, for the limitation period of possible judicial proceedings.

The personal data processed for the direct marketing purpose indicated to the letter. c) of the previous point 2 will be retained until the withdrawal of consent or opposition to processing or for 24 months from the moment of the last renewal of consent and the will not to oppose the processing.

Data transfer outside the European Economic Area

Personal data may be transferred to the United Kingdom and/or the United States of America on the basis of appropriate adequacy decisions adopted by the European Commission and, in the case of the United States of America, the accession of recipients to the EU-US Data Privacy Framework programme.

Rights of the person concerned

The data subject may assert his or her rights and/or request information on the processing of his or her data, by contacting the Data Controller. The GDPR gives the data subject:

the right to withdraw consent provided, provided that the withdrawal of consent does not prejudice the lawfulness of the processing based on consent before revocation;
the right of access, i.e. the possibility to obtain a copy of personal data and to know: the purposes of the processing; the categories of personal data in question; the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if they are recipients of third countries or international organisations; where possible, the period of storage of the personal data envisaged or, if it is not possible, the criteria used to determine that period; the existence of the right of the data subject to request the data controller to correct or delete personal data or to restrict the processing of personal data concerning him or to oppose their processing; the right to lodge a complaint with a supervisory authority; where the data are not collected from the data subject, all information available on their origin; the existence of an exclusively automated decision-making process, including profiling, and, at least in such cases, significant information on the logic used, as well as the importance and consequences of such processing for the data subject;
the right to rectification and integration of inaccurate or unupdated data;
the right to erasure, whenever the data is not necessary in respect of the purposes pursued, or if the data subject decides to withdraw consent or opposes processing and there are no other legal bases for their retention, or if the data are unlawfully processed, or have to be deleted for a legal obligation;
the right to limitation of processing if the data subject disputes the accuracy of personal data, for the period necessary for the controller to verify the accuracy of such personal data; if the processing is unlawful and the data subject objects to the deletion of personal data and instead requests that its use be limited; although the data controller no longer needs it for the purposes of processing, if the personal data are necessary to the data subject for the purpose of establishing, exercising or defending a right in court; if the data subject has opposed processing, pending verification of the possible prevalence of the legitimate reasons of the data controller over those of the data subject.

In cases of exercise of the rights referred to in points (c), (d), and (e), the data subject shall have the right to know the recipients to whom the personal data have been transmitted and the right that the Data Controller communicate to them corrections, cancellations or limitations of the processing, unless this proves impossible or implies a disproportionate effort.

the right to data portability, i.e. to receive in a structured format, of common use and readable by automatic device the personal data concerning him, including the direct transfer of the same by the Owner to other Owners, if the processing takes place by automated means and is based on consent or contract;
the right to object to processing if the processing is based on the legitimate interest of the Data Controller, as already specified in point 2 above;
the right to lodge a complaint before the Competent Supervisory Authority (for Italy, the Data Protection Supervisor,https://www.garanteprivacy.it).