Privacy Policy for data processing on the website
(Last Update February 12th, 2021)
Blastness S.r.l, with registered office in Milan (Italy), Piazza Castello n. 26 – 20121, VAT no. 01195440118, as data controller (hereinafter, “Data Controller”), informs you pursuant to the EU Regulation no. 679/2016 (“GDPR”) and the applicable national regulation on personal data protection that your personal data shall be processed according to the following modalities and for the following purposes:
Subject of the Processing
The Data Controller processes the identifying and not particular personal data (hereinafter “Data” or “Personal Data”) communicated by you while browsing on the website of the Data Controller HYPERLINK "http://www.blastness.com" www.hotelfuxia.com (hereinafter “Website”) and, namely:
e-mail address and any other data you provided when requesting information to the Data Controller;
name, surname, e-mail and any other hotel and location related data you provided when subscribing to the newsletter;
name, surname, address, email address, telephone number, place and date of birth, tax code, data on the educational and professional career and any other data contained in the CV provided at the time of your application to the Data Controller;
browsing data such as IP addresses or domain names of the computers used by users connecting to the Website, URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and IT system of the user. This information is collected through the cookies described in the Cookie Policy of the Website, to which reference is made.
Purposes and legal bases of the processing
Your Personal Data are processed for the following Purposes and legal bases:
the execution of the contract or the fulfilment of pre-contractual obligations:
managing a contact request coming from you;
use of the Website;
providing you with technical assistance;
properly carrying out human resources selection (e.g. application management).
the pursuit of a legitimate interest of the Data Controller:
managing and maintaining the Website;
preventing or discovering fraudulent activities or harmful abuses on the Website;
exercising the rights of the Data Controller, such as the right to defence in court.
the fulfilment of legal obligations:
complying with obligations under laws, regulations, European laws, orders and requirements issued by the relevant authorities.
your prior free, specific and unambiguous consent:
to carry out marketing activities and to send commercial communications relating to products, services, initiatives and updates of the Data Controller or its partners. In this case, consent is given by requesting subscription to the newsletter and, subsequently, by clicking on the confirmation link contained in the email you receive;
to carry out statistics – performed by using the analytical cookies described in the Cookie Policy of the website to which reference is made – aimed at optimising and improving the Website browsing without identifying the user. In this case the consent is collected and can be revoked by means of the cookie banner on the Website.
Modalities of Data Processing
The processing of your Data is carried out, electronically, by means of data collection, registration, update, organization, storage, consultation, elaboration, amendment, selection, retrieval, comparison, usage, interconnection, blockage, communication, erasure and destruction operations.
Data Retention
The Data Controller shall process the Personal Data for a duration that is necessary to fulfil the above purposes and anyway, without prejudice to the terms established by laws, for no longer than 5 years after the collection for the purposes mentioned in point no. 2, except for: human resources selection, for which the retention period is 1 year after the collection of the CV;
marketing and commercial communications sending, for which the retention period is 2 years from the collection;
carrying out statistics using analytical cookies, for which the retention period is indicated in the Cookie Policy of the Website, which reference is made.
Data conferral
The Data conferral for the above-mentioned purposes is optional. If you decide not to provide your Data, we will not be able to carry out the Data processing indicated in point 2.
Access to Data
Your Data may be made accessible for the purposes mentioned above to:
employees and/or collaborators of the Data Controller, as persons in charge of the processing and/or internal Data Processors and/or system administrators;
group companies or third subjects (e.g., IT service providers, suppliers, credit institutes, professional firms, etc.) carrying out outsourcing activities on behalf of the Data Controller as external Data Processors.
Data Communication
Your Data may be communicated, even without your prior consent, for the above-mentioned purposes and upon their request, to control bodies, police or judiciary bodies, that will process them in their quality of independent Data Controllers for institutional purposes and/or pursuant to the law during investigations and controls. Moreover, your Data may be communicated to third parties (for example, partners, independent contractors, agents, etc.) that will process them as independent Data Controllers to carry out activities that are instrumental to the above purposes.
Data Transfer
Your data will not be disclosed but may be transferred to the UK based on the agreements signed between the European Union and the United Kingdom or on the basis of adequate guarantees such as decisions of adequacy or the signing of the Standard Contractual Clauses.
Data Subject’s Rights
The Data Controller informs you that you, as Data Subject, if allowed by the law, have the right to:
obtain confirmation over the existence or inexistence of Personal Data relating to you, even if not yet registered, and their communication in a comprehensible way;
obtain the indication and, if necessary, the copy of the: a) source and category of the Personal Data; b) logic applied in case the processing is performed by means of electronic instruments; c) purposes and modalities of the processing; d) identification references of the Data Controller and the Data Processors; e) subjects or categories of subjects to whom Personal Data may be communicated or who may come to know, in particular if recipients are extra-EU countries or international organizations; e) period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period; f) existence of an automated decision-making process and, in this case, information about the logic involved, the significance and consequences for the data subject; g) existence of adequate safeguards in case of transfer of Personal Data to an extra-EU country or international organization; obtain, without undue delay, the update and the rectification or, whether you are interested, the integration of incomplete Data;
obtain the erasure, the transformation into anonymous form or blocking of the Data: a) processed in breach of the law; b) no longer necessary in relation to the purposes for which the Data have been collected or subsequently processed; c) if you withdraw consent on which the processing is based and there is no other legal ground for the processing; d) if you object to the processing and there are no overriding legitimate grounds for the processing; e) in compliance with a legal obligation; f) referred to children. The Data Controller may refuse to erase them when the processing is necessary: a) to exercise the right of freedom of expression and information; b) in compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority; c) for reasons of public interest; d) to achieve purposes in the public interest, scientific or historical research purposes or statistical purposes; e) for making legal claims;
obtain the restriction of processing when: a) the accuracy of the Personal Data is contested; b) the processing is unlawful and the data subject opposes the erasure of the Personal Data; c) Data are required by you for your exercising of legal claims; d) pending verification whether the legitimate grounds of the controller override those of the data subject;
receive the Personal Data concerning you in a structured, commonly used and machine-readable format and transmit those data to another controller without hindrance from the controller to which the personal data have been provided, if the processing is carried out by automated means;
withdraw at any time the consents provided;
object, in whole or in part: a) for lawful grounds to the processing of Personal Data regarding you, even if pertaining the purpose of Data collection; b) to the processing of Personal Data that relates to you for the purpose of sending advertising material or of direct sale or for market researches or commercial communication, by means of automated call systems without the intervention of an operator, e-mail and/or traditional marketing methods by telephone and/or paper mail.
submit a data protection complaint to the relevant supervisory authority.
In the cases mentioned above, if necessary, the Data Controller shall communicate any exercise of your rights to each third party to whom the Personal Data are communicated, except for specific cases (for example, if this proves impossible or involves disproportionate effort).
Modalities of the Exercise of Rights
You will be able to exercise your rights anytime:
by sending a registered letter with return receipt to the address of the Data Controller;
by sending an email to [email protected];
Data Controller and Data Processor
The Data Controller is Blastness S.r.l, with registered office in Milan, Piazza Castello n. 26 – 20121, VAT no. 01195440118.
Blastness S.r.l.
