Notice to Data Subjects

Dear Prospective Client,

This privacy notice is provided pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR) as well as in accordance with current legislation on the protection of personal data (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018), to provide you with all information regarding the processing of your personal data in connection with your use of our website www.hotiday.com, its subdomains, and the services we offer, including participation in the Hotiday Club loyalty program.

We would like to clarify that this privacy policy applies only to the website hotiday.com and not to other websites that users or visitors may access through any links provided, including the websites of partner accommodations where the stay is booked.

The Data Controller is Hotiday S.r.l., with its registered office at Via Giovanni Porzio No. 4, Naples (NA), and VAT number 10011061214, represented by Federico di Carlo, Chairman of the Board of Directors.

The Data Controller has appointed a Data Protection Officer, Studio Figurati S.r.l.s., who can be contacted by email at dpo.hotiday@figurati.it for any questions regarding the processing of your personal data and the exercise of your rights.

The computer systems and software procedures used to operate the website may, during their normal operation, collect certain personal data whose transmission is implicit in the use of Internet communication protocols (IP addresses, domain names of the computers used to connect, operating system and browser used, and timestamps). This data is not collected to be associated with identified individuals, but by its very nature—through processing and association with third-party data—it could indirectly allow for the identification of users. They are used exclusively to obtain anonymous statistical information and to verify the proper functioning of the website; they are retained for a limited period and are neither disclosed nor disseminated. The legal basis is the Data Controller’s legitimate interest (Art. 6(1)(f) of the GDPR) in the security of its IT infrastructure.

Cookies are small text strings that websites you visit store on users’/visitors’ computers to enable the sites to function, improve navigation, and, in some cases, monitor usage; they may also be installed by other websites or web servers (so-called “third parties”). The website uses technical cookies, which are necessary for its operation and do not require consent, and—subject to your consent, which may be given in advance and revoked on a per-purpose basis—cookies for the purposes of functionality, user experience, analytics, and marketing, including personalized ads.

Upon first access, the user/visitor has the option to grant, refuse, or customize their consent and may modify or revoke it at any time via the preferences panel. The updated list of cookies installed for each purpose, their providers, durations, and third-party notices is contained in the Cookie Policy, available at the bottom of every page on the site and accessible at any time from the preferences panel.

For individuals who wish to use our services, we require that they provide certain personal information, including basic personal details, contact information, as well as billing and payment method details. The purpose is to book your stay with our partners, send you communications regarding the organization of the service and booking confirmation, process payments, manage any changes, cancellations, and refunds, and provide you with assistance before and during your stay. In this case, the legal basis is that provided for in Article 6(1)(b) of the GDPR, namely the performance of a contract to which the data subject is a party, or the implementation of pre-contractual measures taken at the data subject’s request; failure to provide such data makes it impossible to process the reservation.

During the booking process, you have the option—on a completely voluntary basis—to indicate your expected arrival time and the type of trip. This information is processed solely to enable the host facility to organize your reception and services. The legal basis is the performance of the contract (Art. 6(1)(b) of the GDPR), and failure to provide this information has no impact on your reservation.

If you wish to provide us with additional personal data concerning you, including data belonging to special categories—so-called “sensitive data”—pursuant to Article 9 of the GDPR (in particular, data revealing health status, such as dietary requirements related to medical conditions or the need for mobility aids) by filling out the free-text “Notes” field during the booking process, you will be deemed to have implicitly consented to the disclosure of such data to the facility where you are making the reservation. In this case, the purpose will be to process your explicit request, and the data will be processed only for the time necessary to fulfill the request, after which it will be deleted at the end of your stay.

By signing up for the “ Hotiday ” Club program for free, you can receive special offers and discounts on reservations, as well as access to exclusive last-minute rates. To sign up, we’ll ask for your personal information, including your basic personal details, contact information, and residential address. Alternatively, you can sign up using your Google account: in this case, we receive the profile information necessary for authentication from the service provider.

Your data is processed to create and manage your account, automatically provide and apply the financial benefits offered by the program, manage your booking history, and provide you with assistance. The legal basis is the performance of the program membership agreement to which you are a party (Art. 6(1)(b) of the GDPR). Membership is voluntary and does not in any way affect your ability to book a stay; you may withdraw at any time by requesting the deletion of your account.

Membership also entitles you to receive special offers reserved for members, as described in the following section.

Membership in the “ Hotiday Club” program entitles you to receive, via email and in the members-only section of the website, exclusive offers and rates reserved for members, as provided for in the program’s Terms and Conditions. The legal basis is the performance of the program membership agreement to which you are a party (Art. 6(1)(b) of the GDPR).

You can opt out of receiving exclusive offers via email at any time by clicking the “unsubscribe” link at the bottom of each email. Unsubscribing will not affect your ability to book a stay, nor will it affect your membership or the benefits of the Hotiday Club program: the offers will remain available in the members-only area.

If you have already used one of our services, we may use your email address to send you communications regarding services similar to the one you purchased, pursuant to Article 130, paragraph 4, of Legislative Decree 196/2003, without the need for your prior consent. You may object to this processing, informally and free of charge, at any time by using the opt-out link included in each message.

Subject to your specific, optional consent, we analyze your preferences and behavior (booking history, destinations and properties viewed, the type of trip you’ve indicated, and your interaction with our communications) in order to create a profile and send you offers tailored to your interests. The legal basis is the data subject’s consent (Art. 6(1)(a) of the GDPR). Failure to provide consent does not affect your participation in the program or its benefits. You may withdraw your consent at any time through the member portal. This processing does not produce legal effects against you nor does it affect you in a similarly significant manner within the meaning of Article 22 of the GDPR.

Your personal data may be disclosed to:

• the partner establishments through which you make your reservation, which act as independent data controllers;
• technical and management service providers (hosting, booking engine and PMS management, sending communications, customer support), appointed as data processors pursuant to Article 28 of the GDPR, with whom Hotiday has entered into a specific Data Protection Agreement;
• payment service providers, which process payment method data as independent data controllers in compliance with industry regulations;
• third parties responsible for managing administrative, financial, accounting, and legal matters;
• any third parties to whom the data may be disclosed for the purpose of managing additional services, at the customer’s explicit request, as part of the “Digital Concierge” service, who process the data as data controllers or data processors, depending on their role and the circumstances;
• authorities and supervisory bodies, in the cases provided for by law.

The complete and up-to-date list of entities that process data as data processors is available upon request by emailing dpo.hotiday@figurati.it.

Under no circumstances will your personal data be disclosed.

The data is processed at the Data Controller’s facilities and at the facilities of the technical service providers appointed by the Data Controller as data processors, whose hosting infrastructure is located within the European Union.

Some third-party services we use (in particular, Google Account authentication, messaging tools, and analytics tools) may involve the transfer of data to third countries. In such cases, the transfer is based on an adequacy decision by the European Commission or on the standard contractual clauses referred to in Article 46(2)(c) of the GDPR, together with additional measures where necessary.

You may request a copy of the safeguards in place by writing to dpo.hotiday@figurati.it.

Your data is retained for as long as necessary to fulfill the purposes for which it was collected and, thereafter, for the duration of the statutory retention obligations. Specifically: reservation and stay data, including billing information, for ten years following the end of the stay (Art. 2220 of the Italian Civil Code and tax regulations); optional information regarding the stay and the contents of the “notes” field up to the end of the stay; browsing data and system logs for a period not exceeding twelve months, as necessary for website security; Hotiday Club account data for the duration of membership and, in the event of inactivity, for twenty-four months from the last interaction, after which the account is deleted following prior notice.

Data is processed to send communications regarding similar services until you object, and in any case no later than twenty-four months after your last reservation, and for profiling purposes until you withdraw your consent, and in any case no later than twelve months after the data is recorded. Once these periods have elapsed, or following an objection or revocation, processing for these purposes ceases; the email address of the person who objected is retained solely to ensure compliance with the objection. This is without prejudice to retention for the time necessary to exercise or defend a right in court.

As the data controller, Hotiday S.r.l. is committed to ensuring compliance with current regulations regarding the security of personal data. Content maintenance and management are carried out internally by personnel who have been appropriately trained and authorized in accordance with Article 29 of the GDPR. Each data processing operation is carried out using automated tools (e.g., electronic procedures and media) and/or manually (e.g., on paper) for the time strictly necessary to achieve the purposes for which the data was collected and, in any case, in accordance with applicable regulations.

Specific security measures are in place to prevent the loss, unlawful or improper use of data, as well as any unauthorized access.

As a data subject, you have the right to access your personal data, request its rectification, erasure, portability, restriction of processing, or to object to its processing, in accordance with Articles 15 through 22 of the Regulation, as well as to lodge a complaint with a supervisory authority in accordance with applicable procedures. In particular, you may object at any time and without having to provide a reason to the processing of your data for direct marketing purposes, including related profiling (Article 21(2) of the GDPR), and may withdraw the consent you have provided at any time, just as easily as you gave it, without this affecting the lawfulness of the processing carried out prior to the withdrawal (Article 7(3) of the GDPR).

To exercise these rights, you may write to our Data Protection Officer (DPO), Studio Figurati S.r.l.s., who can be contacted by email at dpo.hotiday@figurati.it

The Data Controller reserves the right to modify or update this privacy policy, including as a result of changes in regulations or in the services offered. The current version is always published on the website www.hotiday.com. In the event of substantial changes to the purposes or legal bases, registered data subjects will be notified via a specific communication.

We would like to take this opportunity to thank you and wish you a pleasant stay with our partners.

Management.