Personal Data Security Policy

The management and all employees of Hotiday S.r.l., a company operating in the hotel hospitality sector, are committed to ensuring the confidentiality, integrity, availability, and resilience of the personal data processed by the Organization, in order to safeguard the rights and freedoms of data subjects while ensuring legal, regulatory, and contractual compliance, as well as the resulting positive impact on the company’s market reputation that adopting robust protection of its customers’ privacy can generate.

The data security requirements are consistent with the Organization’s operating procedures, and the Organizational Model for the Protection of Personal Data that has been adopted serves as the tool that enables information sharing, ensures proper operations, and reduces information-related risks to acceptable levels.

The definition of roles and responsibilities, as well as the specific identification of the processing operations performed on personal data and the related analysis of the risks to which such data may be subject, constitute the context within which the Organizational Model has been implemented and is dynamically updated in response to the continuous evolution of that context.

Other key elements of this policy include business continuity and emergency plans, data recovery procedures, protection against malware and intrusions, system access controls, and reporting mechanisms for information security incidents. Control indicators for each of these areas are defined in the System documentation and supported by specific procedures.

All parties involved who are employees of Hotiday S.r.l., external parties to the Organization who process personal data on behalf of the Data Controller, and independent Data Controllers with whom the Company has decided to share certain processing activities, ensure that their conduct complies with the provisions of this Policy and the Organizational Model that implements it. All personnel involved in the processing of personal data are formally appointed and receive the necessary and appropriate training in this regard.

The Organizational Model is subject to continuous and systematic reviews and improvements, and the Company is constantly committed to effectively maintaining compliance with the requirements set forth in EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data.

Naples, June 5, 2024

The Data Controller

Federico Di Carlo