Privacy Policy of www.hotelallegria.it

Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

Last updated: August 2026

This Privacy Policy describes how personal data are processed when users visit the website www.hotelallegria.it and use the digital services made available by:

CALYPSO SRL UNIPERSONALE
Via Grazzano no. 8 – 33100 Udine (UD), Italy
VAT No.: 03213080306

• E-mail: info@hotelallegria.it
• Tel.: +39 0432 201116

acting as the Data Controller pursuant to Regulation (EU) 2016/679.

This Privacy Policy applies exclusively to the website www.hotelallegria.it and does not apply to external websites that may be accessed through links on the website.

1. Types of personal data processed

Data voluntarily provided by the user

The website may collect personal data voluntarily provided by the user, including:

• first and last name;
• e-mail address;
• telephone number;
• content of requests submitted through contact forms;
• information necessary to request availability or book the services offered.

Providing such data is optional; however, failure to provide the requested information may make it impossible to provide the requested information or services.

Booking data

When requesting or managing a booking, personal data necessary for managing the pre-contractual and contractual relationship may be processed.

Browsing data

During the normal operation of the website, computer systems automatically collect certain data whose transmission is implicit in the use of Internet communication protocols.

This may include, by way of example:

• IP address;
• browser type;
• operating system;
• date and time of the request;
• technical information relating to browsing activity.

Such data are processed solely to ensure the proper functioning of the website, IT security and the prevention of unlawful activities.

2. Purposes and legal bases of processing

Personal data are processed for the following purposes.

A) Management of enquiries and bookings

Personal data are processed in order to:

• respond to requests for information;
• provide quotations;
• manage availability requests;
• manage bookings and requested services.

Legal basis: Article 6(1)(b) GDPR (performance of a contract or taking steps at the request of the data subject prior to entering into a contract).

B) Administrative, accounting and tax obligations

Personal data may be processed to comply with obligations imposed by applicable laws and regulations.

Legal basis: Article 6(1)(c) GDPR (compliance with a legal obligation).

C) Public security obligations

In the event of a stay at the property, guests’ personal data will be processed in order to comply with the obligations provided for by Article 109 of Royal Decree No. 773/1931 and applicable legislation concerning the communication of guest information to the competent authorities.

Legal basis: Article 6(1)(c) GDPR.

D) Commercial communications to existing customers (“soft spam”)

Where the data subject has already used the services of Hotel Allegria, the Data Controller may use the contact details provided during the contractual relationship to send communications concerning services similar to those previously purchased.

Such communications may concern, for example:

• accommodation offers;
• seasonal initiatives;
• events organised by the property;
• restaurant activities;
• experiences and proposals relating to the local area.

This processing is carried out pursuant to Article 130(4) of Italian Legislative Decree No. 196/2003 (Italian Privacy Code).

The data subject may object to such communications free of charge at any time.

E) Newsletters and promotional communications

Subject to the user’s freely given, specific and optional consent, personal data may be used to send:

• newsletters;
• special offers;
• promotions;
• updates concerning Hotel Allegria’s activities.

Legal basis: Article 6(1)(a) GDPR (consent of the data subject).

Consent may be withdrawn at any time.

3. Processing methods

Personal data are processed using paper and electronic means in accordance with the principles of:

• lawfulness;
• fairness;
• transparency;
• data minimisation;
• storage limitation;
• integrity and confidentiality.

The Data Controller adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or improper disclosure.

4. Recipients of personal data

Personal data may be disclosed only to parties whose involvement is necessary for the purposes described above, including:

• personnel authorised by the Data Controller;
• hosting and website maintenance providers;
• IT service providers;
• administrative, tax and legal consultants;
• Passepartout S.p.A., as provider of the Passepartout Welcome booking system, limited to the data necessary to manage availability requests and bookings;
• public authorities where required by law.

Entities that process personal data on behalf of the Data Controller are appointed, where applicable, as Data Processors pursuant to Article 28 GDPR.

Personal data will not be publicly disclosed.

5. Third-party services

Passepartout Welcome booking system

The website provides a booking system operated through the Passepartout Welcome platform.

When users access the booking engine or enter data to request availability or make a booking, such data are also processed through the systems of the Passepartout Welcome platform solely to provide the requested service.

The legal basis for this processing is Article 6(1)(b) GDPR.

Google Maps

The website may include interactive maps provided by Google Maps, a service operated by Google.

Use of the map may involve the transmission of technical data, such as the user’s IP address and information concerning the device being used.

Where the map is embedded on the website through third-party content, it will be loaded in accordance with applicable legislation concerning consent to cookies and other tracking technologies.

For further information, please refer to Google’s privacy policy.

6. Transfers of personal data to third countries

Some technology providers used by the website, including Google and other digital service providers, may process personal data outside the European Union.

Such transfers are carried out exclusively in accordance with Articles 44–49 GDPR, using an adequacy decision adopted by the European Commission, Standard Contractual Clauses (SCCs), or other safeguards provided for by applicable legislation.

7. Data retention period

Personal data are retained for no longer than necessary to achieve the purposes for which they were collected.

In particular:

8. Cookies

The website uses:

• technical cookies necessary for the operation of the website;
• cookies relating to third-party services, such as Google Maps;
• analytics or marketing cookies only where the user’s prior consent is required and has been obtained.

Consent is collected through an appropriate cookie banner allowing users to:

• accept all cookies;
• reject non-essential cookies;
• customise their preferences.

Cookie preferences may be changed at any time.

For detailed information, please refer to the website’s Cookie Policy.

9. Nature of providing personal data

Providing personal data for information requests or bookings is optional, but necessary in order to provide the requested service.

Failure to provide the required information may prevent the Data Controller from responding to the request.

Providing data for marketing purposes is always optional.

10. Rights of the data subject

The data subject may exercise, at any time, the rights provided for by Articles 15–22 GDPR, including:

• the right of access to personal data;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to object to processing;
• the right to data portability;
• the right to withdraw previously given consent.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

11. How to exercise your rights

Requests concerning the exercise of data protection rights may be sent to:

CALYPSO SRL UNIPERSONALE

• E-mail: info@hotelallegria.it
• Address: Via Grazzano no. 8 – 33100 Udine (UD), Italy

The Data Controller will respond within the time limits established by Article 12 GDPR.

12. Automated decision-making

Personal data processed through the website are not subject to decisions based solely on automated processing, including profiling, producing legal effects or similarly significantly affecting the data subject within the meaning of Article 22 GDPR, except where this may be applicable to third-party services for which the user has provided the relevant consent through the cookie management system.

13. Updates to this Privacy Policy

This Privacy Policy may be updated to reflect changes in legislation, technology or the organisation of the services.

The most recent version will always be available on www.hotelallegria.it.