Privacy policy

of users consulting the Groupe Valadier website pursuant to Article 13 of Regulation (EU) 2016/679

This page describes how the website is managed with regard to the processing of the personal data of users who consult it and their confidentiality. This information notice is also provided pursuant to Art. 13 of European Regulation 679/2016 – Personal Data Protection Legislation, to those who interact with the web services of Groupe Valadier, accessible electronically from the address:

https://www.groupevaladier.com/

This information does not apply to other sites, pages, or online services accessible via hyperlinks that may be published on the site but refer to resources external to the domain of Albergo Valadier S.r.l.

DATA CONTROLLER

Following consultation of this site, data relating to identified or identifiable persons may be processed. The "Data Controller" of the personal data processed following consultation of our site and any other data used for the provision of our services is Albergo Valadier S.r.l., Via della Fontanella 15 - 00187 Rome - Tax Code 00995220589, VAT No. 00950281006.

DATA PROTECTION OFFICER

The Data Protection Officer (DPO) can be contacted at the following address: amministrazione@groupevaladier.com

PLACE OF DATA PROCESSING

The processing operations connected to the web services of this site [physically hosted at QNT S.r.l. a Socio Unico ("www.qnt.it")] take place at our registered office and are carried out only by our authorized and trained staff, or by any persons appointed for occasional maintenance operations.

Personal data provided by users who submit hotel booking requests or requests for information material (information, newsletters, registrations, etc.) are used for the sole purpose of carrying out the service or performance requested and are not disclosed to third parties, except in the following possible cases:

Commercial partners of Groupe Valadier to whom data is communicated exclusively to process online bookings, including SimpleBooking (https://www.simplebooking.travel/it);

Persons, companies, or professional firms providing assistance and consultancy to Albergo Valadier S.r.l. in accounting, administrative, legal, tax, and financial matters;

Entities whose right to access the data is recognized by legal provisions or orders from authorities.

Credit card details used for reservations will automatically be made unavailable six months after the end of the stay.

TYPES OF DATA PROCESSED – LEGAL BASIS – NATURE OF PROCESSING
NAVIGATION DATA

The computer systems and software procedures responsible for the operation of this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.  

This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.  

This category of data includes IP addresses or domain names of the computers used by users connecting to the site, URI/URL (Uniform Resource Identifier/Locator) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters relating to the user's operating system and computer environment. These data, necessary for the use of web services, are also processed for the purpose of:  

Obtaining statistical information on the use of services (most visited pages, number of visitors per time slot or day, geographical areas of origin, etc.);

Checking the correct functioning of the services offered.

The data could be used to ascertain liability in the event of hypothetical cybercrimes against the site.

Legal Basis: Processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject requiring personal data protection, taking into account the reasonable expectations of the data subject and activities strictly necessary for the functioning of the site and navigation itself – (Recital 47 - Art. 6, par. 1, lit. f of the GDPR).

Nature of Provision: Providing data is necessary for browsing the website.

DATA PROCESSED THROUGH SOCIAL MEDIA PLATFORMS

Regarding the processing of personal data carried out by the operators of the Social Media platforms used by the Controller, please refer to the information provided by them through their respective privacy policies. The Controller processes personal data provided by users through dedicated Social Media pages to manage interactions with users (comments, public posts, etc.) in compliance with current legislation.  

DATA PROVIDED VOLUNTARILY BY THE USER

The optional, explicit, and voluntary sending of messages to the Controller's contact addresses, private messages sent by users to institutional profiles/pages on social media (where this option is available), as well as the completion and submission of forms present on the Controller's website, entail the acquisition of the sender's contact details, necessary to respond, as well as all personal data included in the communications.

Data will be stored solely for the requested subscription to receive newsletters or special offers and will not be disclosed to anyone.

Personal information regarding visitors to the website is neither collected nor used. Visitors remain anonymous. The only exception concerns personally identifiable information necessary to fulfill contractual booking obligations towards the user.

A. Newsletter
Website visitors can register for our newsletter service. By registering, the user's email address will automatically be added to a contact list to which email messages containing periodic updates with information—including commercial and promotional information—relating to initiatives, events, or promotions of the Data Controller may be sent.

To subscribe to the Newsletter, users can use the subscription forms on the site by entering their name and email address. The data entered will be used solely to send our newsletter via email and will not be disclosed to third parties.

Legal Basis: Processing is based on consent to the processing of personal data (Recitals 42 and 43 and Art. 6, par. 1, lit. a of the GDPR).

Nature of Provision: Provision is optional. Failure to provide the necessary data will make it impossible to receive communications.

B. Bookings
In the case of a booking made on the Website, the user must provide their name, phone number, billing address, email address, payment method information, and credit card details. Albergo Valadier S.r.l. will use this information solely to process the booking and send specific information relevant to its confirmation, such as the receipt, booking code, and terms and conditions.

The information provided will not be used for marketing purposes and will not be sold, transmitted, licensed, or forwarded to third parties in any way, with the exception of online booking service providers SimpleBooking (https://www.simplebooking.travel), credit card companies that may be contacted solely to verify validity, and online payment service providers Nexi Payments S.p.A. (https://www.nexi.it/it/ecommerce/xpay), exclusively for purposes related to the management of online bookings.

In any case, the site administrator ensures the adoption of scrupulous procedures to protect navigation data and the use of special care to protect credit card data provided during online bookings.

Legal Basis: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Recital 44 and Art. 6, par. 1, lit. b of the GDPR).

Nature of Provision: Provision is necessary. Failure to provide the necessary data will make it impossible to complete bookings.

C. Management of Personal Data Collected from Curriculum Vitae
It is possible to use the contact details of Albergo Valadier S.r.l. to send candidates' Curricula Vitae in hard copy and/or digital format. The spontaneous and voluntary sending of a CV will be implicitly considered informed consent granted by the data subject for the receipt and processing of personal data contained therein, solely for purposes related to candidate selection.

The data processed for recruitment purposes are personal data useful for searching for the specific profile required. Generally, personal data are of a standard nature, except in certain cases where sensitive data necessary to identify specific requirements provided for by current regulations may be indicated, such as belonging to protected categories, fitness for specific jobs, and/or mandatory job placement, within the limits indicated by the General Provision of the Privacy Guarantor of June 5, 2019, which amended the General Authorization No. 1 of December 15, 2016, on the processing of sensitive data in employment relationships.

Legal Basis: Processing is based on consent to the processing of personal data (Recitals 42 and 43 and Art. 6, par. 1, lit. a of the GDPR) and/or processing is necessary for the performance of a contract or pre-contractual measures (Recital 44 - Art. 6, par. 1, lit. b of the GDPR).

Nature of Provision: Provision is necessary. Failure to provide the necessary data will make it impossible to apply.

General Rules for Sending Curricula Vitae:

Any CVs received spontaneously, in response to an ad, or following a request will be archived directly by designated data processing staff according to personal data security directives adopted in compliance with the security measures under Chapter IV, Sec. 2 of GDPR 679/2016. These will only be printed for a meeting and interview with the candidate. To send a CV, please use the following contact details: Albergo Valadier S.r.l., Via della Fontanella 15 - 00187 Rome, c/o Head of HR, Email: jobs@groupevaladier.com.

D. Administrative-Accounting Management
For organizational, administrative, financial, accounting, and customer/user data management activities, the Data Controller may process relevant personal data.

Legal Basis: Processing is necessary for the performance of a contract to which the data subject is party (Recital 44) or for compliance with a legal obligation (Art. 6, par. 1, lit. c of the GDPR).

Nature of Provision: Providing personal data is mandatory, as it is essential for fulfilling legal obligations.

COOKIES AND TRACKING TECHNOLOGIES USED

Cookie technologies are applied on this site for various purposes, including computer authentication, session monitoring, and storing specific technical information regarding users accessing the web server provider, in compliance with the Guidelines on cookies and other tracking tools adopted by the Privacy Guarantor (June 10, 2021) and the Guidelines of the European Data Protection Board (EDPB) of May 2020. More information on the cookies used is available in the Cookie Policy on this website.

However, if the user blocks or deletes a cookie, it may be impossible to restore previously specified preferences or customized settings, and our ability to personalize the user experience will be limited.

Legal Basis: For non-technical cookies and equivalent technologies, processing is based on consent (Art. 6, par. 1, lit. a and Recitals 42 and 43 of the GDPR). Consent is given through the site's banner and cookie policy.

Nature of Provision: See the cookie policy in the website footer.

DATA RETENTION PERIOD OR CRITERIA TO DETERMINE THE PERIOD

In compliance with Art. 5, par. 1, lit. e) of Regulation (EU) 2016/679, collected personal data will be stored in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

The retention periods for personal data provided through the website depend on the purpose of processing, specifically:

Technical navigation data for correct website functioning: Save for any investigation of liability, navigation data do not persist for more than seven days;

Responding to requests for information/provision of requested services: Maximum 12 months for contact requests; 10 years for administrative/accounting/financial documentation related to service provision;

Data collection for recruitment: Maximum 6 months. In principle, data collected during the recruitment process will be deleted as soon as it becomes clear that no job offer will be made or that the offer will not be accepted by the candidate;

Newsletter, marketing, or general promotional communications via email: Maximum 24 months – or until consent is revoked;

Administrative-accounting management: 10 years as per statutory terms for administrative/accounting/financial record retention;

Cookie management: See the cookie policy in the website footer;

Whistleblowing reports management: See the privacy notice on the whistleblowing portal.

TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES

Personal data are not transferred to third countries outside the EU, in compliance with Chapter V of GDPR 679/2016.

OPTIONAL NATURE OF DATA PROVISION

Apart from what is specified for navigation data, users are free to provide personal data requested in application forms to Albergo Valadier S.r.l. or otherwise indicated in contacts with the hotel to send CVs, make online bookings, or request information material or other communications. Failure to provide such data may make it impossible to obtain what was requested.

PROCESSING METHODS AND DATA PROTECTION MEASURES

Personal data are also processed using automated tools for the time strictly necessary to achieve the purposes for which they were collected, as specified in this notice. The Data Controller and Data Processors ensure the adoption of appropriate organizational, technical, and physical measures to guarantee a level of security appropriate to the risk, ensuring personal data are processed lawfully and in compliance with Art. 32 of GDPR 2016/679. Specific security measures are observed to prevent data loss, unlawful or incorrect use, and unauthorized access. Automated decision-making processes are not used for data processing.

RIGHTS OF THE DATA SUBJECT

The Data Controller is Albergo Valadier S.r.l., Via della Fontanella 15 - 00187 Rome. The Data Protection Officer can be reached via company contact channels.

Data subjects may contact these entities at any time to exercise their rights as provided under Chapter III of GDPR 679/2016, in particular:

The right to request access to personal data, rectification, or erasure ("Right to be Forgotten");

The right to restriction of processing or to object to processing;

The right to obtain a copy of the personal data being processed;

The right to data portability.

Requests can be submitted by contacting: valadierhtl@groupevaladiere.com (or designated privacy email).

RIGHT TO LODGE A COMPLAINT

Data subjects who believe that the processing of their personal data carried out through this site violates the Regulation have the right to lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali), as provided for by Art. 77 of the Regulation, or to bring an action before the appropriate judicial authorities (Art. 79 of the Regulation).