Winter Services S.r.l. recognizes the importance of the protection of personal data, undertakes to respect the privacy of users, to treat private data with caution and confidentiality and not to use them for purposes other than those specified below.

To this end, this policy describes how to manage the site with reference to the processing of personal data of users who consult it.

This information is provided, also in accordance with art.13 of EU Regulation 679/2016, to those who interact with the web services of Winter Services S.r.l.

• wintergarden-hotel.com

This Policy may be modified or updated at any time by Winter Services S.r.l..

The information is provided only for this website and not for other websites that may be consulted by the user through links, except for those indicated above.

Data Controller

The Data Controller is: Winter Services S.r.l., Via Padergnone 52, 24050 Grassobbio (BG) VAT number: 03790640167

Data and purpose of processing

Winter Services S.r.l. informs users of the site that the data collected will be used exclusively for the purposes specified below. The data subject to processing are navigation data and data provided voluntarily by the user.

1. Navigation data

The computer systems responsible for the functioning of the website acquire some data necessary for the functioning of the platform and information whose transmission is implicit in the protocols used to connect and surf the Internet.

Some information regarding the browser session and generic data regarding the device used by the user are also acquired. All data is acquired in anonymous form and not referable, however, to a specific user or for profiling purposes.

2. Data provided voluntarily by the user

The user, in order to access some services of the website (contact form, ticketing assistance portal, careers portal) provides Winter Services S.r.l. with different types of data in a spontaneous form after having read this information and possible consent to the processing for one or more of the purposes provided for and listed below.

Winter Services S.r.l. will use the data collected for:

1. purposes related to the use of the services offered by the site (site navigation);
2. activities strictly connected and instrumental to the management of relations with customers and potential collaborators (contacts);
3. to process data relating to curricula for job application evaluation.

Modalità di trattamento

Il trattamento dei dati verrà realizzato ai sensi dell’Art. 4 n. 2) del GDPR, per mezzo delle seguenti operazioni: raccolta, registrazione, organizzazione, conservazione, consultazione, elaborazione, modificazione, selezione, estrazione, raffronto, utilizzo, interconnessione, blocco, comunicazione, cancellazione e distruzione dei dati.

I dati verranno sottoposti a trattamento sia cartaceo che elettronico e/o automatizzato.

I dati, a partire dal loro ricevimento/aggiornamento, saranno conservati per un periodo congruo rispetto alle finalità del trattamento sopra riportate. Per avere maggiori informazioni rispetto ai termini di conservazione dei dati è possibile scrivere a privacy@wintergarden-hotel.com

Comunicazione e trasferimento dei dati

I dati, oggetto del trattamento, non saranno diffusi; potranno invece, per le finalità indicate nella presente informativa, essere comunicati a soggetti terzi, tra cui partners commerciali, consulenti e liberi professionisti, banche ed istituti di credito, assicurazioni, società finanziarie, di factoring, di leasing, di servizi, di gestione e di recupero del credito, revisori dei conti, società di recupero crediti, Enti pubblici, Organismi di revisione o vigilanza, per adempiere ad obblighi derivanti dalla legge, regolamenti, normative comunitarie o per aspetti riguardanti la gestione ed esecuzione del rapporto giuridico con Voi intercorrenti o intercorsi.

I dati verranno trattati dai seguenti soggetti:

• Dipendenti e collaboratori delle società che operano come persone autorizzate al trattamento dei dati in funzione delle mansioni svolte ed adeguatamente istruite.
• Responsabili Esterni ai sensi dell’art.28 GDPR.

L’elenco dei Responsabili per il trattamento dei dati personali è disponibile presso la sede legale di Winter Services S.r.l.

Per tutte le finalità indicate nella presente informativa i dati potranno essere comunicati anche all’estero, all’interno e all’esterno dell’Unione Europea, nel rispetto dei diritti e delle garanzie previsti dalla normativa vigente, previa verifica che il Paese in questione garantisca un livello di protezione “adeguato” ai sensi di quanto previsto dal GDPR.

Rights of the interested party 

In relation to the aforementioned data, all the rights set forth in articles 15, 16, 17, 18, 20 and 21 of the GDPR may be exercised:

1. the right of access to personal data;
2. their rectification in the event of inaccuracy;
3. the deletion of data;
4. the restriction of processing;
5. opposition to processing;
6. the right to data portability, i.e. to receive in a structured, commonly used and machine-readable format the personal data provided and to have them transferred to another data controller without hindrance.

In case of violation of these provisions, the data subject has the right to lodge a complaint with the competent Control Authority.

For further explanations regarding this policy or privacy issues, or to exercise your rights, please write to privacy@wintergarden-hotel.com. privacy@wintergarden-hotel.com

INFORMATION ON THE PROCESSING OF PERSONAL DATA – HOTEL GUESTS

1. Data controller

Winter Services S.r.l. in its capacity as Data Controller, wishes to inform you that EU Regulation no. 2016/679 (hereinafter GDPR) and Legislative Decree no. 196/03 s.m.i. govern the protection of personal data in the context of the processing activities of the same.

Winter Services S.r.l. bases the processing of personal data on principles of correctness, lawfulness, transparency and necessity, thus protecting your rights.
To this end, and in accordance with article 13 of the GDPR, we provide you with the following information.

2. Object of the treatment

The processing that we intend to carry out concerns your personal data as defined by GDPR, of which we are or will become aware by virtue of the legal and contractual relationship with you.

3. Purpose of Treatment

The processing we intend to carry out has the following purposes:

1. to acquire and confirm your reservation of accommodation and ancillary services, and to provide the requested services;
2. to comply with the obligation provided for in the “Consolidated Law on Public Security” (article 109 R.D. 18.6.1931 n. 773) which requires us to communicate to the Police Headquarters, for purposes of public security, the details of the customers accommodated;
3. comply with current administrative, accounting and tax obligations;
4. send you communications regarding promotional offers and updates on rates and dedicated offers.

Pursuant to Article 6(1)(b) and (c) of GDPR, the legal basis for the processing carried out for the purposes referred to in this point (a)(b) and (c) is the performance of the contract or pre-contractual measures and the fulfilment of legal obligations. The provision of data is mandatory; failure to provide the data will make it impossible for us to provide the requested services.

In accordance with the provisions of Article 6(1)(a) of the GDPR, the legal basis for the processing carried out for the purpose referred to in point d) corresponds to the consent given by the data subject. The granting of consent is optional and, in its absence, it will not be possible to carry out the activities indicated. In any case, the consent given may always be revoked, without prejudice to the lawfulness of the processing carried out before the revocation. Communications relating to marketing activities may take place through the use of telematic means (e.g. e-mail).

4. Treatment modalities

The processing of data may consist, in addition to their collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction, in accordance with the provisions of Article 4 n. 2) of the GDPR. It may be carried out both with the use of paper and with the aid of electronic, computer and telematic instruments, according to methods and tools suitable to guarantee the security and confidentiality of the data. In particular, all technical and organizational measures appropriate to data protection will be adopted in order to meet legal requirements and to protect the rights of data subjects.

From the moment they are received and/or updated, the data will be kept for a period of time that is appropriate to the purposes of the processing indicated in point 3 and in any case within the terms of the law.

1. Communication and data transfer

The data will not be disseminated and will be processed by employees and collaborators of the Company, who operate as persons authorized to process the data according to the tasks performed and adequately instructed.

The data may be communicated to external parties, including the Managers appointed in accordance with art. 28 of GDPR. In particular, the data may be communicated to the following categories of subjects, listed below by way of example and not exhaustive:

• Police headquarters;
• Consulting firm;
• Banking institutions;
• Professionals.

For all the purposes indicated in this information notice, your data may also be communicated abroad, inside and outside the European Union, in compliance with the rights and guarantees provided for by current legislation, subject to verification that the country in question guarantees an “adequate” level of protection in accordance with the provisions of the GDPR.

6. Rights of the interested party  

In relation to the aforementioned data, all the rights set forth in articles 15, 16, 17, 18, 20 and 21 of the GDPR may be exercised:

1. the right of access to personal data;
2. their rectification in the event of inaccuracy;
3. the deletion of data;
4. the restriction of processing;
5. opposition to processing;
6. the right to data portability, i.e. to receive in a structured, commonly used and machine-readable format the personal data provided and to have them transferred to another data controller without hindrance.

In case of violation of these provisions, the data subject has the right to lodge a complaint with the competent Control Authority.

For further explanations regarding this policy or privacy issues, or to exercise your rights, please write to privacy@wintergarden-hotel.com. privacy@wintergarden-hotel.com

INFORMATION ON THE PROCESSING OF PERSONAL DATA – THE SPA

1. Data controller

Winter Services S.r.l., in its capacity as Data Controller, wishes to inform you that EU Regulation no. 2016/679 (hereinafter GDPR) and Legislative Decree no. 196/03 s.m.i. regulate the protection of personal data in the context of their processing activities.

Winter Services S.r.l. bases the processing of personal data on principles of correctness, lawfulness, transparency and necessity, thus protecting your rights.

To this end, and in accordance with article 13 of the GDPR, we provide you with the following information.

2. Object of the treatment

The processing that we intend to carry out concerns your personal data as defined by GDPR, of which we are or will become aware by virtue of the legal and contractual relationship with you.

3. Purpose of Treatment

The processing we intend to carry out has the following purposes:

1. to proceed with your request for access to the SPA and the services offered;
2. to comply with current administrative, accounting and fiscal obligations;
3. to send you communications regarding promotional offers and updates on services and dedicated offers.

Pursuant to Article 6(1)(b) and (c) of the GDPR, the legal basis for the processing carried out for the purposes referred to in this point (a) and (b) is the performance of the contract or pre-contractual measures and the fulfilment of legal obligations. The provision of data is mandatory; failure to provide the data will make it impossible for us to provide the requested services.

In accordance with the provisions of art. 6 par. 1 letter a) of GDPR, the legal basis of the processing carried out for the purpose referred to in letter c) corresponds to the consent given by the person concerned. The granting of consent is optional and, in its absence, it will not be possible to carry out the activities indicated. In any case, the consent given may always be revoked, without prejudice to the lawfulness of the processing carried out before the revocation. Communications relating to marketing activities may take place through the use of telematic means (e.g. e-mail).

4. Treatment modalities

The processing of data may consist, in addition to their collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction, in accordance with the provisions of Article 4 n. 2) of the GDPR. It may be carried out both with the use of paper and with the aid of electronic, computer and telematic instruments, according to methods and tools suitable to guarantee the security and confidentiality of the data. In particular, all technical and organizational measures appropriate to data protection will be adopted in order to meet legal requirements and to protect the rights of data subjects.

From the moment they are received and/or updated, the data will be kept for a period of time appropriate to the purposes of processing indicated in point 3 and in any case within the terms of the law.

5. Communication and data transfer

The data will not be disseminated and will be processed by employees and collaborators of the Company, who operate as persons authorized to process the data according to the tasks performed and adequately instructed.

The data may be communicated to external parties, including the Managers appointed in accordance with art. 28 of GDPR.

For all the purposes indicated in this statement, your data may also be communicated abroad, within and outside the European Union, in compliance with the rights and guarantees provided for by current legislation, after verification that the country in question guarantees an “adequate” level of protection in accordance with the provisions of the GDPR.

6. Rights of the interested party 

In relation to the aforementioned data, all the rights set forth in articles 15, 16, 17, 18, 20 and 21 of the GDPR may be exercised:

1. the right of access to personal data;
2. their correction in case of inaccuracy;
3. the deletion of data;
4. the limitation to processing;
5. opposition to processing;
6. the right to data portability, i.e. to receive in a structured, commonly used and machine-readable format the personal data provided and to have them transferred to another data controller without hindrance.

In case of violation of these provisions, the data subject has the right to lodge a complaint with the competent Control Authority.

For further explanations regarding this policy or privacy issues, or to exercise your rights, please write to privacy@wintergarden-hotel.com.