PRIVACY POLICY

pursuant to Art. 13 of EU Regulation 2016/679 (GDPR)
and Legislative Decree no. 196/2003 (Privacy Code)

Last updated: September 15, 2025

1. DATA CONTROLLER

EUFENTE S.P.A.

Registered Office: Viale Giappone snc, Loc. Le Rughe - 00060 Formello (RM) - Italy

Email: privacy@eufentespa.it

Phone: +39 0544 502681

Data Processor:
Dr. Giorgio Federico Nitti
Via Cassia km 24,300 Formello
Tel. +39 06 90109014

Data Protection Officer (DPO):
Email: privacy@eufentespa.it

2. TYPES OF DATA PROCESSED

2.1 Quotes and Information Requests

  • Data collected: first name, last name, email, phone number
  • Purpose: preparation and sending of quotes, responding to inquiries
  • Legal basis: consent (Art. 6, par. 1, point (a) GDPR)
  • Retention: until consent is withdrawn

2.2 Police Communication and Hotel Services

  • Data collected: full personal details, identity document, contact details, details of all guests
  • Purpose: confirmation of bookings, provision of services, compliance with Art. 109 R.D. 18.6.1931 no. 773
  • When: upon guest arrival (check-in), NOT at the time of booking
  • Timing: within 24 hours of arrival (6 hours if stay is less than 24 hours)
  • Method: in-person verification of documents + communication via the "AlloggiatiWeb" portal
  • Legal basis: execution of a contract + legal obligation (Art. 6, par. 1, points (b) and (c) GDPR)
  • Retention: 10 years for tax compliance, immediate transmission to the Police Headquarters

2.3 Payment Data

  • Data collected: credit/debit card details, bank details
  • Purpose: payment processing, refunds, accounting compliance
  • Legal basis: execution of a contract + legal obligations (Art. 6, par. 1, points (b) and (c) GDPR)
  • Retention: 10 years for tax regulations, immediate masking of sensitive data

2.4 Regular Customers - Fast-Track Procedures

  • Data collected: data from previous bookings
  • Purpose: to simplify future registrations
  • Legal basis: revocable consent (Art. 6, par. 1, point (a) GDPR)
  • Retention: maximum 5 years, revocable at any time

2.5 Marketing and Newsletter

  • Data collected: email, name, preferences
  • Purpose: sending offers, rate updates, promotional communications
  • Legal basis: consent (Art. 6, par. 1, point (a) GDPR)
  • Retention: maximum 2 years, revocable at any time

2.6 Video Surveillance (CCTV)

  • Data collected: images from designated common areas
  • Purpose: protection of individuals and property, workplace safety, fire prevention
  • Legal basis: legitimate interest (Art. 6, par. 1, point (f) GDPR)
  • Retention: 24 hours (up to 1 week in case of closures)

2.7 WiFi Service

  • Data collected: IP and MAC addresses of connected devices, visited addresses (not content)
  • Purpose: provision of service, network security
  • Legal basis: legitimate interest (Art. 6, par. 1, point (f) GDPR)
  • Retention: according to current regulations

2.8 Website Browsing Data

  • Data collected: IP address, browser type, pages visited, session duration
  • Purpose: anonymous statistics, technical functioning, service improvement
  • Legal basis: legitimate interest for technical cookies, consent for profiling
  • Retention: varies by type (see Cookie Policy section)

3. COOKIES AND TRACKING TOOLS

3.1 Technical Cookies (Consent NOT required)

Cookie Function Duration Management
PHPSESSID Unique identifier for online bookings Session end Block via browser settings
_icl_current_language Stores the chosen language 24 hours Block via browser settings

3.2 Analytical Cookies (First-Party)

  • Google Analytics 4 (_ga): Anonymous usage statistics with anonymized IP addresses
  • Duration: 14 months
  • Legal basis: Legitimate interest (configured for maximum privacy)
  • Opt-out: Google Analytics Opt-out browser add-on

3.3 Third-Party Cookies (Consent required if used for profiling)

YouTube (if embedded videos): VISITOR_INFO1_LIVE, YSC, GEUP, PREF

  • Purpose: Video playback, user preferences
  • Duration: Variable (from session to 8 months)

Social Networks (if widgets are active): Facebook, X (formerly Twitter)

  • Purpose: Cookies for social sharing
  • Duration: Variable according to the platforms' policies

3.4 Newsletter and Contact Forms

  • Service: MailUp (Italy)
  • Data: Name, last name, email
  • Purpose: Sending requested communications

3.5 Booking System

  • Technical cookies: ASP.NET_SessionId, BookingUserSessionV1, __RequestVerificationToken
  • Purpose: Proper functioning of the reservation system
  • Duration: Session end

3.6 Cookie Consent Management

In accordance with the 2021 Italian Data Protection Authority (Garante) Guidelines:

  • Prohibited: automatic scrolling as a form of consent
  • Prohibited: cookie walls that prevent access
  • Prohibited: pre-selected consent boxes
  • Mandatory: explicit consent for profiling activities
  • Mandatory: simple opt-out option (X to close)
  • Mandatory: granular consent for each purpose
  • Mandatory: if browsing continues without making a choice, or by closing the banner by clicking the "X", only technical cookies will remain active.

4. DATA RECIPIENTS AND DISCLOSURES

4.1 Authorized Personnel

  • Data Controller, Data Processor, DPO
  • Specifically authorized and trained staff

4.2 Service Providers (External Processors)

  • Software Houses: management of IT systems
  • Accountant: tax and accounting compliance
  • MailUp: newsletter service (Italy)
  • Booking System: online booking providers
  • Eufente Group Companies: for administrative purposes

4.3 Mandatory Communications

  • Competent Police Headquarters: guest details for public safety
  • National Inspection Bodies: tax and administrative audits
  • Judicial Authorities: upon reasoned request

4.4 International Transfers

  • Google (USA): for Analytics and cloud services - Standard Contractual Clauses
  • Facebook, YouTube (USA): if widgets are active - EU Adequacy Decisions
  • Security Measures: Assessment according to EDPB Recommendations

5. DATA RETENTION PERIODS

Scroll horizontally to view the full table ⟷

Data Category Retention Period Reference Regulation
Contractual and billing data 10 years Civil Code and tax regulations
Public safety data No retention Immediate transmission
Marketing and newsletter Until withdrawal Based on consent
Regular customers Max 5 years Specific consent
Video surveillance (CCTV) 24 hours (max 7 days) Proportionality principle
Technical cookies Session / 12 months Functional necessity
Analytics cookies 14 months Google Analytics 4
WiFi data Per current regulations Legal obligations

6. DATA SECURITY

6.1 Technical Measures

  • Encryption: SSL/TLS for data transmission
  • Access Control: authentication for critical systems
  • Backup: automated procedures with restoration testing
  • Updates: timely security patching

6.2 Organizational Measures

  • Training: staff regularly updated on privacy and security
  • Procedures: protocols for data and incident management
  • Audits: periodic internal checks
  • Privacy by Design: integrated from the design phase

7. YOUR RIGHTS (GDPR)

You can exercise the following rights by writing to privacy@eufentespa.it attaching a copy of your identity document:

7.1 Immediate Rights

  • Access (Art. 15): obtain confirmation and a copy of your data
  • Rectification (Art. 16): correct inaccurate or incomplete data
  • Erasure / Right to be Forgotten (Art. 17): request deletion (except where legal obligations apply)
  • Restriction (Art. 18): limit processing in case of dispute
  • Portability (Art. 20): receive your data in a structured format
  • Objection (Art. 21): object to processing for marketing purposes

7.2 Withdrawal of Consent

  • Always possible for processing based on consent (newsletter, regular customers, profiling cookies)
  • Does not affect the lawfulness of processing based on consent before its withdrawal
  • Immediate application
7.3 Response Times:
30 days from the request (extendable by 60 days in complex cases). The service is free of charge, except for manifestly excessive requests.

8. COMPLAINTS

8.1 National Supervisory Authority

In case of a violation of your rights, you may lodge a complaint with:

Entity Garante per la Protezione dei Dati Personali (Italian Data Protection Authority)

Address Piazza Venezia, 11 – 00187 Rome (Italy)

Email garante@gpdp.it

Certified Email (PEC) protocollo@pec.gpdp.it

Phone +39 06.69677.1

Website www.garanteprivacy.it/en

9. COOKIE MANAGEMENT - PRACTICAL INSTRUCTIONS

9.1 Compliant Cookie Banner

  • Accept all: giving consent for all types of cookies.
  • X (close): equivalent to refusing profiling cookies.
  • Manage preferences: granular consent for each purpose.
  • Technical cookies only: continue without giving consent.

9.2 Browser Controls

You can block cookies directly through the official settings of the browser manufacturers:

Chrome Firefox Safari Edge

9.3 Specific Opt-outs

  • Google Analytics: To disable Google Analytics tracking across all websites, visit the Google Analytics Opt-out Browser Add-on page.
  • Social Networks: You can manage settings via the privacy section of your respective accounts (Facebook, X, etc.).

10. CONTACTS AND INFORMATION

10.1 For Exercising Rights and Privacy Information

Email privacy@eufentespa.it

Phone +39 0544 502681

Availability Monday - Friday: 9:00 AM - 6:00 PM (CET)

10.2 For Bookings and Services

Data Controller EUFENTE S.P.A.

Address Viale Giappone snc, Loc. Le Rughe - 00060 Formello (RM) - Italy