This information document (the Document) is issued pursuant to Reg.(UE) 2016/679 related to the protection of people regarding the processing of personal data (GDPR), contains information on the processing of the personal data collected by Bluserena SpA Unipersonale (the Company) and describes the way they are used.
The Document is an integration to any other information received in other circumstances and contains important information about the following:
- THE PROCESSING OF PERSONAL DATA
- COLLECTED PERSONAL DATA
- THE PURPOSE OF PERSONAL DATA PROCESSING
- THE COMMUNICATION AND THE DISCLOSURE OF PERSONAL DATA
- THE PROTECTION OF THE PRIVACY OF MINORS
- SECURITY AND CONFIDENTIALITY OF PERSONAL DATA
- SOCIAL MEDIA
- THE RIGHTS OF THE PARTY CONCERNED
- DATA STORAGE
- THE CONTROLLER – THE DATA PROTECTION OFFICER – THE COMPANY’S CONTACT DETAILS
- UPDATES OF THIS DOCUMENT - COMMUNICATIONS
1. THE PROCESSING OF PERSONAL DATA
In this Document, the term “Personal Data” is used with reference to any information that allows the Company to identify you (or to identify any third party whose data are provided by you), directly or indirectly, including any information related to the purchase of services, or that you choose to give to or share with the Company during the use of the Websites or at the holiday facilities managed by Bluserena SpA (the Facilities). Personal Data will be processed in compliance with the GDPR also through the use of automatic tools. The Company reserves the right to further process your data when required to do so by law, i.e. in criminal proceedings or investigations or any other kind of legal proceedings.
2. COLLECTED PERSONAL DATA
The origin of the data
The Company only collects personal data that you provide of your own free will, for example:
Asking for a quote, asking for information, contacting the Company by sending a comment or a question, confirming or finalising your booking, subscribing to News Bluserena by email, sending your CV by using the relevant form;
Using the app that allows through a browser to know and book the services offered by the village;
Email, texts and other electronic messages, as well as phone inquiries
Exchanging communications with the Company.
Asking for assistance, informing about special needs or complaining about anomalies in the delivery of services;
Filling in the documents provided when checking in, interacting with the staff, complaining about anomalies in the services received or giving feedback on them, requesting or purchasing services;
Registering with the Bluserena Più Club;
Requesting connection to a facility’s Wi-Fi network;
Taking part in events, surveys, market research activities and other promotions – even online – reserved for Bluserena customers;
The Close-circuit TV system at the holiday facility
For the protection of our clients, our staff and the company assets.
Social Network Pages
Publishing or posting comments and opinions on Bluserena's social pages (Facebook, Instagram, Twitter, ...)
Judgment forms and questionnaires: filling in the judgment cards or questionnaires during and after your vacation to express opinions regarding Bluserena services.
If you provide the Company with personal data of third parties (e.g., relatives, other customers or potential customers), you should make sure that they are informed and have authorized the use of their data as described in this Document.
If, during several contacts, you will provide different contact details (for example different email addresses), the Company will keep all the contact details provided and will use them in compliance with the purposes for which each of them was provided and no later than the time necessary to achieve the same or in other cases in which it decides to revoke the allow or oppose their treatment.
Types of data
The Company can collect and use various types of personal data according to the specific purposes as described below:
a. Personal information such as name, surname, age/date of birth, place of birth, identity document number;
b. Contact information such as home address, email address, telephone number, mobile number;
c. Payment information, such as payment method (credit or debit card, bank transfer, etc.) and relevant details;
d. Information related to the services purchased, such as the facility, arrival and departure dates, details of the services booked and the related costs, feedback on services received, complaints, refunds, travel companions or other information related to the services requested and that can be collected in compliance with current laws;
e. Habits and profiles, such as data regarding the services booked (the booking history, including the facility, the services booked and the related costs), information on activities and initiatives related to the management of the relationship with customers (date and type of actions taken or to be taken and their outcome), notes on purchasing habits or special needs, other information that can be collected in compliance with current laws;
f. Information related to the family and the members of the same booking, such as the number of children, dates of birth and other data that can be collected in compliance with current laws;
g. Footage taken within the holiday facility by the close-circuit TV system;
h. Navigation data i. When sending a CV: personal data, contact details, curriculum vitae, other data provided of your own free will, the source of information about the job offer, special data provided (e.g., the status of a protected person, data that can disclose one’s health status, etc.);
j. In the event you use our medical services: data related to your health status.
3. THE PURPOSE AND LEGAL BASIS OF PERSONAL DATA PROCESSING
According to the specific circumstances of your interaction with the Company, your personal data may be used for the following purposes.
3.1 Booking a holiday and the delivery of the services booked
Personal data communicated and collected during the booking step, during the stay or even subsequently, both online and interacting with our Booking Office, with our Customer Service or even at the accommodation facility - i.e. personal data, contact information, data regarding the booked services, tax data, payment details, special requests, reports about the used services and any other data strictly necessary both for the provision of the booked services and for the management of the contractual relationship, even in the post phase of sale - will be used to comply with current regulatory, accounting and tax obligations and for purposes related to mutual obligations deriving from the contractual relationship (e.g. to assist you with reservations, including future ones, to offer you upgrade services, to provide the requested services to meet your needs during your stay, to deal with your reports and to prepare a detailed account, to send you useful information concerning your stay in the days leading up to your arrival by instant messaging services or by sms, telephone or email.
The processing of your personal data for these purposes does not require your consent as it is necessary to comply with legal obligations and the execution of the residence contract. Any refusal may make impossible to host you (for example with reference to the data reported on the identity document) or the impossibility to provide the requested services.
3.2 The specific purposes for which you provided the data
The personal data provided by you or collected when you request a specific service (e.g., asking for a quotation stating special needs, asking for information, subscribing to our News, registering with our Bluserena Più Club, making complaints) – such as personal and contact details, and data required to follow up your request – will be used for:
a. Providing the required services (e.g., answering a question or a contact request, providing the information, arranging the service requested, assisting you and managing complaints contact you again by text message by phone or instant messaging services if it was not possible to answer to your call);
b. Sending a quotation, provide clarifications and complete the sale process;
c. Processing your registration with the Bluserena Più Club, if you have requested it;
d. Allowing you to use the Wi-Fi connection:
e. Allowing you to use our medical assistance;
f. Allowing our customers to participate into initiatives;
g. Consent to the management of Bluserena's Social Pages and the interaction with the users;
h. Place it on the waiting list for the facility you have identified. In cases of unavailability, the owner may, on the basis of legitimate interest, contact you again to propose an alternative structure;
i. Manage the use of the reserved area dedicated to travel agencies.
In these cases, it is necessary to provide your personal data for the above mentioned purposes. Your refuse would make impossible to fulfil your request.
3.3 For marketing purposes
Your personal contact details such as name, surname, postal address, e-mail address, landline and mobile telephone number, date of birth, structure and year of stay, tax code and VAT number, may be used to contact you by telephone or send, to your home, by e-mail or telephone inbox, also in an automated way, information, offers, discounts, periodic documentation - including advertising, also published and sent by third parties (for example by periodical publications) - on products and services in its own interest of Bluserena. These data will also be used to send you multimedia products and wishes for holidays and birthday of the family members.
Furthermore, your data may be used to include you among the recipients of Bluserena News.
The consent to the processing of such personal data referred to above is optional and any refusal will make it impossible to communicate commercial information, greetings or multimedia products.
Your e-mail address provided during the booking phase will also be used by Bluserena to offer you services similar to those purchased. This treatment does not require explicit consent (so-called "soft spam") therefore the right to object may be exercised at any time pursuant to art. 21 GDPR by writing an email to email@example.com and in any case when sending any communication by clicking on the appropriate link.
Your e-mail address provided in the context of booking a stay will also be used by Bluserena to offer you similar services. For this use, your consent is not required, as provided by Article 130 of Legislative Decree 196/03 (soft spam), but we inform you that you can oppose this use at the moment in the provision of the e-mail address or in any other time and in any case when sending any communication by clicking on the appropriate link.
3.4 Performing messaging services and forwarding phone calls to you
Your personal data (name and surname), the start and end dates of your stay, your room number, your the date of your stay and the presence at the facility, your mobile number will be used to: deliver messages from external third parties during your stay; put phone calls from outside through to your room; inform third parties, who wish to contact you, of your presence in the facility.
The consent for the use of your personal data for these purposes is optional. If refused, we will not be able to collect messages or calls addressed to you and to inform third parties about your presence in the hotel. This use will end at the end of your stay.
3.5 For profiling activities aimed at making personalised offers
Giving your consent to profiling activities is optional. Refusing to give consent does not prevent you from enjoying all our services, except that our Company cannot inform you by phone, text, email or mail about offers or promotions for services, discounts and commercial initiatives or service proposals for you and your family resulting from profiling.
3.6 For customer care purposes
The processing of data relating to the booking jointly with the collected data for customer care activities, including after sales (e.g. administration of questionnaires and surveys in the structure, sending the service satisfaction questionnaire by email by phone contact, text message, instant messaging services, etc.), is carried out on the basis of the legitimate interest to manage complaints, detect customer satisfaction, guarantee a fixed and constant information reference for the guest, identify solutions and areas for improvement.
3.7 For safety purposes
The facilities are monitored on the basis of legitimate interest by a close-circuit TV system in order to protect the safety of our customers, our staff and our company’s assets.
3.8 In order to verify the correct functioning of the website
The navigation data are processed, on the basis of legitimate interest, to verify the correct functioning of the website.
3.9 For recruiting and assessing staff
The personal data provided via the specific form in the “Work with us” through the delivery of the curriculum vitae on paper or in response to advertisements published by Bluserena Spa area will be processed for the recruitment and assessment of staff, with the aim of establishing a work relationship and to assess the effectiveness of the communication channels for our job offers (with regards to such channels, the data will be processed anonymously). Therefore, you may be contacted by phone, email or text message or you may receive communications and information about job openings from Bluserena in accordance with your profile.
The provision of data marked with an asterisk on the data collection form is obligatory. If data are missing, inaccurate or partial, we will not be able to upload your CV onto the Bluserena SpA data base. The provision of all other personal data is optional. If data are missing, inaccurate or partial, we may not be able to carry out our staff recruitment activity in the best way.
3.10 To ensure the safety of our guests and staff and comply with regulations
Bluserena reserves the right to process your personal data. This data will be kept in a special file along with a description of the incident if you engage in disruptive behavior that exceeds normal tolerance, give rise to complaints from other customers due to your actions, are insolvent, commit a criminal offence, or harm the safety and reputation of the Company. This processing is based on Bluserena's legitimate interest in protecting its name, reputation, and preventing significant loss of customers resulting from behavior that is incompatible with peaceful coexistence. However, if prohibited by law, this interest may not prevail over your right to data protection associated with a brief and objective description of the incident in which you were involved. The Company may report the incident and disclose the data if requested by the relevant authorities.
According to the Regulations and Article 187 of the Executive Regulation of the Tulps, Bluserena may refuse future bookings from individuals responsible for the aforementioned conduct.
4. THE COMMUNICATION AND THE DISCLOSURE OF PERSONAL DATA
Personal data provided will not be disclosed, unless required by law or expressly authorized, and may be disclosed to subjects who.
Personal data provided will not be disclosed, unless required by law or expressly authorized, and may be disclosed to subjects who:
- Operate as Authorized by the Data Controller for the purposes above indicated. To this end, Bluserena SpA guarantees that internal staff are duly trained on the importance of protecting personal data and that they use secure tools that are necessary from time to time;
- Operate as independent data controllers, if this meets a legal obligation (for example, Public Administrations, for the performance of institutional functions; practicing the profession of lawyer, for legal assistance in any disputes, banking institutions, insurance companies);
- Operate as external Data Processors, i.e. contractually authorized subjects who operate in the name and on behalf of Bluserena SpA, engaged in the correct and regular pursuit of the purposes described (e.g. company that deals with accounting and administrative services, which Bluserena uses for the provision of its services).
Such companies, bodies and organizations will only receive the personal data required to perform the agreed services or to fulfill with legal obligations and will not be authorised to use them for any other purpose.
With specific reference to the recruitment and assessment of staff, the data will not be subject to disclosure or to automated decision-making processes and may only be communicated to the companies in the Carlo Maresca SpA Group and their officers, who will only be able to use them for the purposes mentioned above.
In the event of corporate or asset transactions (such as, but not limited to: mergers or takeovers, company restructuring or liquidation, establishment or termination of the lease of a company branch, etc), the collected data might be one of the transferred assets and, as allowed by law and according to the legitimate interests of the receiving Company, made available to the same if the corporate aim allows it.
The Company can also provide your personal data to third parties if foreseen by current law (e.g., public safety authorities, local authorities), in the event of legal proceedings in response to a request from law enforcement authorities based on legitimate reasons, to protect the rights, the privacy, the safety or the property of the Company or of the public.
Moreover, as allowed by law, the Company may give your personal data to third parties in the event of complaints about the use of the Websites or the wi-fi connection, if necessary for investigating, preventing or taking measures against unlawful activities and suspected fraud.
The full list of the people in charge of processing your personal data and the third parties to whom they are given can be obtained by using the contacts provided in this Document.
Transfer of data to non-EU countries
In case it is necessary to transfer personal data abroad in order to pursue the aforementioned purposes, the transfer of personal data will be carried out in compliance with the guarantees provided by law.
5. THE PROTECTION OF THE PRIVACY OF MINORS
The Websites address the general public, however their services are aimed at people aged 18 and over. The Company does not deliberately request, collect, use and disclose personal data provided by people under 18 online or at our holiday facilities, unless foreseen by law. If you are under 18, please do not make online bookings and ask an adult (i.e. your parents or a guardian) to carry out the necessary procedures.
6. THE SAFETY AND THE CONFIDENTIALITY OF PERSONAL DATA
Your personal data will be carried out only by authorized personnel and by any external subjects specifically appointed as data processors and will be processed in accordance with the principles of correctness, lawfulness and transparency, both electronically and in hard copy, and in a way that ensures the appropriate safety of your personal data from unauthorized or unlawful processing as well as from loss, destruction or accidental damage, by means of appropriate technical and organizational measures.
In the unlikely event that the Company believes that the safety of your personal data in its possession or under its control has been or may have been compromised, you will be informed about such incidents in accordance with the methods foreseen by current law and using the appropriate means therein prescribed.
7. SOCIAL MEDIA
We also inform you that Bluserena may use the images and videos you have published, posted, shared on your social wall or on your social media pages (Facebook, Instagram, etc.).
8. THE RIGHTS OF THE CONCERNED PARTY
At any time and free of charge, by sending an email to firstname.lastname@example.org or sending a request to Bluserena Spa - Via Caravaggio 125 – 65125 Pescara (PE), you can ask to access, correct or delete your data or limit their processing; you can also receive your electronic personal data in a commonly used structured format, which can be read mechanically and transmitted to another data processing controller (data portability).
The requests for data deletion are subject to the Company’s current legal obligations regarding document storage. You also have the right to revoke your consent at any time, without prejudice to the lawfulness of the processing based on your consent given before revocation.
Also with specific reference only to profiling, you can exercise all the rights expressed in this Document, objecting, amongst other things, to any further profiling of your data. If you believe there is a problem in the way your personal data are managed, you have the right to complain to the Garante the protection of your personal data (Data Protection Commissioner) as appointed Supervisory Authority according to current procedures.
Exercising the right to oppose to receive communications using automatic tools makes it impossible to receive communications even in a non-automated way.
If you believe there is a problem in the way your personal data are managed, you have the right to complain to the Garante the protection of your personal data (Data Protection Commissioner) as appointed Supervisory Authority according to current procedures.
9. DATA STORAGE
Considering the purposes for which they were collected, the fulfilment of legal obligations and the protection of the rights of the Controller, these data will be stored for a period not exceeding the necessary time (e.g., 10 years for accounting purposes and to avoid additional bookings as per point 3.9 of this information notice, for the duration of the storage obligation for tax purposes for the time necessary to answer to your requests and no later than the sending of the text message in case of non-response to your call, until the end of the requested stay in case of a quote, or, in case of processing for marketing purposes, registration for Bluserena News and Bluserena Più Club and the Travel Agency area until revocation and in any case no later than 10 years from the last request and, upon expiration of that period of time, they will be deleted or made permanently anonymous), or to allow the Company to keep evidence of the relative rights and obligations.
With specific reference to the closed-circuit TV system, please be aware that personal images will be stored for not more than 24 hours (48 hours for Is Serenas Badesi Village, 72 hours for Sansicario Majestic), unless otherwise foreseen by current law, and they cannot be disclosed or communicated to third parties, except if requested by the police or for juridical purposes.
Please be informed that the data collected for commercial profiling purposes as described above will be stored for no more than 2 years; at the end of that period of time, they will be automatically deleted or rendered permanently anonymous, unless otherwise required for current legal purposes. The consent to the processing you have given will remain valid until revoked and will in any case within two years from the collection data.
With specific reference to staff recruitment and assessment activities, the data provided will be stored for the period of time that is necessary for the above mentioned purposes, however not exceeding 3 years (with cancellation in the middle and at the end of the year) from the sending or from the last update, during which you can always update the CV already sent.
With reference to the questionnaires and judgment forms, we inform you that the collected data will be kept for a period of 2 years.
10. THE CONTROLLER – THE DATA PROTECTION OFFICER – THE COMPANY'S CONTACT DETAILS OF THE COMPANY
For any further information, please contact the Controller, Bluserena S.p.A. Unipersonale, Via Caravaggio 125 - 65125 Pescara (PE) – Italy, email: email@example.com or the Data Protection Officer sending an email to: firstname.lastname@example.org or writing to: The Data Protection Bluserena Officer – Via Caravaggio 125 – 65125 Pescara – Italy.
11. UPDATES OF THIS DOCUMENT - COMMUNICATIONS
The Company, at its own discretion, reserves the right to change, modify, add or remove parts of this current Document on Privacy at any time, publishing the reviewed version on this page of the Website.
In some cases, the Company can provide further communications related to significant changes to this current Document on Privacy by publishing a notice on the home page of this current Website. If the changes involve new or further processing which involve the agreement of the interested party and in the cases foreseen by current law, your data will not be subject to further processing without your explicit consent.