Privacy and Cookie Policy

INFORMATION ON THE PROCESSING OF PERSONAL DATA OF USERS CONSULTING ART AND LUXURY APARTMENTS WEB SITES PURSUANT TO ARTICLE 13 OF (EU) REGULATION 2016/679

PRIVACY POLICY

Pursuant to EU Regulation no. 679/2016 (the General Data Protection Regulation, “GDPR”), this page describes the methods for processing personal data of users who visit the Art and Luxury Apartments websites (hereinafter ” Art and Luxury Apartments Sites”) accessible by electronic means at the following addresses:

• https://www.artandluxuryapartments.com/

Moreover, should you decide to book a reservation by selecting arrival and departure dates via the appropriate booking forms on the aforementioned websites, you will be connected to a booking engine. This booking engine is provided by our partner Ermes Hotels, appointed as Data Processor as indicated in this statement.

This information does not apply to other websites, pages or online services accessible via hypertext links that may be published on sites and which refer to resources that are external to the artandluxuryapartments domain.

The information is also based on Recommendation n. 2/2001, which the European authorities for the protection of personal data, that gathered in the Group established by art. 29 regarding directive n. 95/46/EC, adopted on 17 May 2001 in order to identify certain minimum requirements for the collection of personal data online, and, in particular, the methods, timing and nature of the information that the data controllers must provide to the users when they connect to web pages, regardless of the purpose of the connection; as well as the provisions established by the General Measures of the Privacy Guarantor dated May 8, 2014.

THE DATA CONTROLLER

Following consultation of the sites listed above, data relating to identified or identifiable natural persons may be processed.

The Data Controller of your personal data is BINFI SPA (the company that manages Art and Luxury Apartments) VAT number 01043670478 and Fiscal Code number 03129270488, with registered office in Florence, in via De ‘Martelli, n. 5, telephone number: 055.27370 email: info@appartamentilussofirenze.it

TYPES OF DATA PROCESSED AND PURPOSE OF THE PROCESSING

Browsing data The computer systems and software procedures used to operate this website acquire, during their normal operating functions, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified interested parties; however, due to its very nature it could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of the computers used by users connecting to the site, the addresses in the Uniform Resource Identifier (URI) of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the operating system and the user’s computer environment. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and is deleted immediately after processing. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the site: except for this eventuality, at present, the data on web contacts does not last for more than seven days.

The legal basis for this specific data processing: the processing is necessary to allow the interested party to consult the site.

 

Data provided by the user.  The optional, explicit and voluntary sending of emails to the addresses indicated on the Art and Luxury Apartments Sites, as well as filling in and forwarding the forms found on the Art and Luxury Apartments Sites or the booking engine managed by ERMES HOTELS Srl, entail the acquisition of the sender’s contact data, which is needed to respond, as well as all personal data included in notifications (including data entered in the forms and forwarded through the Art and Luxury Apartments sites to book a stay).

Personal data provided in the manner described above will be processed for the following purposes:

1. a) to manage your contractual relationship regarding the service requested, or to execute pre-contractual measures (such as, for example, the request for information or an estimate), to acquire and confirm your booking of accommodation services and ancillary services, and to provide the requested services. Legal basis for processing: execution of the pre-contractual or contractual service requested;
2. b) for administrative purposes and for the fulfilment of legal obligations regarding accounting and taxes, or to comply with requests from judicial authorities. The legal basis for this processing: fulfilment of legal obligations;
3. c) only with prior specific consent, for periodically sending newsletters by e-mail. The legal basis for this processing: consent of the interested party;
4. d) only with prior specific consent, to receive promotional notifications and invitations to events and special promotions (marketing). The legal basis for this processing: consent of the interested party;
5. e) when sending a curriculum vitae, exclusively for selection purposes. The legal basis for this processing: consent of the data subject to processing CV data for selection purposes;
6. f) only with prior specific consent, for purposes of automated processing and/or profiling. The legal basis for this processing: consent of the interested party.

We wish inform you that when issuing notifications for marketing purposes and sending newsletter to clients, via email, for the purposes referred to in subparagraphs c) and d) the Data Controller also initiates automated processing, profiling, based on indices and pre-established parameters, as we use MailUP’s platform and IT tools to issue our notifications. In particular, MailUP provides information on who opens the newsletter and clicks on the links contained in the email received. In particular, MailUP, via statistical tracking systems (for example web beacons), enables to detect when the message is opened, the number of clicks on hyperlinks contained in the email, which IP address or what type of browser is used to open the email, and other similar details. The logic used in the use of the processing in question, consists in sending newsletters and commercial offers to subjects who interact with Binfi Spa (Art and Luxury Apartments), that are interested in the Data controller’s service and/or products and to avoid forwarding unwanted notifications. The profiling activity (with the consent of the interested party) is limited to the data provided by you (without data enrichment). You have the right not to give consent to processing via profiling and in any case, you can, at any time, oppose this process as outlined in this disclosure in the Rights of the interested parties section. The legal basis for this processing: consent of the interested party.

Specific summary information will progressively be provided or displayed on the Art and Luxury Apartments Sites pages, possibly prepared for the provision of certain services. Upon checking-in, clients will receive further information regarding the processing of their personal data with regard to the hotel service.

Cookies. Cookies are text files, containing small amounts of information, which are stored on the computers or mobile devices or other similar technologies of users that visit a website. At each subsequent visit, cookies are sent back to the website that originated them (first party cookies), or to another website (third-party cookies) and recognized. Cookies cannot retrieve any other data from your hard drive, nor transmit computer viruses or acquire email addresses. For information regarding our use of cookies please refer to our Cookie Policy. For further information on the types of cookies, features and their function, please visit the following websites – http://www.allaboutcookies.org, www.youronlinechoices.com, http://cookiepedia.co.uk and the aforementioned Provision of the Guarantor.

OPTIONALITY TO PROVIDE DATA

Apart from what has been specified with regard to browsing data, the user is free to provide personal data listed in the application forms or indicated in contacting the Office to request to receive informative material or other notifications. Failure to provide such data may make it impossible to fulfil requests.

Please note that should consent be given to receive marketing material, newsletters, CV processing for personnel selection purposes by Art and Luxury Apartments, it can be revoked at any time.

 

 

 

DATA RETENTION PERIOD

The data provided will be processed for the time strictly necessary to give feedback to requests and notifications sent voluntarily by clients. With regard to receiving a CV, it will be processed only for the time strictly necessary for the evaluation of the candidacy. The data processed for the purpose of booking a stay at the Hotel through our website will be kept for the entire duration of the relationship and subsequently, after payment, for 10 years (the time envisaged by legal regulations). Personal data provided to receive newsletters and to receive promotional offers (marketing) will be kept for 10 years. Data relating to web browsing is stored for a maximum of seven days. Cookies are kept for the period indicated in the cookies policy.

 

SAFETY METHODS AND INFORMATION PROCESSING

Personal Data will be processed using manual, computerized or telematic tools that are suitable for ensuring security and confidentiality and will be carried out by personnel that has been trained to comply with current legislation.

Specific security measures have been implemented to prevent the loss, illicit or incorrect use and unauthorized access of data, in compliance with the provisions set forth in Articles 24.25 and 32, of the GDPR.

In any case, Art and Luxury Apartments cannot be held responsible for unauthorized access or loss of personal data attributable to the interested party or in any case beyond its control.

No data acquired via the web will be passed on to third parties unless otherwise indicated in the Cookie Policy.

 

SITE SECURITY MEASURES

With regard to managing the site, specific security measures have been adopted, aimed at ensuring the user’s secure access and to protect the information contained in the site from risks of loss or destruction, even accidental. The antivirus software used in managing the site is updated on a regular basis in order to avoid data loss due to possible computer viruses. It is worth highlighting that though we ensure adopting specific anti-virus systems, despite being a legal obligation, it is advisable for users to equip their workstations with an anti-virus system to prevent possible attacks. An identification code and password are assigned to companies that wish to access the reserved part of the site. These passwords are generated in such a way that they do not contain references that are easily traceable, so as to avoid possible abuse. Users are required to keep their password confidential.

DATA PROCESSING LOCATION

Personal data is stored on servers located within the European Union, unless otherwise specified in the Cookie Policy

With regard to forwarding emails via MailUP, the physical data centre located within the EU is compliant with the applicable legal provisions, pursuant to the provisions established in Article 45 and 46 of the European Regulation 679/2016.

 

DATA ACCESS. PROCESSING RECIPIENTS.

Access to Personal Data collected, as a result of consulting the website and sending requests and/or reservations via the website, is permitted only to persons in charge of processing, expressly authorized by the Data Controller, and to designated data processors as established in Article 28 of the GDPR.

The Data Controller is aware of the importance of data security for our clients and has selected our data processors very carefully.

The Data Controller has appointed as Data Processors, pursuant to Article 28 of the GDPR:

• ERMES HOTELS SRL with reference to the processing of personal data provided by clients when making a reservation for a stay through the Art and Luxury Apartments website, via the management of the booking engine. More precisely, it should be noted that if users intend to make a reservation on the Art and Luxury Apartments Sites, they will be connected to the search engine for bookings managed by ERMES HOTELS SRL, https://www.ermeshotels.com/, which ensures an encrypted and protected session.
• MailUp S.p.A. with registered office in Viale F. Restelli 1, 20124 Milan (Italy), which manages the MailUP service for the management of forwarding email notifications, with which we have signed an agreement in compliance with the law and art. 28 GDPR.

The updated list of external processors is available at the data controller’s registered office. The updated list can be requested any time by contacting the data controller at the addresses and through the contacts indicated in this document.

 

No data deriving from the web service is circulated. The data will not be disclosed to third parties except to third parties who, in fulfilling the contract and limited to the purposes indicated above, collaborate with the Data Controller (professionals/companies providing consultancy work of a legal, tax and accounting nature, competent authorities for ‘fulfilling legal obligations’, subjects providing services for managing computer systems and assistance to the website); all of which are bound by the obligation of confidentiality. In any case, in compliance with the principles of data processing envisaged by the GDPR, only the data necessary for carrying out the activities entrusted to them will be passed on to external parties.

The personal data provided by users who request dispatch of informative material is used for the sole purpose of carrying out the service or provision requested and is communicated to third parties only if this is necessary for that purpose (shippers or couriers, for example).

 

 

RIGHTS OF THE INTERESTED PARTIES (art 7, articles 15 to 22 GDPR).

Based on current legislation and the provisions established in the GDPR, you have the right to:

1. ask the data controller to access personal data and request confirmation of the existence, or otherwise, of your personal data;
2. obtain information on the origin, the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data has been or will be communicated and, where possible, the retention period, the existence of an automated decision-making process, including profiling, and in relation to it, obtaining information on the logic used, as well as the importance and expected consequences of such processing for the data subject;
3. obtain the correction of data concerning you without unjustified delay;
4. obtain the deletion (right to be forgotten) of the data without unjustified delay if no longer necessary, incomplete, erroneous or collected in violation of the law;
5. obtain the integration of incomplete personal data, by providing an additional declaration, taking into account the purpose of the processing;
6. obtain the processing limitation or oppose the processing;
7. object, at any time, to the processing, including profiling, in relation to the data processed for direct marketing purposes;
8. obtain data portability, i.e. receive it from a data controller, in a structured format, commonly used and readable by an automatic device, and transmit it to another data controller without delay;
9. revoke your consent at any time, if this constitutes the basis of the processing. The withdrawal of consent, however, does not prejudice the lawfulness of the processing based on the consent given prior the revocation;
10. know whether the communication of personal data is a legal or contractual obligation or a necessary requirement for the conclusion of a contract, and whether the data subject is obliged to provide personal data and the possible consequences of not communicating such data ;
11. oppose an automated decision-making process concerning individuals, including profiling, and, in such cases, receive significant information on the logic used, as well as the importance and expected consequences of such processing for the data subject;
12. lodge a complaint to a supervisory authority (Privacy Authority);
13. be informed of the existence of adequate safeguards pursuant to Article 46 relating to the transfer of data, should the personal data be transferred to a third country or to an international organization.

Requests addressed to the Data Controller may be sent to the following address: BINFI SPA, in via De ‘Martelli, no. 5, 50122 Florence, telephone number: 055.27370, email: info@appartamentilussofirenze.it.

The Data Controller must proceed in this direction without delay and, in any case, no later than one month after receiving a request. The deadline may be extended to two months if necessary, taking into account the complexity and the number of requests the Data Controller receives. In such cases, the Data Controller, within one month of receiving your request, will inform you of the reasons for the extended period.

Complaints to the supervisory authority can be addressed to the Guarantor for the protection of personal data, Piazza di Monte Citorio 121, IT-00186 Rome, email: rpd@gprp.it.

 

CHANGES

The Data Controller reserves the right to modify or amend, at any time, this privacy statement, wherever published on the site, mainly due to the entry into force of new sector regulations. At any time, users can check the latest version of the privacy policy as updated from time to time by the Data Controller, by simply connecting to the site

Last updated May 2018

*

PRIVACY POLICY AND OF PERSONAL DATA PROCESSING PURSUANT TO LEGISLATIVE DECREE No. 196/2003 (“PRIVACY CODE”) ARTICLES 13, 23 AND 26; OF (EU) REGULATION 2016/679 (“GDPR”) ARTICLES 13 AND 14 AND OF THE MEASURES ESTABLISHED BY THE AUTHORITY FOR THE PROTECTION OF PERSONAL DATA, N. 229 OF MAY 8, 2014 (THE “PRIVACY GURANTOR MEASURES”).

Binfi Spa (the company that manages the Art and Luxury Apartments facilities, as the data controller of the processing of personal data collected through this site (the “Data Controller”), wishes to provide users with some information on the use of cookies by its sites:

• https://www.artandluxuryapartments.com/
• https://www.ermeshotels.com/ for reservations through the search engine. (Hereinafter referred to as the Site).

For all other information required by legislation on the protection of personal data, please refer to the “Privacy Policy“, available at the following link: https://www.artandluxuryapartments.com/privacy/

COOKIES INFORMATION

Cookies are used on the site. This term indicates small text files that the sites visited by the user send to the user’s terminal (usually the browser), where they are stored before being re-transmitted to the same sites when the same user visits once again.

They are used to improve the functionality of the site, allow users to move easily between pages, remember their preferences and to ensure the user always has optimal browsing.

Cookies can be of various nature and duration. In particular, they may be “persistent” and remain stored until they expire, or they may be c.d. “Session” cookies and, therefore, disappear automatically when the browser is closed.

TECHNICAL COOKIES

Cookies of this type are necessary for the proper functioning of some of the site’s areas. They can be divided into browsing or session cookies, which guarantee the normal navigation and use of the website (allowing, for example, to make a purchase or authenticate access to restricted areas). In the absence of such cookies, the site or some parts of it may not work properly. Therefore, they are always used, regardless of user preferences. It is precisely due their nature that disabling or deleting them, which is permitted in general by accessing the your browser’s functions, may compromise optimal navigation on this site. The user’s consent is not required for the use of these cookies.

This site uses both persistent and session technical cookies

COOKIES ANALYTICS

These Cookies have been assimilated by the Provision of the Guarantor, should they be used directly by the site operator to collect information, in an aggregate and anonymous form, on the number of users and on how they visit the site. Here too, the users’ prior consent is not required.

FUNCTIONALITY COOKIES

Functionality cookies allow users to navigate according to a series of selected criteria (for example, the language or the products selected for purchase…) with the aim of improving the service offered.

This type of cookie as well, has been assimilated by the Guarantor to technical cookies, which do not require the user’s prior consent.

 

PROFILING COOKIES

THIRD PARTY COOKIES

During the navigation on the site, the user may receive cookies from different websites or web servers (so-called “Third-party cookies”) on their terminal: this happens because there may be elements on the site such as images, maps, sounds, specific links to web pages of other domains (such as social networks) that reside on servers other than those used by the Data Controller. In other words, these cookies are set directly by other websites or servers which are different from the one that the user is currently visiting.

The use of third-party cookies can normally be blocked by users through the appropriate option in their browser: see the above instructions. Additional tools and information, useful for managing consent regarding third-party cookies, can be found on the following site: http://www.youronlinechoices.com.

 

COOKIES USED BY THE SITE

https://www.artandluxuryapartments.com/

The following is information on cookies used by the site, including third party cookies.

Should users decide not to grant authorization for the use of third-party cookies, they will not be able to use the sections of this site that require these cookies.

Technical cookies (session and persistent), analytical and functional

Cookie Name	Function / Goal	Deadline
Google Analytics https://support.google.com/analytics/answer/6004245?hl=it	STATISTICAL Google Analytics is a Google analysis tool that helps website and app owners to understand how visitors interact with their website content (pages viewed, browsing time, etc.) by providing useful statistics to optimize and improve browsing the website without identifying the browser	_utma 2 years _utmt 10 minutes _utmb 30 minutes _utmc up to closure of session _utmz 6 months _utmv 2 years
Google AdWords https://support.google.com/adwords/answer/2407785?hl=it	PROFILING Facilitates search on Google on services offered by the hotel without collecting or monitoring information that can personally identify a user	30 days

COOKIES USED BY THE SITE  https://www.ermeshotels.com/

The following is information on cookies used by the site, including third party cookies.

Should users decide not to grant authorization for the use of third-party cookies, they will not be able to use the sections of this site that require these cookies. 

Interaction with Social Networks and External Platforms

These services (icons, or “social buttons”) allow interaction with social networks or other external platforms directly from the pages of this site.

The interaction and information acquired from this site are however subject to the user’s Privacy settings with regard to each social network.

In the event that an interaction service is installed with a social network, it may collect traffic data relating to the pages in which it is installed even if users do not use the service.

The data controller does not have access to the data collected and processed independently by the authorities of social network platforms.

For more information on the processing logic and methods of the data collected from social networks, users are invited to read the information notes issued by the subjects providing the services in question:

• Twitter : Twitter disclosure https://twitter.com/it/privacy 
• You Tube: Google You Tube disclosure https://policies.google.com/privacy?hl=it&gl=it
• Instagram: Instagram disclosure https://help.instagram.com/519522125107875
• Facebook: Facebook disclosure https://www.facebook.com/about/privacy

 

USER CONSENT TO USE COOKIES

DATA RETENTION PERIOD

The information collected through the cookies installed on the Site will be kept in compliance with the table shown in this disclosure and in the “Privacy Policy”, available at the following link: https://www.artandluxuryapartments.com/privacy/

BLOCKING / ELIMINATING COOKIES

If users wish to disable the installed cookies, they must intervene on their browser settings. It should be noted, however, that should this be the case, the Site or some of its functionalities may not function correctly. The procedure to follow varies depending on the type of browser used. To obtain detailed instructions on this issue, please click on one of the following links:

Internet Explorer

Firefox
Chrome
Safari
Opera

If the browser used is not among those listed, you can obtain information by consulting the www.aboutcookies.org website or by selecting the “Help” function on your browser.

USER RIGHTS

For any information regarding the rights granted to users by legislation on the protection of personal data, please refer to the “Privacy Policy”, available at the following link.

CHANGES TO THIS DISCLOSURE

The Data Controller reserves the right to modify or amend, at any moment, this privacy disclosure which is published on the site as a result, among other things, of the entry into force of new sector regulations and the updating or provision of new services or technological innovations.

As a result, all users are invited to periodically consult this page

Last updated May 2018