eng
1. Data Controller
The Data Controller is Auxesis Counseling S.r.l., Via Strozzi 2 - 50123 Florence (FI), Italy, VAT No. 07061500489, e-mail info@residenzestrozzifirenze.it, operator of Residenze Strozzi.
2. Personal data processed
The data processed may include identification and contact details, booking and stay information, administrative and tax data, details of the identity documents required by law, data necessary for public security obligations, payment information limited to what is necessary, requests voluntarily provided by the guest, technical browsing data, IP address, and data collected through cookies and tracking tools.
3. Purposes and legal basis
Data is processed to respond to requests and manage bookings/stays (Art. 6(1)(b) GDPR); to fulfil administrative, tax, and public security obligations (Art. 6(1)(c)); to protect rights and prevent fraud, to the extent covered by the applicable legitimate interest (Art. 6(1)(f)); and to send any promotional communications, subject to prior consent where required (Art. 6(1)(a)).
4. Guest identity documents
Guests' identification data is processed to comply with the requirements set out by the regulations applicable to accommodation facilities. Any images or digital copies of the identity document collected solely for identification/check-in purposes must not be retained beyond the time strictly necessary, unless otherwise required by law.
5. Direct bookings - ErmesHotels Booking Engine
Residenze Strozzi uses the ErmesHotels Booking Engine to manage direct online bookings. Through this system, identification and contact data, booking and stay information, and any further data necessary to provide the requested services may be processed. The legal basis is the performance of pre-contractual measures and of the contract (Art. 6(1)(b) GDPR). The provider's privacy role for each specific processing activity must be indicated consistently with the contract/DPA actually signed with Auxesis Counseling S.r.l.; any processing carried out autonomously by the provider is governed by its own privacy notice.
6. Booking.com and Airbnb
The property may also receive bookings through Booking.com and Airbnb. Processing carried out independently by these platforms is governed by their respective privacy notices. Residenze Strozzi processes the data it receives to manage the booking, the stay, and related legal obligations.
7. Online payments - Nexi XPay
Residenze Strozzi uses Nexi XPay for online payments. When the transaction is handled by this external provider, Residenze Strozzi does not directly retain the complete card data. The data necessary for the transaction is processed in accordance with the technical flow and the notices of the service; the legal basis, insofar as the Data Controller is concerned, is the performance of the contract and applicable obligations.
8. Third-party web services
The website may use Google Analytics, Google Maps, links or content from Instagram and Facebook, and WhatsApp links/widgets. Tools that are not strictly necessary and that involve tracking are activated, where required, only after consent has been given.
9. Recipients and providers
Data may be disclosed, to the extent necessary, to authorised personnel, consultants, IT/hosting providers, booking engine/PMS providers, payment service providers, booking platforms, e-mail/CRM providers, public security authorities, the Municipality, and other authorities. Appointments as Data Processor under Art. 28 GDPR must reflect the roles actually performed and the applicable contracts.
10. Transfers outside the EEA
The use of certain technology providers may involve transfers of, or access to, data from countries outside the EEA. Where applicable, such transfers must comply with Articles 44 et seq. of the GDPR and the safeguards provided for by the applicable regulations.
11. Data retention
Data is retained for the time necessary to achieve the purposes for which it was collected, and for any further periods required by law. Administrative, accounting, and tax data is retained in accordance with statutory retention periods. Marketing data is retained until consent is withdrawn and is subject to periodic review.
12. Rights
Where provided for under Articles 15-22 GDPR, the data subject may exercise the rights of access, rectification, erasure, restriction of processing, objection, and data portability, and may withdraw consent at any time. Requests may be sent to info@residenzestrozzifirenze.it. The data subject also retains the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).