Legal Notice

Dear Client,
pursuant to the applicable data protection regulations, we would like to inform you that your personal data will be
processed with fairness and transparency, for lawful purposes, and in a manner that safeguards your privacy and
rights. In accordance with Article 26, paragraph 1 of the GDPR, “where two or more controllers jointly determine the
purposes and means of processing, they shall be joint controllers of the processing,” we hereby provide you with the
relevant details:
the joint controllers of the collected data are Hotel Royal Village srl, Via Benedetto Croce, 23 - 25010 Limone sul Garda
(BS) and Blu Hotels S.p.A., Via Porto Portese, 22 – 25010 San Felice del Benaco (BS).

OBJECT OF THE PROCESSING (what type of data is necessary to process)
• Personal data
• Any special data (“sensitive data”) (health conditions related to the provision of the service, such as food
intolerances or the presence of motor disabilities)

PURPOSE (what is the purpose of the processing)
A) Provision of catering and/or hospitality services.
B) Compliance with legal obligations (“Consolidated Law on Public Safety” – Article 109 of Royal Decree No. 773 of
June 18, 1931, which requires us to report to the police the personal details of guests for public safety purposes, and
other applicable administrative and fiscal laws).
C) Marketing
D) Profiling

LEGITIMATION (what is the legal basis of the processing)
Respectively for the purposes listed above:
A) Execution of the contract
B) Compliance with legal obligations
C) Consent of the data subject, which may be revoked
D) Consent of the data subject, which may be revoked

MAXIMUM DATA RETENTION PERIOD
• Personal data: no longer than 10 years after the end of the relationship for service purposes and no longer than 5
years from the collection of data for marketing purposes.
• Special data: no longer than 30 days after the end of the stay, unless otherwise required.

RECIPIENTS (who the data is communicated to)
• Employees and collaborators of the Joint Data Controllers (authorized to process and/or responsible for the
processing and/or system administrators)
• Third-party companies or other entities performing outsourcing activities on behalf of the Joint Data Controllers
(external data processors)
• Judicial authorities and/or police authorities if necessary
No data transfer to non-EU countries or international organizations.

RIGHTS (what rights you can exercise)
• Right to request and obtain from the Joint Data Controllers – without “undue delay” – confirmation whether or not
personal data concerning you is being processed and the information referred to in Article 15 of the GDPR.
• Right to update, integrate, delete, transform into anonymous form, or block data processed in violation of the law.
• Right to rectification; right to erasure; right to restriction of processing; right to data portability; right to object; right
to file a complaint with the Data Protection Authority.
How? By sending an email to the following address: privacy@bluhotels.it

ADDITIONAL INFORMATION
Extended privacy notice: http://www.bluhotels.it/en/legal-notice