Privacy Policy

1. Data Controller

The Data Controller is Hotel Ortensia, which processes users' personal data in accordance with EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

2. Data collected and purposes of processing

2.1 Site browsing

While browsing the website www.hotelortensia.it, the IT systems automatically acquire certain data whose transmission is implicit in the use of Internet communication protocols, including IP address, browser type, operating system, pages visited and access times. This data is used exclusively for technical and anonymous statistical purposes, and is not associated with identified users.

2.2 Booking requests (Xenion Booking Engine)

The site incorporates the booking engine provided by Xenion (my.xenion.it), a third-party service that allows online bookings to be made. Through this system, the following personal data may be collected and processed:

• First and last name
• Email address
• Phone number
• Payment data (handled directly by Xenion in a secure environment)
• Stay dates and room preferences

The processing of this data is necessary for the performance of the booking contract (art. 6.1.b GDPR). For detailed information on the processing carried out by Xenion, please refer to their privacy notice available at my.xenion.it.

2.3 Communications via email or phone

Data spontaneously provided by the user via email or phone (name, contact details, message text) is processed exclusively to respond to the request and, subject to consent, for any future communications related to the hotel.

2.4 Technical browsing data and cookie consent

The site uses local browsing sessions (browser sessionStorage) to manage the hero animation and page scrolling. None of this data is transmitted to external servers.

The site also installs a first-party technical cookie called ho_cookie_consent, lasting 365 days, to store the user's choice regarding the acceptance or rejection of third-party cookies. This cookie does not contain identifiable personal data and is not shared with third parties. The choice can be changed at any time via the "Manage cookies" link in the site footer.

3. Third-party services

Google Fonts

The site uses the Google Fonts (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to load the Montserrat and Playfair Display typefaces. When the page loads, the user's browser sends a request to Google's servers, which may involve the transmission of the IP address. Google processes this data according to its own Privacy Policy.

Google Maps

The site incorporates a map via Google Maps Embed API (Google LLC). This service is loaded exclusively upon the user's explicit prior consent via the cookie banner. When active, the browser connects to Google's servers, which may collect usage data including the IP address. Processing is governed by the Google's Privacy Policy and the Google Maps Terms of Service.

Xenion Booking Engine

The booking engine is provided by Xenion, which loads scripts and stylesheets from its own servers (my.xenion.it). This service is loaded exclusively upon the user's explicit prior consent via the cookie banner. The processing of booking data is subject to Xenion's terms and privacy notice. As the booking manager, Xenion acts as a data processor pursuant to art. 28 GDPR for the personal data entered during the booking process.

Instagram

The site contains links and images related to the Instagram profile @hotelortensia. The links open in a new tab to the Instagram platform (Meta Platforms Ireland Ltd). No third-party widget is embedded that transmits data to Meta without the user's explicit interaction.

4. Legal basis for processing

The processing of personal data is based on the following legal grounds pursuant to art. 6 GDPR:

• Performance of a contract (art. 6.1.b): for bookings and information requests.
• Legitimate interest (art. 6.1.f): for site security and anonymous browsing statistics.
• Consent (art. 6.1.a): for any commercial or promotional communications, where required.
• Legal obligation (art. 6.1.c): for tax and administrative obligations related to the stay.

5. Data retention

Data relating to bookings and stays is retained for the period necessary to fulfil contractual and tax obligations, in any case not exceeding 10 years from the end of the relationship, unless otherwise required by law.

Data provided for simple information requests is retained for the time necessary to handle the request and, in the absence of a booking, is deleted within 12 months.

6. Rights of the data subject

The user has the right, at any time, to:

• Access their personal data (art. 15 GDPR)
• Request their rectification (art. 16 GDPR)
• Request their erasure ("right to be forgotten", art. 17 GDPR)
• Request the restriction of processing (art. 18 GDPR)
• Object to processing (art. 21 GDPR)
• Request data portability (art. 20 GDPR)
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal

To exercise their rights, the user can contact the Data Controller at ortensiahotel@gmail.com. A complaint can also be lodged with the competent supervisory authority: Italian Data Protection Authority (Garante per la protezione dei dati personali), www.garanteprivacy.it.

7. Transfer of data outside the EU

Some third-party services used by the site (Google LLC) are based in the United States. Data transfer takes place in compliance with the safeguards provided for by articles 44-49 GDPR, in particular through the standard contractual clauses adopted by the European Commission or the EU-US Data Privacy Framework.

8. Changes to this notice

The Data Controller reserves the right to update this notice at any time, in particular in the event of regulatory or technological changes. The updated version will be published on this page indicating the revision date.