PRIVACY NOTICE FOR THE PROCESSING OF GUESTS’ PERSONAL DATA
1. Data Controller
MARVET S.A.S. DI VETTORELLO MARCO & C.
Registered Office: Via Torino 2, 10075 Mathi (TO)
Tax Code and Company Register No.: 12044130016
PEC Address: [email protected]
2. Purpose and Legal Basis of Processing
Your personal data will be processed for the following purposes:
Compliance with legal obligations (e.g., art. 109 of T.U.L.P.S., mandatory notifications to authorities, tax and accounting regulations) – Legal basis: legal obligation.
Operational management of the reservation and stay, including check-in, payment, assistance, and communications – Legal basis: contract performance.
➤ Identification data, such as name, surname, and contact details, may also be acquired via online booking portals (e.g., Booking.com, Airbnb, etc.), in compliance with the conditions set by such platforms.
Protection of property and security, including technological security measures. The property is equipped with an external video surveillance system that only records accesses and outdoor perimeter areas, for the purpose of preventing unlawful acts, damage, and intrusions – Legal basis: legitimate interest of the Data Controller.
Sending of informational or promotional communications relating to the property (e.g., offers or updates), only with prior consent – Legal basis: consent.
3. Types of Data Processed
The following personal data may be processed, including those acquired through third-party booking portals:
Personal information (name, surname, date and place of birth)
Nationality
Identity document
Tax code
Residence
Contact details (phone, email)
Stay-related data (e.g., arrival and departure dates, preferences)
Payment data (if managed directly)
Any specific requests or service notes
Images captured by the external video surveillance system, limited to property accesses
4. Methods of Processing
Processing takes place using manual, electronic, and IT tools, in compliance with the security measures required by current legislation, to ensure confidentiality, integrity, and availability of the data.
No automated decision-making or profiling is involved.
Images recorded by the video surveillance system are processed exclusively for security purposes, are not disseminated, and are accessible only to authorized personnel or competent authorities in case of investigations.
5. Data Retention
Data will be retained for as long as necessary to achieve the above purposes, and in any case:
10 years for administrative, accounting, and tax obligations
5 years for public safety obligations (notifications to the Police Headquarters)
Until withdrawal of consent for promotional purposes and post-stay communications
6. Data Disclosure to Third Parties
Data may be disclosed, within strictly necessary limits, to:
Public authorities, supervisory and public safety authorities
Professionals or consultants (e.g., accountants)
IT or management software service providers (e.g., KrossBooking software)
Credit institutions and electronic payment providers (e.g., Stripe, PayPal) for transaction management
Some data may be transferred outside the European Union (e.g., to the United States), in compliance with the GDPR, for example based on European Commission adequacy decisions and/or Standard Contractual Clauses approved by the Commission.
Data will not be disclosed or sold to third parties for marketing purposes without specific consent.
7. Data Subject’s Rights
At any time, data subjects may exercise the rights provided for in Articles 15 et seq. of the GDPR, including:
Access to personal data
Rectification or erasure
Restriction of or objection to processing
Data portability
Withdrawal of consent (without affecting the lawfulness of prior processing)
Complaint to the Data Protection Authority
Requests may be sent to:
[email protected] or [email protected]
8. Provision of Data
Provision of personal data is:
Mandatory for legal obligations and proper management of the stay. Failure to provide data will make it impossible to accept the guest.
Optional for promotional and informational purposes. Lack of consent does not affect the use of the accommodation in any way.
9. Information Collected from Third Parties (Art. 14 GDPR)
When booking is made via portals (e.g., Booking.com, Airbnb, Expedia, etc.), personal data are not obtained directly from the data subject but communicated by such platforms. In this case, this notice is provided pursuant to Article 14 GDPR.
The categories of data received include:
Personal and contact details (e.g., name, surname, phone, email)
Residence, if provided
Booking information (e.g., dates, number of guests, preferences)
Any notes or requests from the guest
Such data are processed exclusively for the management of the stay and legal obligations, as outlined above.
