Villa Rosa Hotel: Policy on the processing of personal details This declaration contains information on the guidelines and directives to which the Villa Rosa Hotel adheres when processing the personal details supplied by users of the www.villarosahotel.eu website. Since the site in question is based and hosted in Italy, all information concerning users will be processed by the Villa Rosa Hotel in ways that comply with the Italian legislation that integrated EU directives 95/46/CE and 2002/58/CE - i.e. Italian Legislative Decree No. 196, issued on the 30th of June 2003, and subsequent additions and alterations. This legislation is the Italian equivalent of the Data Protection Act. 1. Purposes and methods of data processing The Villa Rosa Hotel hereby informs you that the data you supply will be used exclusively for the purposes outlined below and to keep you informed of the latest news, promotions, competitions and activities concerning the Villa Rosa Hotel. Aside from any communications made to comply with legal obligations, the data you supply may be disclosed, in Italy and/or overseas: - to credit institutions - to credit recovery companies - to credit insurance companies - to commercial information companies - to professionals and consultants - to insurance companies - to private laboratories or public bodies that we have commissioned to conduct testing and analysis - for direct marketing operations, through the sending out of newsletters, MMS or SMS messages or other types of messages - for informative purposes - for the creation of professional profiles of customers or consumers - for market research or other types of research aimed at enhancing our products and services. The data you supply may be processed using magnetic, electronic or paper formats - in all cases, your data will always be protected by appropriate, constantly updated, safety systems and will be stored in a secure, controlled environment. 2. Granting of access to your details and consequences of a decision to withhold consent The granting of access to your details is optional, except in cases where the details received must be used to execute a contract or a service you have requested. In such cases, if you (as the data subject) decide to withhold consent for your details to be accessed, this will make it impossible for the Villa Rosa Hotel to carry out what you have requested of us. 3. Persons responsible for data processing and disclosure limits The personal details you supply will be received and used by employees of the Villa Rosa Hotel and/or of its overseas subsidiaries for the sole purpose of executing the operations that constitute the reason for which the details were collected in the first place (i.e. to implement a contract of sale/service contract or to send out newsletters). Your details may be disclosed to parent companies, subsidiaries and/or associated companies of the Villa Rosa Hotel Group in Italy, in the EU and in non-EU countries, on condition that the legislation of the destination country (or the countries through which the information may pass) is sufficient to protect your privacy. The appropriateness or otherwise of the legislation of the countries in question will be evaluated by comparing the systems in use in those countries with the Italian system. In addition, your details may be disclosed to providers of electronic communication services, banks, financial intermediaries, credit institutions, other funding agencies, managers of centralised IT systems (anti-fraud centres, etc.), insurance companies, consultants and professionals who assist the Villa Rosa Hotel in its credit recovery or dispute resolution operations, companies that carry out packaging, shipping and delivery operations on purchases or that organise the sending out of e-mails and commercial communications, research agencies and companies and non-profit associations or foundations. 4. Your rights as the Data Subject The company responsible for the processing of the details you supply is the Villa Rosa Hotel, a company with its headquarters at No. 89, Lungolago C. Battisti, 25015 Desenzano del Garda (BS), Italy, to which you should address any communication of your intention to exercise the rights afforded to you by Article 7 of Italian Legislative Decree No. 196/2003, which include the right to: 1) be informed as to the source of the personal details held, the purpose(s) for which they are being processed, and the systems used (when the processing operations are being carried out by electronic means); be informed of the contact details of the party responsible for the processing operations, and receive information on the individuals and categories of individuals to whom the personal details may be disclosed 2) request the updating, correction or completion of the details held; the cancellation, making anonymous or blocking of access to details processed illegitimately, including those details that do not require to be stored in relation to the purpose(s) for which they were originally collected and subsequently processed; confirmation that the requested form and content of the data-protection operations have been communicated to any individuals to whom the details have been disclosed, unless doing so would be impossible or would require the allocation of resources that are clearly disproportionate to the right being protected 3) oppose, for legitimate reasons, the processing of the relevant personal details, even if still relevant to the purpose(s) for which they were collected; oppose the processing of the relevant personal details if said operations are being carried out with a view to sending the data subject advertising, direct sales, market research or commercial material. Art. 7. Right of access to personal details and other rights (Italian Legislative Decree No. 196/2003 - the Italian Data Protection Act) 1. The data subject has the right to be informed as to the existence of any personal details that concern him or her - even if they have yet to be recorded - and to receive a copy of said details in an intelligible form. 2. The data subject has the right to be informed as to: a) the source of the personal details held b) the purpose(s) for which they are being processed c) the systems used (in cases where the processing operations are conducted using IT equipment) d) the contact details for the party legally responsible for the processing operations, the data manger and the designated representative, as per the prescriptions of Paragraph 2, Article 5 e) the parties to which the details may be disclosed, or which may be given access to the details as the designated local representatives of the State, as managers or functionaries 3. The data subject has the right to request: a) the updating, correction or, where necessary, completion of the details b) the cancellation, making anonymous or blocking of access to any details processed unlawfully, including those details that are not required to be held in relation to the original purpose for which the details were collected and subsequently processed c) confirmation that the operations described at point a) and b) have been communicated to all those to whom the details were disclosed, except when the act of fulfilling this obligation would be impossible or would require the expenditure of funds that are clearly disproportionate to the right being protected. 4. The data subject has the right to oppose, fully or partially, for legitimate reasons: a) the processing of the personal details that concern him or her, even if these details are relevant to the purpose for which they were collected b) the processing of his or her personal details for the purposes of sending out publicity or direct sales material, or for the completion of market research surveys or for commercial communications. Article 13. Information for data subjects (Italian Legislative Decree No. 196/2003 - the Italian Data Protection Act) 1. The data subject, or any party from whom personal details are collected, must be informed in advance, either verbally or in writing, as to: a) the purposes of the processing operations and the methods to be used b) whether the granting of consent for the requested details to be processed is obligatory or voluntary c) the consequences of failing to grant consent d) the parties or categories of parties to whom the details may be disclosed, or who may be given access to the details in their roles as data processors or data managers, and the disclosure limits of said details e) the rights set out in Article 7 f) the identity of the data manager and, where designated, of the data manager's local representative (in compliance with the terms of Article 5) and of the data processor. If several data processors have been designated by the data manager, at least one of said processors must be identified, as must either the internet site on which, or any other mechanisms through which, the current list of data processors can easily be consulted. If a data processor has been designated to provide responses to data subjects in cases where the rights set out in Article 7 are to be exercised, the data processor in question must be identified. 2. The declaration described in Paragraph 1 must also contain the regulations set out in the relevant Articles of the Italian Data Protection Act, though certain regulations may not be included if they are already known to the party supplying the details or if their disclosure would compromise any monitoring and control operations being carried out by public-sector agencies for purposes of national security or the detection, suppression or prevention of offences. 3. The Guarantor may issue a provision setting out simplified arrangements for the public to access information and support on their rights by telephone. 4. Whenever the personal details are not supplied directly by the data subject, the data subject must, in any case, be informed of the content of Paragraph 1 (including information on the categories of details to be processed) at the time in which the details are registered, or if the details are to be disclosed to third parties, no later than the time in which the details are disclosed for the first time. 5. The terms of Paragraph 4 shall not apply if: a) the details are being processed in order to comply with legal requirements, regulations or EU directives b) the details are being processed either to allow the counsel for the defence to conduct investigations (as per the terms of Italian Law No. 397, issued on the 12th of December, 2000) or to assert or defend a legal right, on condition that the details are processed exclusively for said purposes and for a period of time lasting no longer than that which is strictly necessary c) the provision of the relevant information to the data subject would require the allocation of resources that the Guarantor, on prescribing appropriate measures, declares to be clearly disproportionate to the right being protected, or if the provision of the relevant information to the data subject would be, in the judgement of the Guarantor, impossible.

() I Agree