Skip to content Skip to footer
Book Now
Book Now

Privacy Policy

Close

Privacy Policy of cacelestechioggia.it

Pursuant to Regulation (EU) 2016/679 (“GDPR”) and the applicable national legislation on the protection of personal data, this notice describes the methods of processing of personal data collected through the website cacelestechioggia.it (hereinafter, the “Website”).

1. Data Controller

The Data Controller is:

Karma Srl
Via Rolando da Piazzola 2, 35139 Padova (PD), Italy
VAT No. 05210020284
E-mail: nicolamellon@karmaitaly.it

For any request or to exercise the rights indicated in this notice, you can contact the Data Controller at the above addresses.

2. Categories of Data Processed

Through the Website, the following categories of personal data may be processed:

  1. Browsing data
    The IT systems and software procedures used to operate this Website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.
    This category of data includes, by way of example: IP addresses, domain names of the computers used by users, URI/URL addresses of the requested resources, time of the request, method used to submit the request to the server, size of the file obtained, numerical code indicating the status of the server response, and other parameters relating to the user’s operating system and IT environment.
  2. Data voluntarily provided by the user
    • Contact details (name, surname, e-mail address, telephone number) entered in any contact or information/booking request forms.
    • The content of messages sent via forms or e-mail addresses published on the Website.
    • Any additional personal data voluntarily provided by the user (e.g. preferences, specific requests, any notes in the booking or contact form).
  3. Cookies and similar technologies
    The Website may use technical cookies and, upon consent, analytical and/or profiling cookies or similar tools. For more details, please refer to the specific Cookie Policy, available through the link provided in the banner and in the footer of the Website.

3. Purposes of Processing and Legal Bases

Personal data collected through the Website may be processed for the following purposes, with the corresponding legal bases:

  1. Managing requests sent via the Website
    • Responding to requests for general information, quotes, availability of accommodation, services offered, etc.;
    • Managing any bookings or pre-bookings made through forms or direct contact.
      Legal basis: performance of pre-contractual measures and/or of a contract to which the user is party (Art. 6(1)(b) GDPR).
  2. Compliance with legal obligations
    • Fulfilment of tax, accounting and administrative obligations related to any contractual relationship established (for example, stay in the Ca’ Celeste accommodation facilities);
    • Fulfilment of obligations related to public security and tourism regulations, where applicable.
      Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
  3. Operation, security and maintenance of the Website
    • Ensuring the correct technical functioning of the Website;
    • Preventing or detecting fraudulent activities or abuses in the use of the Website;
    • Managing and improving the IT infrastructure.
      Legal basis: legitimate interest of the Data Controller in ensuring the security and proper functioning of the Website (Art. 6(1)(f) GDPR).
  4. Anonymous and aggregated statistical analysis
    • Analysis of traffic on the Website and anonymous/aggregated statistics on its use, possibly also through analytical cookies.
      Legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR), or the user’s consent for cookies/tools that are not purely technical (Art. 6(1)(a) GDPR).
  5. Marketing activities (if applicable)
    Possible sending of promotional communications or newsletters relating to Ca’ Celeste services, only if the user has given specific consent via dedicated forms.
    Legal basis: data subject’s consent (Art. 6(1)(a) GDPR), which may be freely withdrawn at any time.

4. Methods of Processing

Personal data are processed:

  • using manual, electronic and telematic tools;
  • according to logics strictly related to the purposes indicated above;
  • by adopting appropriate technical and organisational security measures in order to prevent loss of data, unlawful or incorrect use and unauthorised access.

Data are not subject to automated decision-making processes that produce legal effects concerning the user or similarly significantly affect them, unless otherwise indicated in the specific notices of particular services.

5. Provision of Data and Consequences of Refusal

  • The provision of data marked as mandatory in the Website forms is necessary in order to process the user’s requests or manage bookings. If such data are not provided, it may not be possible to provide the requested response or service.
  • The provision of data for marketing purposes (e.g. newsletter subscription) is entirely optional; failure to provide them or withdrawal of consent does not affect in any way the use of the other services of the Website.

6. Recipients of the Data

Personal data may be disclosed, within the limits strictly related to the purposes indicated above, to:

  • collaborators and employees of the Data Controller, duly authorised and instructed to process data;
  • providers of technical and IT services (e.g. hosting companies, website maintenance, e-mail providers, booking platforms, CRM systems);
  • consultants of the Data Controller (e.g. tax, legal consultants), to the extent necessary for the performance of their assignments;
  • public bodies or authorities to which disclosure is mandatory by law or by order of an authority.

These parties will process data as independent data controllers or, where applicable, as data processors pursuant to specific data processing agreements under Art. 28 GDPR.

Personal data will not be disseminated (i.e. made available to unspecified parties) unless required by laws or regulations.

7. Transfers of Data to Non-EU Countries

For technical and organisational reasons, the Data Controller may use service providers (e.g. hosting services, newsletter services, CRM, booking management) that involve the transfer of personal data to countries outside the European Economic Area.

In such cases, the transfer will be carried out in compliance with Articles 44 et seq. of the GDPR, on the basis of an adequacy decision of the European Commission, or by adopting appropriate safeguards (such as standard contractual clauses approved by the European Commission) or other conditions provided for by the applicable legislation.

Upon request, the user may obtain information on the location of the data and the safeguards adopted.

8. Data Retention Period

Personal data will be stored for no longer than is necessary for the purposes for which they were collected. In particular:

  • Contact data and content of requests: stored for the time needed to process the request and, if the request leads to a contractual relationship, for the entire duration of the relationship and for the subsequent period required by law (for example, limitation periods for legal claims, accounting and tax obligations).
  • Data relating to bookings and stays: stored in compliance with legal obligations in tax, accounting and public security matters.
  • Data processed for marketing purposes: stored until the user withdraws consent or, in any case, for a period not exceeding that permitted by applicable laws and guidelines of the supervisory authority, unless anonymised.
  • Browsing data: usually deleted within short periods of time (unless necessary for the investigation of crimes by judicial authorities).

At the end of the above retention periods, the data will be deleted, anonymised or stored in a form that no longer allows identification for the original purposes.

9. Data Subject Rights

As a data subject, the user may exercise at any time, with respect to the Data Controller, the rights provided for in Articles 15–22 GDPR, including:

  • Right of access: to obtain confirmation as to whether or not personal data concerning them are being processed and, if so, to access the data and information related to the processing.
  • Right to rectification: to obtain the correction of inaccurate data or the completion of incomplete data.
  • Right to erasure (“right to be forgotten”): to obtain the deletion of personal data in the cases provided for in Article 17 GDPR.
  • Right to restriction of processing: to obtain restriction of processing in the cases provided for in Article 18 GDPR.
  • Right to data portability: to receive in a structured, commonly used and machine-readable format the personal data provided, and to transmit them to another controller, in the cases provided for in Article 20 GDPR.
  • Right to object: to object at any time to processing based on the legitimate interest of the Data Controller, unless the latter demonstrates compelling legitimate grounds for the processing.
  • Right to withdraw consent: where processing is based on consent, the user may withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority or with another competent supervisory authority, if they believe that the processing of their personal data is carried out in breach of the applicable law.

10. How to Exercise the Rights

To exercise the above rights or to obtain any information regarding this notice and the processing of their personal data, the user may contact the Data Controller at the following addresses:

Karma Srl
Via Rolando da Piazzola 2, 35139 Padova (PD), Italy
E-mail: nicolamellon@karmaitaly.it

The request will be processed without undue delay and, in any case, within the time limits set out in the GDPR.

11. Links to Third-Party Websites

The Website may contain links to third-party websites or services (for example, booking portals, social networks, map services). These websites operate as independent data controllers. Users are encouraged to read the relevant privacy policies to understand how personal data are processed by such third parties.

12. Updates to this Notice

This Privacy Policy may be subject to changes and updates. In the event of significant changes, the Data Controller will provide notice on the Website.

Users are therefore invited to periodically consult this page in order to be informed about any updates.