Privacy Policy

This is a translation provided for convenience. In case of discrepancies, the Italian version prevails.

Company information

Company name

Stefa s.r.l.

Registered office

Viale Rovereto, 57/59 – 38066 Riva del Garda (TN), Italy

VAT number

IT02526270984

Privacy Policy

Below is the privacy notice pursuant to Articles 12, 13 and 14 of the GDPR – Regulation (EU) 2016/679, as supplemented by Italian Legislative Decree 101/2018, concerning the processing of personal data provided by the Customer/data subject when filling in forms for the purchase of products/services offered by the Data Controller, as well as when visiting the Website, using software/applications, registering for events, and interacting with the services and features of the Website.

Dear User,
we would like to inform you that your personal data will be used by the Data Controller Stefa S.R.L., with offices at Viale Rovereto 57, 38066 Riva del Garda (TN), Italy, VAT no. 02526270984, represented by its sole director Mr Alessandro Calzà, in compliance with Regulation (EU) 2016/679, supplemented by Legislative Decree 101/2018 (General Data Protection Regulation), and with its guiding principles of lawfulness, fairness and transparency in the processing of personal data.

1. Purposes and legal basis of processing, purpose limitation and data minimisation

Your personal data is processed solely to provide the services needed to achieve the institutional purposes of the Controller (hotel and restaurant business), without commercial purposes, and for commercial purposes and other marketing initiatives only with your specific consent. The Controller will comply with the principle of purpose limitation, and any processing subsequent to the initial processing will not have purposes incompatible with the original one.

The Controller will also comply with the principle of data minimisation, limiting as far as possible the amount of personal data collected and the number of people who may have knowledge of it.

2. Data collected through this website

Contact form and quote requests

When you write to us using the form on the website, we collect your full name, email address, telephone number (optional), your message and, for quote requests, the dates of stay, the number and ages of guests, and the room type and board requested. This data is used only to reply to your request and, if you wish, to make you an offer. The legal basis is the performance of pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).

Your request is sent to us by email and a backup copy is kept on the server hosting the website for 90 days, after which it is deleted automatically. To protect the form against automated and abusive submissions, the IP address of your device is also processed and stored only in pseudonymised form (never in clear text). The resulting correspondence is kept for as long as needed to handle your request and any stay.

Online bookings

The “Book” button opens the hotel's online booking system, provided by Ericsoft (booking.ericsoft.com). The data entered on that page is processed to manage the booking; the information provided on that page also applies to data collected through the booking system.

Browsing data

During normal operation, the computer systems running the website acquire certain technical data whose transmission is implicit in the use of the Internet (for example IP address, date and time of the request, page visited, browser type). This data is used only to ensure that the website works properly and securely, and is kept only for as long as strictly necessary for these purposes. For visitor statistics the website uses Microanalytics, a cookie-free tool that produces only aggregate, anonymous data (page address, referring page, screen resolution); according to the provider, the IP address is not logged. The website does not use profiling cookies: see the Cookie Policy for details.

Links to external services

The website contains links to third-party services (Google Maps, Facebook, the restaurant menu). By following these links you leave the hotel's website, and the privacy notices of the respective providers apply.

3. Accuracy

The Controller will keep data up to date, promptly deleting and correcting inaccurate data.

4. Storage limitation – duration of processing

Data will be kept in a form that allows your identification for no longer than necessary to achieve the purposes set out in point 1, and as required by applicable tax law.

5. Integrity and confidentiality

To ensure appropriate security of the data processed, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, the following measures are applied: backup of electronically stored data at least once a year; computer access tracked through usernames and passwords changed at least once a year; use of licensed software; paper archives accessible only to formally designated authorised staff; written procedures for data access; sensitive data archives with controlled access, kept under lock and key.

6. Methods of processing

• Processing consists of the collection, recording, organisation and storage of data within the time limits stated above, and subsequent paper and/or electronic archiving, with access and consultation reserved to authorised staff under written rules.
• Operations may be carried out with or without electronic or automated tools, and all appropriate technical and organisational measures will be applied to ensure the security and protection of data, such as access passwords held only by authorised staff (changed at least once a year) and licensed systems, details of which are available from the Controller, to prevent unauthorised third parties from accessing the databases.
• Archives containing sensitive data will be locked and accessible only to staff authorised for this purpose, with each access recorded in writing.
• Persons who may access the Controller's premises outside opening hours are specifically identified and registered: the list can be requested from the Controller or the relevant authorised person.

7. Data Controller (Art. 24 GDPR)

The Data Controller is Stefa S.R.L., represented by its sole director Mr Alessandro Calzà, with offices at Viale Rovereto 57, 38066 Riva del Garda (TN), Italy, VAT no. 02526270984. Contact details: telephone +39 0464 551884; email info@hotelprimo.it; certified email (PEC) stefa.srl@legalmail.it.

8. Data Processors (Art. 28 GDPR)

Data may be disclosed to external Data Processors who have entered into specific agreements, conventions, memoranda of understanding or contracts with the Data Controller.

By way of example, data may be disclosed to the following categories of recipients: consultants and other suppliers and service providers (accountant, labour consultant, training consultants and certifiers, lawyers and legal advisers, system administrator, IT consultants, website and email hosting provider, visitor statistics provider, online booking system provider, insurer and brokers).

9. Persons authorised to process data (Art. 29 GDPR)

Persons authorised to process personal data are employees, collaborators and assistants, whose details are available at the Controller's premises, who have been instructed and trained in the correct processing of data and designated in writing.

10. Provision of data

Providing common identifying personal data is strictly necessary to carry out the activities referred to in point 1. The personal data processed by the Controller is collected directly by the Controller from the Customer/data subject at the time of the request or booking and while browsing the Website or using applications, social media or web services, or through its collaborators at the time of, or after, the booking and during the stay.

11. Refusal to provide data

If the data subject refuses to provide personal data, it will not be possible to carry out the activities referred to in point 1.

12. Disclosure of data

Personal data may become known to persons authorised to process it, whose details are available from the Controller, and may be disclosed for the purposes set out in point 1 to external collaborators, operators in the sector and, in general, to all public and private parties to whom disclosure is necessary for the correct fulfilment of those purposes. Employees and/or collaborators of the Controller responsible for managing personal data may have knowledge of users' personal data. They will process the User's data exclusively for the purposes stated in this notice and in compliance with the Italian Privacy Code and the European Regulation. If necessary, third parties processing personal data on behalf of the Controller as “external Data Processors” may also have knowledge of users' personal data. Users have the right to obtain a list of any data processors by making an explicit request to the Controller.

13. Dissemination of data

Personal data is not disseminated, except as expressly authorised in the consent and as strictly necessary for the Controller's institutional activity.

14. Transfer of data abroad

Your personal data may be transferred to countries of the European Union and to countries outside the European Union for the purposes set out in point 1, without being sold to third parties.

15. Automated processing

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Controller implements technical and organisational measures considered appropriate to ensure a level of security appropriate to the risk.

16. Rights of the data subject

Regulation (EU) 2016/679, supplemented by Legislative Decree 101/2018, grants all data subjects specific rights over their personal data, including the right to ask the controller for access to, rectification or erasure of their personal data, restriction of processing, or to object to processing on legitimate grounds; the right to data portability, meaning the right to receive the data concerning you that you have provided to the Controller in a structured, commonly used and machine-readable format and to transmit that data to another controller without hindrance; and the right to have personal data transmitted directly from the Controller to another controller, where technically feasible.

Data subjects may exercise these rights by sending a written request to the Controller at the contact details given in point 7. A reply will be given within 30 days, or at most within three months for complex requests or assessments.

Data subjects also have the right to lodge a complaint with the supervisory authority, the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

17. Legitimate interests of the Controller

The legitimate interests of the controller or of a third party may provide a valid legal basis for processing, provided that the interests or fundamental rights and freedoms of the data subject do not override them. In general, such legitimate interests may exist where there is a relevant and appropriate relationship between the controller and the data subject, for example where the data subject is a customer of the controller. In particular, it is a legitimate interest of the Controller to process users' personal data: to carry out its institutional activity securely; for direct marketing to existing customers (by email, including with profiling aimed at personalising commercial communications, for products/services similar to those previously purchased); to ensure the free flow of such data within the Controller's infrastructure, including IT infrastructure; and, as regards traffic data, to ensure network and information security, that is, the ability of a network or system to resist unforeseen events or unlawful acts that could compromise the availability, authenticity, integrity and confidentiality of data.