Blu Hotels

Policy implemented by Blu Hotels SpA on the processing of personal details.

This declaration contains indications of the regulations and directives to which Blu Hotels SpA conforms in relation to the processing of personal details supplied by visitors to the bluhotels.it web site. Since this site is operated and hosted from a base in Italy, the information and data concerning users of the site will be processed by Blu Hotels SpA in ways that comply with the Italian legislation (Legislative Decree No. 196 of June 30, 2003 and subsequent amendments and additions) that integrates Directives 95/46/CE and 2002/58/CE of the European Parliament and European Council.

1. Purposes of data processing and methods used

Blu Hotels SpA hereby informs users of its site that the details they supply will be used for the purposes specified below, and also to keep them informed about news, promotions, competitions and initiatives relating to Blu Hotels SpA.
Without prejudice to disclosures carried out in order to comply with legal requirements, the personal details may also be disclosed to the following companies and bodies, in Italy and/or overseas:  
- credit institutions
- debt-recovery companies
- credit insurance companies
- commercial information companies
- professionals and consultants
- insurance companies
- private laboratories and public bodies commissioned by us to carry out tests and analyses 
- for direct marketing activities, including newsletters, MMS/SMS messages or other
- for information-based activities
- for the compiling of professional profiles on clients or consumers 
- for market research or other types of research geared towards the enhancement of our products and services.
The data received will be processed electronically and/or manually, and will be protected by appropriate security systems (which will be constantly updated) and stored in a safe, monitored environment.

2. Granting of access to details and consequences of the decision to withhold consent 
 
The granting of access to your personal details is optional, except for cases in which the details collected must be used to implement a contract or deliver a service you have requested. In such cases, refusal to grant access to your details will make it impossible for Blu Hotels SpA to respond to, or act upon, your request.

3. Persons responsible for data processing and disclosure limits

The personal details you supply will be disclosed to, and utilised by, the employees of Blu Hotels SpA and/or its overseas subsidiaries for the sole purpose of carrying out the activities that constitute the reason for which the details were collected in the first place (for example, to implement a sales or service contract or to send out newsletters). The data may be disclosed to other parent, subsidiary and/or associated companies of Gruppo Blu Hotels SpA in Italy, the EU or countries outside the EU, on condition that the legislation in place in the destination country (or the country or countries through which the data may pass) is sufficient to ensure an adequate level of protection of your details. The adequacy of the protective measures in place will be evaluated by comparing the system used in the relevant country with the system used in Italy. 
Your details may also be disclosed to IT service providers, banks, financial intermediaries, credit institutions, other financial bodies, managers of centralised IT systems (risk and anti-fraud centres, etc.), insurance companies, consultants and freelance professionals who assist Blu Hotels SpA in the recovery of debts and the resolution of disputes, packaging companies, couriers and delivery companies or companies that provide postal and marketing services, bodies and companies specialising in research, and non-profit associations and foundations.

4. Rights of the data subject

The party responsible for the processing of the collected data is Blu Hotels SpA, a company with its headquarters at Via Enrico Fermi, 7/b  - 25087 Salo' Loc. Cunettone (BS) ITALY. As the data subject, you can contact this party in writing in order to exercise your rights under Article 7 of Italian Legislative Decree No. 196/2003, which include the right to: 
1) be informed as to the source of the personal details held, the purpose(s) for which they are being processed, and the systems used (when the processing operations are being carried out by electronic means); be informed of the contact details of the party responsible for the processing operations, and receive information on the individuals and categories of individuals to whom the personal details may be disclosed
2) request the updating, correction or completion of the details held; the cancellation, making anonymous or blocking of access to details processed illegitimately, including those details that do not require to be stored in relation to the purpose(s) for which they were originally collected and subsequently processed; confirmation that the requested form and content of the data-protection operations have been communicated to any individuals to whom the details have been disclosed, unless doing so would be impossible or would require the allocation of resources that are clearly disproportionate to the right being protected
3) oppose, for legitimate reasons, the processing of the relevant personal details, even if still relevant to the purpose(s) for which they were collected; oppose the processing of the relevant personal details if said operations are being carried out with a view to sending the data subject advertising, direct sales, market research or commercial material.

Art. 7. Right of access to personal details and other rights

(Italian Legislative Decree No. 196/2003)  
1. The data subject has the right to be informed as to the existence of any personal details that concern him or her - even if they have yet to be recorded - and to receive a copy of said details in an intelligible form. 
2. The data subject has the right to be informed as to: 
a) the source of the personal details held 
b) the purpose(s) for which they are being processed
c) the systems used (in cases where the processing operations are conducted using IT equipment) 
d) the contact details for the entity/individual legally responsible for the processing operations, the data manager and the designated representative, as per the prescriptions of Paragraph 2, Article 5 
e) the entities (individuals) to which the details may be disclosed, or which may be given access to the details as the designated local representatives of the State, as managers or functionaries 
3. The data subject has the right to request: 
a) the updating, correction or, where necessary, completion of the details
b) the cancellation, making anonymous or blocking of access to any details processed unlawfully, including those details that are not required to be held in relation to the original purpose for which the details were collected and subsequently processed; 
c) confirmation that the operations described at point a) and b) have been communicated to all those to whom the details were disclosed, except when the act of fulfilling this obligation would be impossible or would require the expenditure of funds that are clearly disproportionate to the right being protected. 
4) The data subject has the right to oppose, fully or partially, for legitimate reasons: 
a) the processing of the personal details that concern him or her, even if these details are relevant to the purpose for which they were collected; 
b) the processing of his or her personal details for the purposes of sending out publicity or direct sales material, or for the completion of market research surveys or for commercial communications.

Article 13. Information for data subjects (Italian Legislative Decree No. 196/2003)

1. The data subject as well as any entity from whom or which personal data are collected shall be preliminarily informed, either orally or in writing, as to: 
a) the purposes and modalities of the processing for which the data are intended 
b) the obligatory or voluntary nature of providing the requested data 
c) the consequences if (s)he fails to reply 
d) the entities or categories of entity to whom or which the data may be communicated, or who/which may be given access to the data in their capacity as data processors or persons in charge of the processing, and the scope of dissemination of said data 
e) the rights as per Section 7 
f) the identification data concerning the data controller and, where designated, the data controller’s representative in the State’s territory pursuant to Section 5 and the data processor. If several data processors have been designated by the data controller, at least one among them shall be referred to and either the site on the communications network or the mechanisms for easily accessing the updated list of data processors shall be specified. If a data processor has been designated to provide responses to data subjects in case the rights as per Section 7 are exercised, said data processor shall be referred to. 
2. The information as per Paragraph 1 shall also contain the items referred to in specific provisions of this Code and may fail to include certain items if the latter are already known to the entity providing the data or their knowledge may concretely impair supervisory or control activities carried out by public bodies for purposes related to defence or State security, or else for the prevention, suppression or detection of offences.  
3. The Garantor may issue a provision to set out simplified information arrangements as regards, in particular, telephone services providing assistance and information to the public. 
4. Whenever the personal data are not collected from the data subject, the information as per Paragraph 1, also including the categories of processed data, shall be provided to the data subject at the time of  recording such data or, if their communication is envisaged, no later than when the data 
are first communicated. 
5. Paragraph 4 shall not apply  
a) if the data are processed in compliance with an obligation imposed by a law, regulations or EU legislation 
b) if the data are processed either for carrying out the investigations by defence counsel as per Act No. 397 of December 12, 2000 or to establish or defend a legal claim, provided that the data are processed exclusively for said purposes and for no longer than is necessary  
c) if the provision of information to the data subject involves an effort that is declared by the Garantor to be manifestly disproportionate compared with the right to be protected, in which case the Garantor shall lay down suitable measures, if any, or if it proves impossible in the opinion of the Garantor.