First of all, your privacy is essential to us; we are aware of the trust you place in our organization when you choose us for our services, and we are committed to better protecting your personal data.

What is this page for?

Before collecting personal data, the European Regulation 679/2016 establishes that people must be informed, in a simple and transparent way; in this information we describe, in a simple and transparent way, which data we acquire, for what reason, how they are treated; we also inform you about the rights granted to the subjects concerned by the privacy legislation.
If there are changes to the methods of treatment, we will update this information accordingly; we therefore recommend that you check this page regularly.

Service recipients

The use of this website is intended exclusively for adults; minors under 18 cannot use its services

Collected personal data

To book a holiday, we will have to acquire some of your data, such as name and surname, contact details, payment details, and if you have travel companions, also their data and related references.
Furthermore, the simple consultation of this site determines a collection of computer data generated during navigation, by the network servers, such as the IP address, some browser identifiers, language settings and other technical data inherent in the protocols and tools.

Legal bases of the treatments

We will treat your personal data in a legitimate way, based on some of the legal bases provided by the privacy legislation:

1. to fulfill contractual or pre-contractual obligations, for example when we will respond to requests for information or make reservations, etc.
2. with your consent, for example when we follow up on requests to subscribe to our newsletters, or in the case of using third-party tools that generate online identifiers, or social-login tools, etc.
3. for legal obligations, for example when we have to comply with national or community regulations, or we receive requests from the competent authorities, etc.
4. for our legitimate interest, for example when we adopt tools, software, services and information platforms, including from third parties, to make advanced features available and/or make the website work properly, or aimed at guaranteeing the necessary security, preventing fraud , etc.

Processing purposes

Your personal data will be processed for the following purposes:

Purpose	Legal basis
use of our web site to search for a holiday, a stay, a trip, an all-inclusive package; registration on our web site to offer personalized services, provide information or support to customers on a specific type of holiday and/or trip; organize and manage transfers and excursions; take out insurance policies to support travel, stays and tourist packages;	fulfillment of contractual and/or pre-contractual obligations
send you newsletters, information, commercial proposals, promotions and special offers relating to our catalogue, new locations or new services; carry out market research on user and/or customer satisfaction; offer after-sales services; personalize content and advertisements, collect and analyze behavior on the site in order to improve usability, content and user experience; use social-login tools; collect reviews and ratings from customers on their travel or stay experience;	your consent
fulfill the obligations established by law, by a regulation, by community legislation or by an order of the Authority (such as, for example, the registration of the guests with the competent offices);	legal obligations
operate our information systems correctly, analyze traffic and functionality, put in place the necessary security measures and prevent illegal activities, or anti-fraud controls; exercise the rights of the data owner, such as, for example, the right of defense in court.	legitimate interest

Data provision

The provision of your personal data, for the purposes indicated in points 1-4 is necessary; in their absence we could not carry on the activities indicated in each point. The consent to the treatment is therefore implicit in the request sent to us or in the service purchased.
Your consent, for the purposes indicated in points 5-10, is optional; in its absence we will not be able to carry out the related activities and the use of the services may be partial or impossible; we inform you that your consent may subsequently be modified or revoked, simply and immediately, through your reserved area of the portal or by making a simple request to our privacy contact person at the address privacy@greatstays.it

Processing methods and security measures

We treat your data in a lawful and correct manner, adopting appropriate security measures aimed at preventing unauthorized access, disclosure, modification or unauthorized destruction of the data. The processing is mainly carried out with IT and/or telematic tools, adopting adequate organizational methods and with logic strictly related to the purposes indicated.

Access to personal data

Your data may be made accessible:

• to our employees or collaborators, specifically appointed;
• to external collaborators, entrusted with specific technical and/or managerial tasks;
• to our partner agencies and/or tour operators and, more generally, to qualified subjects operating in the travel and tourism sectors;
• to other external subjects who, upon appointment as data processors, carry out outsourced processing activities, necessary to pursue the purposes indicated above.

Your personal data may be communicated to companies of our group, exclusively for the purposes indicated in this information, and will not be disclosed or transferred to third parties.

Sharing of personal data with third parties

In order to prepare a holiday, trip, tourist package and more generally services forming part of our offer, we will have to communicate some personal data of the requesting subject and possibly of the other components to real estate operators, tourist agencies, tour operators, travel agents, services of online booking, insurance companies, payment intermediaries, advertising partners, etc. These are qualified subjects, who can act - on our behalf - as external managers or independent data controllers.

Places of personal data processing

Your personal data will be processed, by the Data Controller or by the Data Processors, within the European Union; if, for technical and/or operational reasons, it becomes necessary to use subjects located outside the European Union, we will adopt the necessary precautions in order to obtain the same level of protection guaranteed by EU Regulation 679/2016; the information infrastructure is made available by GreatEstate srl, our parent company; for the booking functions the "Magellano" tool of Medialab srl is used; for corporate collaborative functions we have adopted Google Workspace (also based on European datacenters), while to send newsletters and part of the e-mails we use the infrastructures of the provider MailGun (based on their European datacenters); some data processing relating to third-party tools generating cookies and/or online identifiers, as well as those relating to social-login tools reside outside the Community area, generally in the USA. The complete and updated list is available upon simple request.

Data storage and deletion time

Your personal data will be kept by us for the minimum period necessary to achieve the purposes for which they were collected, without prejudice to a further retention period which is (or may be) imposed by law. In relation only to the data collected on the basis of optional consent, they will be kept for a period not exceeding that necessary to achieve the related purposes, or until consent is revoked.

Your rights

The Regulation grants you the rights pursuant to articles 15 and following, in particular you have the right to obtain:

• confirmation that your personal data is or is not being processed and to obtain access to the data and the following information (purpose of the processing, categories of personal data, recipients and/or categories of recipients to whom the data have been and/or will be communicated, retention period);
• the rectification of your inaccurate personal data concerning you and/or the integration of incomplete personal data, also by providing a supplementary declaration;
• the cancellation of personal data, if the conditions are met;
• the limitation of treatment, in the foreseen hypotheses;
• the portability of data concerning you, where the conditions are met;
• opposition to the processing at any time, for reasons related to your particular situation, to the processing of personal data for purposes related to marketing and profiling.

The exercise of these rights can be carried out, in a simple way, through an e-mail communication to the address: privacy@greatstays.it.
In any case, pursuant to art. 77 of the Regulation, you are granted the right to lodge a complaint with the National Supervisory Authority (www.gpdp.it), if you believe that the processing of your personal data is in violation of current legislation.

Data controller

The Data Controller is GREAT STAYS srl, with headquarters in Castiglion del Lago in via Vittorio Emanuele n. 43, CAP 06061 - Fiscal Code/VAT 03843520549.

Last updated: November 30, 2022