Skip to content

Privacy policy

Last updated: [DATA]

This privacy policy explains how we process the personal data of people who visit the Berghotel Diamantidi website and of people who contact us through the contact form. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

1. Data controller

The data controller is [RAGIONE SOCIALE], [INDIRIZZO SEDE LEGALE], Italy, VAT no. [P.IVA].

For any privacy question, write to [EMAIL PRIVACY] or call us on +39 0462 814177.

We have not appointed a Data Protection Officer, as this is not required for our business.

2. What data we process

Data you give us through the contact form

  • Guests: first and last name, email address.
  • Travel agencies and tour operators: first and last name, email address, name of the agency or tour operator and, if you write one, your message.
  • Along with this data we record the website language, the page you wrote to us from, the wording of the consent you gave and the date.

Browsing data

When you visit the website, the servers that host it automatically record some technical information: IP address, date and time of the request, the page visited, and browser and device type. We use this data only to run the website and protect it from abuse. We do not use it to identify you or to build profiles.

We do not collect payment data or special categories of data (for example, health data).

3. Why we process data, on what legal basis and for how long

Updates on the opening and on offers (guests)

  • Purpose: to email you news about the opening of Berghotel Diamantidi, the start of bookings and our launch offers.
  • Legal basis: your consent (Art. 6(1)(a) GDPR).
  • Retention: until you withdraw your consent. Every email contains an unsubscribe link.

Requests from travel agencies and tour operators

  • Purpose: to answer your request and send you fact sheets, net rates and other material for working together.
  • Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in building business relationships with travel trade partners (Art. 6(1)(f) GDPR).
  • Retention: 24 months after the last contact. If we start working together, we keep the data for the duration of the relationship and for the periods required by civil and tax law.

Proof of consent

  • Purpose: to be able to show that we received your consent.
  • Legal basis: legal obligation (Art. 7(1) and Art. 6(1)(c) GDPR).
  • Retention: for as long as we process data on the basis of that consent and, after withdrawal, for as long as needed to protect our rights.

Running and securing the website

  • Purpose: to provide the website, prevent attacks and abuse, and fix technical problems.
  • Legal basis: our legitimate interest in a secure website (Art. 6(1)(f) GDPR).
  • Retention: for a short time, normally no longer than 30 days, unless the data is needed to investigate unlawful activity.

4. Do you have to give us your data?

No, the form is optional. Without your name, email address and consent, however, we cannot send you updates or answer your request.

5. Who can see your data

Your data is processed by authorised staff of the Mich family and our hotels, who are bound by confidentiality.

We also work with service providers that process data on our behalf as data processors under Art. 28 GDPR:

  • Railway Corporation (USA): hosting of the website and database, on servers in the European Union (the Netherlands).
  • Cloudflare, Inc. (USA): domain management, website protection and image storage.
  • [FORNITORE EMAIL]: sending and receiving email.
  • Where necessary, advisers such as accountants and lawyers, who are bound by professional secrecy.

We do not sell your data and we do not share it with third parties for advertising.

6. Transfers outside the European Union

Railway and Cloudflare are US companies. Even when data is stored in Europe, access from the United States cannot be ruled out. In these cases the transfer is based on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for certified companies, or on the standard contractual clauses approved by the European Commission (Art. 46 GDPR). You can request a copy of these safeguards by writing to the address in section 1.

7. Cookies

The public pages of this website do not use profiling, analytics or marketing cookies and do not load third-party content: even the fonts are served from our own servers. That is why we do not ask you to consent to cookies.

Only technical cookies, needed for the website to work securely, may be used:

  • login cookies for the private area, used only by our staff when working in the management panel;
  • where applicable, security cookies set by Cloudflare to tell real visitors apart from automated traffic.

Under the guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali) of 10 June 2021, technical cookies do not require consent. If we start using analytics or marketing tools in the future, we will update this policy and ask for your consent first.

8. Your rights

At any time you can ask us to:

  • give you access to your data and a copy of it (Art. 15 GDPR);
  • correct or complete it (Art. 16);
  • erase it (Art. 17);
  • restrict its processing (Art. 18);
  • give you your data in a machine-readable format or transfer it to another controller (Art. 20);
  • stop processing based on our legitimate interest (right to object, Art. 21).

You can withdraw your consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal. Just write to the address in section 1 or use the unsubscribe link in any email.

If you believe that the processing of your data breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority or with the supervisory authority of the country where you live or work.

9. Automated decisions

We do not make decisions based solely on automated processing, including profiling.

10. Changes to this policy

We may update this policy, for example when online bookings open. The current version will always be published on this page, with the date of the last change.