Privacy Policy

1. Data controller

The data controller is Ivory S.r.l. (Ivory Dimora di Charme), Viale Circe 154, 04019 Terracina (LT), P.IVA/C.F. 03372380596, registered with the Companies Register of Latina under REA no. LT-317806, share capital € 10.000. Contact details for exercising your rights: dimoraivory@gmail.com — +39 0773 731609.

The controller has not appointed a Data Protection Officer (DPO), as the conditions set out in Article 37 GDPR do not apply.

2. Data processed, purposes and legal bases

a) Information requests. This website does not collect messages through forms: contact takes place by email or telephone and reaches the property directly. Any data communicated (name, contact details, message content) is processed in order to respond to the request. Legal basis: pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR).

b) Booking and stay. Data: identification and contact details, dates and details of the stay, payment data handled by the payment service provider. Purpose: entering into and performing the accommodation contract. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

c) Communication of guests’ identification details to the Police Headquarters via the “Alloggiati Web” portal, as required by law (Art. 109 of the Italian Consolidated Public Security Act, Royal Decree 773/1931), and statistical reporting on tourist flows. Legal basis: legal obligation (Art. 6(1)(c) GDPR). Providing this data is mandatory: without it the guest cannot be accommodated.

d) Tax and accounting obligations (invoicing, tourist tax). Legal basis: legal obligation (Art. 6(1)(c) GDPR).

e) Statistical measurement of website usage through non-technical cookies. Legal basis: consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Details in the Cookie Policy.

No automated decision-making or profiling within the meaning of Article 22 GDPR is carried out.

3. Nature of the provision of data

Providing the data needed to respond to an enquiry, and the data required by law at check-in, is necessary: refusal prevents, respectively, any reply and the provision of the accommodation service. Providing data for statistical measurement purposes is optional.

4. Data recipients

Data may be disclosed to: the booking engine and property management system provider; the property’s email service provider; tax and accounting advisors; banks and payment service providers; public security authorities and public administrations in the cases provided for by law. Suppliers processing data on behalf of the controller are bound by a data processing agreement pursuant to Article 28 GDPR.

This website is for information purposes only and does not collect or store guests’ personal data: bookings are made on the booking service provider’s system and information requests reach the property’s contact details directly.

Data is not disseminated nor transferred to third parties for the controller’s own or third-party marketing purposes.

5. Transfers outside the EU

Some technology providers may process data in third countries. In such cases the transfer takes place on the basis of an adequacy decision of the European Commission or of standard contractual clauses pursuant to Article 46 GDPR, together with supplementary measures where necessary. A copy of the safeguards in place may be requested at the contact details in section 1.

6. Retention periods

Information requests: 24 months from the last contact. Contractual data and tax documents: 10 years from the end of the relationship, pursuant to Article 2220 of the Italian Civil Code and tax legislation. Data communicated to the Police Headquarters: for the periods laid down by public security legislation. Statistical data from cookies: for the durations indicated in the Cookie Policy. At the end of these periods, data is erased or irreversibly anonymised.

7. Data subject rights

Data subjects have the right to request from the controller access to their personal data, rectification, erasure, restriction of processing, portability, and to object to processing (Articles 15-22 GDPR). Where processing is based on consent, they have the right to withdraw it at any time. Requests should be sent to the contact details in section 1 and will receive a response within one month, extendable by two months in particularly complex cases.

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or to bring proceedings before the courts.