privacy information

rev. 5.11.2024

Pursuant to art. 13 of the European Regulation no. 679/2016, Mini Hotel Apartments s.r.l. (also “MHA”), VAT no. 10130210965, with registered office in via Manfredo Camperio 4, Milan, Italy, informs you that it is the Data Controller, pursuant to art. 24 of the EU Regulation no. 679/2016, of your personal data processing and that it will process the data you provide in compliance with the relevant legislation.

Data collected and purposes

The personal data provided by you are collected by telematic means and processed, including by electronic means, for the purposes indicated below and are essentially inherent to:

(1) Responding to requests and information from the Data Subject

Legal basis is the performance of a contract or the execution of pre-contractual measures taken at the data subject’s request (Article 6(1)(b) GDPR).

Data:

– for residence: mandatory first name and surname, e-mail, telephone, company (not mandatory)
– for contacts: first name, e-mail, telephone

(2) Finalisation and execution of the booking and provision of the requested service

The legal basis is the performance of a contract to which the data subject is a party, or the performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR).

Data: First and last name, phone number, email address, postal code, city, province, country, phone, date of birth, credit card information.

(3) To fulfil obligations strictly related to the purchase of a service by a customer, including administrative and accounting purposes and any subsequent after-sales assistance.

Legal basis: performance of a contract to which the data subject is a party, or performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR).

Data: Name and surname, VAT number, address, telephone number, email address.

(4) Customer satisfaction (questionnaires sent by e-mail) to evaluate the services offered by the Controller

Legal basis: legitimate interest of the Data Controller balanced with the rights of the data subjects (Article 6(1)(f) GDPR).

Data: e-mail

(5) Statistics on bookings and site visits on aggregated and anonymised data

(6) Cookies: the site uses cookies to make navigation better and to provide certain functionalities. For more information: https://micasas.it/cookie-policy-ue/.

Nature of data provision

The provision of data is necessary in relation to purposes 1, 2 and 3, as it is strictly functional to the execution of the contract, administrative management and the fulfilment of legal obligations: any refusal will make it impossible to initiate contractual relations and the provision of related services.

With reference to purpose 4, the legal basis is the legitimate interest of the Data Controller (Art. 6 par. 1 lett. f) GDPR) in assessing that the service offered to the customer respects a certain quality standard, also in order to implement any plans for improving the same.

With reference to purpose 5, no personal data will be used, but only aggregated and anonymised data from which the data subject cannot be traced/identified.

Processing methods

Personal data shall be processed in paper, computerised and telematic form and entered in the relevant databases (customers, suppliers, administration, etc.) which may be accessed and thus become known to the employees expressly designated by the Data Controller as authorised/designated for the processing of personal data, in compliance with the legal provisions necessary to guarantee, among other things, the confidentiality and security of the data as well as their accuracy, updating and relevance to the stated purposes.

Scope of data communication and dissemination

The data will not be disclosed.

In relation to the purposes indicated, the data may be communicated to the following subjects and/or categories of subjects, or to companies and/or persons providing services, including external services, on behalf of the data controller. Among them* are indicated, for example:

agencies/IT technicians for user problem solving;
provider of network and hosting services (Utixo Italia s.r.l.);
competent authorities and/or supervisory bodies for the fulfilment of legal obligations;
public administrations for their institutional purposes.
licensed professionals for the purpose of studying and solving any legal and contractual problems.

(*) The list of Processors/Controllers with further useful identification data can be requested by contacting the Company at the contact details given.

Duration of processing

For purposes 1, 2 and 3, your personal data will be processed and stored until 10 years after termination of the contract and/or last registration for administrative-accounting purposes and to comply with legal obligations, after which they will be destroyed or rendered unusable or anonymous.

For purpose 4, the data shall be processed and kept for the period of time strictly related to the underlying service contract and, in any event, for a period not exceeding 2 years from the time of collection, after which it shall be destroyed or rendered unusable or anonymous.

Rights of Data Subjects

In relation to the aforementioned processing operations, you may exercise the rights set out in Chapter III of EU Regulation No. 679/2016 Articles 15 – 22, which include:

obtaining confirmation as to whether or not data concerning you exist;
to know the origin of the data, the logic and the purpose on which the processing is based; and
obtain access, cancellation, transformation into anonymous form or blocking of data processed in violation of the law, updating, restriction, rectification, revocation, portability and integration of data
oppose, for legitimate reasons, the processing of such data
to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR (https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524)

by contacting the Data Controller, by phoning +(39) 02 82397225 or by sending an email to info@micasas.it.

The Data Protection Officer (DPO) can be contacted at: dpo@micasas.it.

Further information regarding the processing and communication of data provided directly or otherwise acquired may be requested at the above addresses.