Privacy policy

1. Owner and Data Protection Officer

The data controller of personal data is GRAND HOTEL FASANO with registered office in Gardone Riviera (BS), [email protected] (hereinafter the 'Data Controller').

2. Information collected by the Site:

(a) automatically

Dati di navigazione:
The computer systems and software procedures used to operate this site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

These data, necessary for the use of web services, are also processed for the purpose of: 

• obtain statistical information on the use of services
• monitor the proper functioning of the services offered.

b) communicated by the user

- Data communicated by the user:

c) through cookies

The site uses cookies, for which please refer to the extended "cookie privacy" statement.

Browsing data is not retained for more than 180 days (except in the event of the need to ascertain criminal offences by the judicial authorities). The optional, explicit and voluntary sending of data through the various filling-in forms on the site which entail the acquisition of the sender's contact data, necessary to fulfil requests for contact, services, allocation of credentials. 

3) Type of personal data, purpose, legal basis and retention period

We need the personal data requested and provided to enable you to access the site and use the following services:

• Type of service: contact area
• Type of personal data collected: personal details, contact data (e.g. e-mail, telephone numbers, etc.)
• Purpose: to acquire, by filling in a specific form, the references of users of the site in order to satisfy information/commercial contact requests (Contact Area)
• Legal basis: execution of contract when requesting authorisation to send promotional or marketing material then ticking acceptance and consent
• Retention period: 24 months from acquisition or renewal of contact
• The processing of data for the above purposes will be carried out in compliance with the Privacy Regulation and all specific sector regulations

The data provided will be processed mainly by computer under the authority of the Data Controller, by persons specifically instructed, authorised and trained to process the data in accordance with Articles 28 and 29 of the Privacy Regulation. Please note that appropriate security measures are also observed pursuant to Articles 5 and 32 of the Privacy Regulation to prevent the loss of data, unlawful or incorrect use and unauthorised access.

4)Compulsory or optional nature of consent to provide data

The provision of data is optional, but if it is not provided, it will not be possible to take advantage of certain services on our site.

5) Where can we transmit data

The data may be communicated within the EU, in full compliance with the provisions of the Privacy Regulation, to the following parties:
(1) to the financial administration and/or other public authorities, where required by law or at their request;
Le informazioni raccolte automaticamente dal Sito potranno essere anche trasferiti in server cloud di Terze Parti ubicati anche Extra UE, qualora tale trattamento risulti necessario per l’esecuzione dei servizi del sito. La base giuridica di detto trattamento è, pertanto, l’art. 49, comma 1, lett. b del Regolamento Privacy.
(2) to external structures, parties and companies which the Data Controller uses to perform activities connected with, instrumental to or consequent upon the execution of the Site Services.

The information automatically collected by the Site may also be transferred to cloud servers of Third Parties also located outside the EU, if such processing is necessary for the performance of the Site Services. The legal basis of said processing is therefore Article 49, paragraph 1, letter b of the Privacy Regulation.

6) Security Measures

Through the Site, data are processed in compliance with the applicable law and using appropriate security measures in accordance with the legislation in force, also pursuant to Articles 5 and 32 of the Privacy Regulation.

In this regard, we confirm, inter alia, the adoption of appropriate security measures aimed at preventing unauthorised access, theft, disclosure, modification or destruction of processed data. 

7) Rights

Please note that you may exercise your rights under Articles 15 to 21 of the Privacy Regulation at any time by sending a written communication to the Controller's contact details, with a view to obtaining:

• confirmation of the existence or non-existence of personal data with an indication of their origin, checking their accuracy or requesting that they be updated, corrected or supplemented;
• access, deletion of data or restriction of processing;
• transformation into anonymous form or blocking of data processed in violation of the law. 

8) Changes to the Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy, replacing previous versions. This notice was issued in May 2023.

One may also object to the processing of personal data previously provided.

With reference to the Newsletter, we would like to point out that any request for cancellation can be made explicit by using a special link/button.