Information pursuant to Article 13 of EU Regulation 2016/679

This privacy notice is provided in compliance with Article 13 of EU Regulation 2016/679 (also known as GDPR) and Article 3.1 of the Provision on Video Surveillance of the Italian Data Protection Authority – April 8, 2010, in order to inform you about the video surveillance systems, their use, and your rights.

Data Controller and Data Protection Officer

Grand Hotel Il Moresco S.r.l. (hereinafter referred to as the “Controller”), with registered office in Naples (ZIP 80121), via Vito Fornari, 4, Tax Code and VAT No. 04433700632 (telephone: +39 081.991355; email: moresco@leohotels.it; certified email: grandhotelmorescosrl@pec.it), informs you that it is the data controller under Article 4, no. 7, of EU Regulation 2016/679. The data you provide will be processed lawfully, fairly and transparently, in accordance with Article 5 of the above Regulation, and with due regard to your rights and freedoms. Additional communications may be provided later, including verbally.

The company has appointed a Data Protection Officer, who can be contacted at the following email: palmieri@aptconsulting.it.

Data Processed

Article 4(1) of EU Regulation 2016/679 defines “personal data” as any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name, ID number, location data, online identifier, or one or more elements specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

Specifically for video surveillance, the data processed are summarized below:

• images of people and objects within the range of the cameras installed in the premises of the Controller.

Purpose of Processing

The personal data you provide will be processed solely for the following purposes:

• safety and security of the Controller’s employees, customers and suppliers;
• protection of the Controller’s property, by preventing and prosecuting potential unlawful acts.

Legal Basis for Processing

The legal basis for video surveillance is the legitimate interest of the Controller (Article 6(1)(f) of EU Regulation 2016/679) to carry out the processing for the purposes set out in Section C.).

Nature of Data Provision

Providing data is mandatory for the purposes indicated in Section C.) and related to the reasons why employees, customers and suppliers access the Controller’s premises.

If data is not provided, access to the premises will not be allowed.

Disclosure and/or Dissemination of Data

The viewing and management of the images recorded by the video surveillance system is reserved to the Controller and/or employees who have been authorized in writing.

Data may also be disclosed to third parties if required by law and/or by order of the judicial or public security authorities.

Data Transfer Abroad

Data will not be transferred to third countries (non-EU countries).

Data Retention Period

Images recorded are generally retained for a maximum of 24 hours after recording, except for special needs for extended retention due to holidays or office closures, or when a specific request is made by judicial or police authorities. After this period, the images will be automatically deleted.

Data Processing Methods

Your personal data will be processed and stored exclusively for the purposes outlined in Section C.), using paper, automated, and electronic means, entered in appropriate databases and processed with tools designed to ensure the integrity, security and confidentiality of the data.

The Controller adopts all appropriate technical and organizational measures to ensure that processing is carried out in compliance with EU Regulation 2016/679. Access to personal data is granted only to persons authorized to process such data.

Data Subject Rights

The data subject may, at any time, exercise the rights under EU Regulation 2016/679, in particular:

• right to access personal data;
• right to obtain rectification or erasure, or restriction of processing;
• right to object to processing;
• right to data portability;
• right to withdraw consent, where applicable (withdrawal does not affect the lawfulness of processing based on consent before withdrawal);
• right to lodge a complaint with the supervisory authority (Privacy Authority).

Due to the type of data and retention periods involved, the right to update, integrate or rectify data under Article 16 of the GDPR may not always be practically enforceable. The right to data portability under Article 20 of the GDPR is not applicable, as the images acquired through the video surveillance system – except in the cases outlined in Section F., paragraph 2 – cannot be transferred to third parties.

These rights may be exercised by sending a communication to:

Grand Hotel Il Moresco S.r.l., via Vito Fornari, 4 – Naples (ZIP 80121), or via certified email at grandhotelmorescosrl@pec.it.