Privacy Policy

The data controller is V.R. srl, with registered office at via Gerace 200, 89013 Gioia Tauro (RC), Italy.

E-mail: bebgeolja@gmail.com · Tel: +39 334 950 5335.

The property processes the following personal data, provided directly by the guest at the time of booking (online or offline) or at check-in:

• Identification data: first name, surname, date and place of birth, residential address.
• Identity document data: document details, required solely for reporting to the Police authority.
• Contact data: phone number, e-mail address.
• Payment data: credit card details or bank coordinates, to manage the guarantee and payment of the stay.
• Special categories: any food allergies or intolerances, or data relating to health (e.g. disability for the assignment of specific rooms).

Data is processed for the following purposes:

• Performance of a contract (Art. 6.1.b GDPR): managing the booking, welcome and provision of the requested services. No consent is required for this purpose.
• Legal obligation (Art. 6.1.c GDPR): registering and reporting guests’ details to the Police authority via the Alloggiati Web portal (art. 109 TULPS) and tax obligations.
• Marketing and newsletter (Consent, Art. 6.1.a GDPR): sending promotional communications after the stay. Optional purpose, requiring explicit and separate consent.
• Health data (Explicit consent): processing information on allergies or intolerances requires written and traceable consent.

Data is processed with electronic and manual tools, adopting appropriate technical and organisational security measures (encryption, profiled access, backups) to prevent data breaches or unauthorised access.

Identity documents: the property does not keep copies (scans or photocopies) of documents. These images are deleted immediately after the data is transmitted to the Police authority.

• Administrative and tax data: 10 years, as required by current legislation.
• Marketing data: a maximum of 24 months from the last stay, or until consent is withdrawn.
• Health data (allergies): deleted immediately at the end of the stay, unless consent is renewed.

Data may be communicated to:

• Public Security authorities (Police) and administrative/tax authorities.
• External data processors (management software/PMS provider, accountant, marketing agencies), following formal appointment.

The guest may exercise at any time the rights provided by the GDPR (arts. 15-22), including:

• Right of access, rectification and erasure (right to be forgotten).
• Right to restriction and objection to processing.
• Right to data portability.
• Right to lodge a complaint with the data protection authority.