Privacy

Privacy Policy and Cookie Information

This website uses cookies and processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable data protection legislation.

1. Data Controller

The Data Controller is Andreatta Sport Snc di Andreatta Gianfranco e CO.
Via Klavenz 54b, 39052 Caldaro (BZ), South Tyrol, Italy
VAT: 01463760213 | Email: [email protected] | Tel: +39 0471 961165

2. Types of Data Collected

Data collected includes browsing data, IP addresses, timestamps, and information voluntarily submitted through inquiry and contact forms (name, email address, phone number).

3. Use of Cookies

This website uses:

  • Technical Cookies: Strictly necessary for the proper functioning and security of the website.
  • Analytics Cookies (Google Analytics): Used to gather aggregate, anonymized statistics about traffic.
  • Marketing Cookies: Activated only upon the user's explicit consent given via the cookie banner.

4. User Rights

You have the right to access, rectify, delete, restrict, or object to the processing of your personal data at any time. Requests can be sent directly to [email protected].

Privacy Policy pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

This policy explains how personal data is processed on the portal TopHotelAltoAdige.it, with particular regard to the contact forms, hotel inquiry forms (single and multi-hotel destination inquiries), and newsletter subscriptions.

1. Data Controller

The Data Controller is:
Andreatta Sport Snc di Andreatta Gianfranco e CO.
Via Klavenz 54b, 39052 Caldaro sulla Strada del Vino (BZ), South Tyrol, Italy
VAT / Fiscal Code: 01463760213
Telephone: +39 0471 961165 | Mobile: +39 347 6076720
Privacy Contact Email: [email protected]

2. Types of Personal Data Collected

  • Data collected via Contact & Booking Inquiry Forms (Single & Area Multi-inquiry): First and last name, email address, telephone number (optional), requested check-in and check-out dates, number of guests (adults and children with indicative age), preferred board and room type, and any optional requests or notes submitted in the message area.
  • Newsletter Subscription Data: Email address and consent timestamp.
  • Navigation and Log Data: IP addresses, request timestamps, requested URI resources, HTTP response codes, browser type, and operating system.
  • Cookies and Tracking Technologies: Strictly necessary technical cookies, plus analytics and marketing cookies subject to prior user consent (see Cookie Policy).
Important Notice on Special Categories of Data (Art. 9 GDPR):
Users are advised not to include sensitive personal data (e.g., health status, religious beliefs) in message fields unless strictly required for hotel accommodation arrangements (such as food allergies, mobility accessibility). Submitting such details constitutes explicit consent for transmission to the selected hotel for accommodation purposes only.

3. Purposes and Legal Bases for Processing

Processing Purpose Legal Basis (GDPR) Retention Period
Handling inquiries and quotes: Responding to user requests and providing customized hotel quotes in South Tyrol. Art. 6(1)(b) GDPR (Performance of pre-contractual measures taken at the request of the data subject). Up to 12 months after processing the request, unless a booking contract is concluded.
Forwarding to partner hotels: Transmitting the inquiry to the requested hotel (or regional partner hotels). Art. 6(1)(b) GDPR (Pre-contractual measures requested by the user). Subject to the respective hotel's data retention policy as an autonomous Data Controller.
Newsletter subscription: Periodic newsletters with travel deals, events, and vacation tips from South Tyrol. Art. 6(1)(a) GDPR (Explicit, freely given consent via unchecked checkbox). Until consent is withdrawn (one-click unsubscribe link in every email).
Site security, spam prevention (reCAPTCHA) & legal defense: Protecting server infrastructure and asserting legal claims. Art. 6(1)(f) GDPR (Legitimate interest in cybersecurity) and Art. 6(1)(c) GDPR (Legal obligations). Technical logs up to 30 days; security incident records until resolution.

4. Nature of Provision and Consequences of Refusal

Providing data marked as required in inquiry forms (name, email, dates) is strictly necessary to formulate a response and provide the requested quote. Failure to supply these fields will make it technically impossible to process your request.
Optional fields (e.g., telephone number or notes) assist in personalizing the offer but are not mandatory.
Consent for promotional newsletters is entirely voluntary and does not affect your ability to send inquiry requests.

5. Data Recipients and Autonomous Hotel Controllers

Personal data will not be disseminated or sold to third parties for independent marketing. Data may be shared with:

  • Partner Accommodation Facilities (Hotels): The specific hotel selected, or partner hotels in the destination area chosen in multi-inquiries. The hotel processes data as an autonomous Data Controller under its own privacy terms.
  • Technical Service Providers (Data Processors, Art. 28 GDPR): Web hosting providers (EU datacenter), technical maintenance engineers, and SMTP delivery services under strict contractual confidentiality obligations.
  • Public Authorities: Strictly where mandated by applicable law.

6. International Data Transfers

Data is stored primarily on servers located within the European Union. Where third-party services are utilized (such as Google Analytics with anonymized IP, Google reCAPTCHA), transfers to the United States occur in compliance with the EU-U.S. Data Privacy Framework or European Commission Standard Contractual Clauses (SCC).

7. Data Subject Rights (Articles 15–22 GDPR)

Under the GDPR, you have the right to request:

  • Access (Art. 15 GDPR) to your personal data;
  • Rectification (Art. 16 GDPR) of inaccurate or incomplete data;
  • Erasure (Art. 17 GDPR) ("Right to be Forgotten");
  • Restriction of processing (Art. 18 GDPR);
  • Data portability (Art. 20 GDPR) in a structured, machine-readable format;
  • Objection (Art. 21 GDPR) to processing based on legitimate interests;
  • Withdrawal of consent (Art. 7(3) GDPR) at any time without affecting prior lawful processing.

To exercise your rights, please email: [email protected]. Your request will be addressed free of charge within 30 days.

8. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

If you believe that your personal data is being processed in breach of the GDPR, you have the right to lodge a complaint with the competent supervisory authority:
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Rome, Italy | Web: www.garanteprivacy.it | Email: [email protected]
Alternatively, you may contact the data protection authority of your EU country of habitual residence or workplace.