Privacy Policy – Szent István Ház

PRIVACY NOTICE FOR GUESTS

Information on the Processing of Personal Data

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), the Foundation of Worship and Religion Santo Stefano d’Ungheria, acting as Data Controller, informs guests that the personal data collected in connection with accommodation and related services provided by Casa per Ferie Santo Stefano d’Ungheria (Saint Stephen House) will be processed in accordance with the terms set out below.

1. Data Controller

FONDAZIONE DI CULTO E DI RELIGIONE SANTO STEFANO D’UNGHERIA
CASA PER FERIE SANTO STEFANO D’UNGHERIA

Registered and operational office:
Via del Casaletto 481
00151 Rome, Italy

2. Categories of Personal Data Processed

The following categories of personal data may be processed:

Personal identification and contact data of the Guest, such as name, surname, identity document details, e-mail address, telephone number, etc., provided during the booking process or upon check-in;
Special categories of personal data necessary for the provision of services, particularly information relating to health conditions that may be relevant to accommodation services (including allergies, food intolerances, etc.);
Documentation submitted for exemption from the tourist tax, which may include information concerning the guest’s general health status;
Images recorded by the video surveillance system for security purposes, the protection of the Foundation’s assets, deterrence of unlawful conduct, and prevention of vandalism.

3. Purpose and Legal Basis of Processing

Personal data are collected and processed for the following purposes:

1. Reservation Management

To process booking requests and manage accommodation reservations.

Legal basis: Performance of pre-contractual and contractual obligations.
Provision of the required data is necessary for the booking service.

2. Provision of Accommodation Services

To provide accommodation and related hospitality services.

Legal basis: Performance of a contract.
Provision of the required data is necessary for the service.

3. Administrative and Accounting Purposes

For administrative, financial, and accounting management related to the accommodation service.

Legal basis: Performance of contractual and legal obligations.

4. Compliance with Legal Obligations

To comply with applicable laws and regulations, including obligations imposed by public authorities and supervisory bodies, particularly those concerning the communication of guest information to public security authorities.

Legal basis: Legal obligation.

5. Protection of the Data Controller’s Rights

For the establishment, exercise, or defense of legal claims.

Legal basis: Legitimate interest and legal obligations.

6. Video Surveillance

To ensure security and protect persons and property.

Legal basis: Legitimate interest of the Data Controller.

Appropriate signs inform guests of the presence of video surveillance systems.

7. Receipt of Messages and Telephone Calls

To receive and forward messages or telephone calls addressed to guests during their stay.

Legal basis: Consent of the data subject.

Consent is voluntary and may be withdrawn at any time.

8. Information and Promotional Communications

To inform guests about rates, offers, services, activities, and projects supported by the Foundation, including through newsletters and promotional communications.

Legal basis: Consent of the data subject.

Consent is voluntary and may be withdrawn at any time.

Personal data will be processed in accordance with the principles of lawfulness, fairness, transparency, confidentiality, and protection of the rights of the Guest. Data will be retained for the duration of the stay and, where necessary, thereafter to comply with legal obligations.

4. Methods of Processing

Personal data may be subject to collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, communication, deletion, and destruction.

Processing may be carried out by automated means using electronic systems as well as manually using paper records, in compliance with applicable security and confidentiality requirements.

5. Place of Processing

Data are processed and stored at:

The registered office of the Foundation;
The operational premises of Casa per Ferie Santo Stefano d’Ungheria.

Data may also be processed on behalf of the Data Controller by professionals and service providers responsible for technical, consulting, software development, management, administrative, and accounting activities.

6. Recipients of Personal Data

Personal data may be accessed by:

Employees and collaborators of the Data Controller who are authorized to process data;
External service providers acting as Data Processors (such as banks, accountants, consultants, insurance companies, IT providers, etc.);
Public authorities, supervisory bodies, and law enforcement agencies where disclosure is required by law.

Personal data will not be publicly disclosed by the Foundation.

7. Data Retention Period

Accounting and administrative data: retained for 10 years, in accordance with applicable legal requirements;
Documents submitted for exemption from tourist tax: retained only for the period necessary to comply with legal obligations;
Data concerning allergies and food intolerances: retained only for the duration of the Guest’s stay;
Data processed for marketing purposes: retained until consent is withdrawn;
Video surveillance recordings: retained in accordance with applicable legislation.

8. Transfer of Data Abroad

The Data Controller declares that personal data are not transferred to third countries or international organizations.

9. Automated Decision-Making

No automated decision-making processes, including profiling, are applied.

10. Rights of the Data Subject

Under Articles 15–22 of the GDPR, the data subject has the right to:

Access their personal data;
Request rectification of inaccurate data;
Request erasure of personal data where applicable;
Request restriction of processing;
Object to processing where applicable;
Receive personal data in a structured, commonly used, and machine-readable format and transmit such data to another controller (data portability);
Not be subject to decisions based solely on automated processing;
Lodge a complaint with the competent Data Protection Authority.

The exercise of these rights is free of charge.

11. Exercising Your Rights

Requests concerning the exercise of the above rights may be submitted in writing to: