PRIVACY POLICY
This Privacy Policy explains how Alcaeus collects and processes the personal data of users who request information, make a reservation, or stay at the property, in accordance with EU Regulation 2016/679 (“GDPR”) and applicable Italian law.
1. DATA CONTROLLER
The data controller is:
Operator/legal entity: Alcaeus
Registered address: Viale Tunisia 22, Milano, CAP 20124
VAT/tax number: IT13998860962
Email: [email protected]
Telephone: +971585089912
2. PERSONAL DATA WE PROCESS
We may process the following categories of data:
• first and last name, date and place of birth, nationality, and identity-document details;
• address, email address, and telephone number;
• reservation information, including arrival and departure dates, number of guests, selected accommodation, preferences, and special requests;
• billing and transaction information, including the amount and status of payments;
• communications exchanged with the guest;
• information required by public-security, tax, tourism, statistical, or other authorities; and
• essential technical data generated while using the booking system, such as the IP address, access date and time, and browser information.
Guests should not provide health information or other sensitive personal data unless it is necessary to meet a specific requirement relating to their stay.
3. PURPOSES AND LEGAL BASES
Personal data is processed for the following purposes:
A. Managing reservations and stays
To respond to enquiries, manage reservations, process payments, provide accommodation, and communicate with guests.
Legal basis: taking steps at the guest’s request before entering into a contract and performing the contract.
B. Compliance with legal obligations
To comply with public-security, guest-registration, tax, accounting, statistical, and tourism-reporting requirements.
Legal basis: compliance with a legal obligation.
C. Guest support and protection of legal rights
To respond to requests or complaints, prevent fraud and unlawful activity, protect people and property, recover unpaid amounts, and establish, exercise, or defend legal claims.
Legal basis: the data controller’s legitimate interests and, where applicable, compliance with legal obligations.
D. Special requests
Any health, dietary, accessibility, or other sensitive information voluntarily provided by a guest will be used only to manage that guest’s request. Explicit consent will be requested where required.
Reservation information is not used to send advertising communications under this Privacy Policy.
4. REQUIREMENT TO PROVIDE INFORMATION
Information identified as mandatory is necessary to complete the reservation, provide the service, and comply with legal requirements.
Failure to provide the required information may make it impossible for us to accept or fulfil the reservation.
5. HOW WE COLLECT INFORMATION
Personal data is normally collected directly from the guest. We may also receive it from:
• a person making a reservation on the guest’s behalf;
• a travel agency or booking platform;
• the provider of our booking system or property-management software; or
• a bank or payment-service provider.
Anyone providing another guest’s personal information confirms that they are authorized to do so and that the guest has been informed about this Privacy Policy.
6. PAYMENTS
Payments may be processed by external service providers. Alcaeus does not normally receive or store complete payment-card details.
We may receive limited information, such as the transaction amount and status, the payment-card network, and a partially masked card number.
7. RECIPIENTS OF PERSONAL DATA
Where necessary, personal data may be disclosed to:
• authorized employees and contractors;
• booking-system and property-management providers;
• banks and payment-service providers;
• accountants and invoicing-service providers;
• IT, hosting, security, and communications providers;
• advisers, insurers, and auditors; and
• public-security, tax, tourism, judicial, or other public authorities.
Service providers acting as data processors may use personal data only according to our instructions and for authorized purposes.
Alcaeus does not sell guests’ personal data.
8. INTERNATIONAL DATA TRANSFERS
Some service providers may process personal data outside the European Economic Area.
In such cases, we use a transfer mechanism recognized by the GDPR, such as a European Commission adequacy decision or Standard Contractual Clauses, together with any required additional safeguards.
9. DATA RETENTION
Personal data is retained only for as long as necessary for the purposes described in this Privacy Policy.
In particular:
• reservation information is retained for the period necessary to provide the service and manage possible disputes;
• tax and accounting records are normally retained for ten years;
• communications and complaint records are retained for [INSERT PERIOD, FOR EXAMPLE, 24 MONTHS]; and
• information required by public authorities is retained only for the period established or permitted by law.
Information may be retained for longer where necessary to fulfil a legal obligation or establish, exercise, or defend a legal claim. It will subsequently be deleted or anonymized.
10. SECURITY
We implement appropriate technical and organizational measures to protect personal data against loss, destruction, alteration, unauthorized disclosure, or unauthorized access.
Access is restricted to people and service providers who require the information for legitimate purposes.
11. YOUR RIGHTS
Subject to the conditions established by applicable law, you may request:
• access to your personal data;
• correction of inaccurate or incomplete information;
• deletion of your personal data;
• restriction of processing;
• data portability; and
• objection to processing based on legitimate interests.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise your rights, contact [PRIVACY EMAIL ADDRESS]. We may request information reasonably necessary to verify your identity.
12. RIGHT TO LODGE A COMPLAINT
You have the right to lodge a complaint with:
Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Rome, Italy
Website: [www.garanteprivacy.it](http://www.garanteprivacy.it)
You may also contact the supervisory authority in the European Union country where you normally live or work.
13. AUTOMATED DECISION-MAKING
Reservation information is not used to make decisions based solely on automated processing that produce legal or similarly significant effects.
14. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy if our services, legal obligations, or processing practices change.
The current version will be made available through our booking system and identified by the “Last updated” date shown above.