Feel Welcome

Dear User,

On this page you will find information explaining the management of your personal data through our website. We are providing this information not only to fulfill our legal obligations regarding the protection of personal data under Regulation (EU) 2016/679 (“the Regulation”), but also because we believe that the protection of personal data is a core value of our business activities and we want to provide you with any and all information that can help you protect your privacy and control how your data are used in relation to your browsing experience on our site.

Data Controller and Contacts

The Data Controller is Xenia Hôtellerie Solution S.p.A. Società Benefit, with registered office in Guardiagrele (Chieti), Via Antonio Gramsci 79, VAT no. and tax code 01691390692.
Contact: privacy@xeniahs.com

Data Protection Officer (“DPO”)

Contact the DPO at: dataprotection@sintab.it or certified email dataprotection@pec.it.

Purpose of the Processing, Data Processed, Legal Bases, Mandatory Provision of Data, Storage Period

Site viewing and navigation

• Purpose: Enable navigation and ascertain liability in case of cybercrime.
• Data processed: IP, domain names, URLs, browsing data.
• Legal basis: Legitimate interest (Art. 6(2)(f) GDPR).
• Mandatory: Yes.
• Storage: Technical logs during session.

Site analytics

• Purpose: Anonymous statistical analysis.
• Legal basis: Outside GDPR scope (anonymized).
• Mandatory: Yes.
• Tool used: Google Analytics 4.

Reservation management

• Purpose: Manage reservations and related requests.
• Data: Identifying and contact data.
• Legal basis: Contractual necessity (Art. 6(1)(b)).
• Mandatory: Yes.
• Storage: 10 years (legal obligations).

Assistance on purchased services and products

• Purpose: Provide assistance and resolve issues.
• Legal basis: Contractual necessity (Art. 6(1)(b)).
• Mandatory: Yes.
• Storage: 5 years from last interaction.

User request form management – Contacts

• Purpose: Respond to direct user requests.
• Legal basis: Contractual necessity (Art. 6(1)(b)).
• Mandatory: Yes.
• Storage: Data erased once request is fulfilled.

Recruitment – Management of candidacies

• Purpose: Evaluate candidacies for employment or collaboration.
• Legal basis: Contractual necessity (Art. 6(1)(b)).
• Mandatory: Yes.
• Storage: 12 months (or duration of employment).

Newsletter subscription – Direct marketing

• Purpose: Send promotional materials, newsletters, conduct research.
• Data: Email address.
• Legal basis: Consent (Art. 6(1)(a)).
• Mandatory: Optional.
• Storage: 24 months.

Ascertainment, exercise, and/or defense of a right

• Purpose: Legal defense and exercise of rights.
• Legal basis: Legitimate interest (Art. 6(1)(f)).
• Storage: 10 years.

Data Recipients

Data are processed by authorized personnel or appointed Data Processors according to Art. 28 GDPR. The updated list is available from the Data Controller.

Method and Place of Processing

Data are processed in Europe, mainly by automated means. Security measures are in place to prevent data loss or unauthorized access.

Cookie Policy

For more info, see the Cookie Policy on our website.

Rights of the Data Subject

You can write to privacy@xeniahs.com to exercise your rights under the GDPR:

1. Right of access – obtain a copy of your data and info about the processing.
2. Right to rectification – correct or complete your data.
3. Right to erasure – when data are no longer necessary.
4. Right to restriction – in certain cases such as dispute over accuracy.
5. Right to portability – receive or transfer your data.
6. Right to withdraw consent – at any time.
7. Right to object – to legitimate interest-based processing.

You also have the right to lodge a complaint with the relevant Data Protection Authority.

We reserve the right to periodically update this policy. Please check regularly for any updates.