Privacy Policy

Last updated: 17th March 2020

1. How the website works

By means of the website www.giosrestaurantvenice.com (the “Site”), managed by CFH MILAN HOLDCO SRL (“The St. Regis Venice”), a hotel managed by Marriott International, the User accesses and may look through the exclusive services of The St. Regis Venice.

2. Privacy policy

This Privacy Policy describes the modalities and purposes through which The St. Regis Venice carries out the processing of its Users’ personal data (the “data”).

This Privacy Policy is provided to Users pursuant to and in compliance with Legislative Decree 196/03 – Personal Data Protection Code and subsequent amendments and additions (the “Privacy Code”), with the EU General Data Protection Regulation no. 2016/679 of 27 April 2016 (the “GDPR”) and with the Provisions issued by the Italian Data Protection Authority, as well as with the applicable European legislation.

This Privacy Policy refers only to the Site and the processing of personal data carried out by The St. Regis Venice, without any extension to the data processing operations carried out by other websites visited by the User by links, in relation to which The St. Regis Venice does not take on any responsibility.

3. Data controller

The Data Controller is CFH MILAN HOLDCO SRL, based in PIAZZA DELLA REPUBBLICA 20, 20124 MILANO (MI).

The data is mainly processed at the Data Controller’s premises, within the European Union and, with respect to services provided by third parties, also outside the European Union.

In case of transfer of the data in countries which do not ensure the standard of protection equivalent to Italy, The St. Regis Venice undertakes to adopt all the necessary measures to legitimize said transfer, as illustrated below.

4. Modalities of data processing

The data is processed mainly with electronic, computerized and automated means, for the period of time which is strictly necessary to seek the purposes for which it was collected.

The St. Regis Venice processes the data in compliance with the law, adopting adequate security measures able to prevent non-authorized accesses, dissemination, non-authorized alteration or destruction of the data.

5. Purposes of data processing

Users’ data will be processed exclusively for the following purposes:

a) Carry out statistics and analysis on anonymous and aggregate data relating to the User, which do not allow to identify the User directly, for the performance of statistical analysis, to improve technical assistance, for evolutionary maintenance of the platform and The St. Regis Venice services offered to the User, for the development of the Site contents, as well as to correct and develop research and analysis techniques;

b) Pursue the rights and legitimate interest of The St. Regis Venice and/or third parties (e.g. companies of the Group), for example the right to defend in court, the management of complaints and disputes, negotiations, the prevention of fraud and/or of illegal activities, etc. In these cases, even if the processing of the User’s data is not mandatory, it is still necessary as these data are strictly connected and instrumental to the pursuit of such legitimate interests, which do not prevail over the privacy rights of the User, and any opposition to the processing could make it impossible to provide the services requested;

c) Purposes connected to the execution of obligations provided by law, regulations, EU and national provisions, orders imposed by competent authorities, which represent the legal basis for the relevant processing operations.

6. Personal data undergoing processing

The St. Regis Venice receives and collects, through the Site, information related to the Users visiting its pages and using the services offered by the Site. In particular, The St. Regis Venice will collect and process the following information.

6.1 Web-browsing data

When the User browses through the Site, the latter collects certain information such as the pages visited, the links and/or buttons clicked by the User, the date and hour of the access, the User’s IP address, the browser used the operative system used (so called “web-browsing data”). Said data, for its nature, in certain cases could allow to identify the User, also by means of elaborations and connections with third party data. However, The St. Regis Venice uses said data exclusively to obtain statistical and anonymous information about the use of the Site, for purposes strictly related to the control of its correct running. The data may also be used for the ascertainment of liabilities in case of IT crimes in damage of the Site.

6.2 Data voluntarily provided by the User

The St. Regis Venice does not collect User’s data by external sources and limits to the minimum the collection of User’s personal data, exclusively in relation to the purposes illustrated above, meaning:

a) Bookings and reservations: through the Site The St. Regis Venice will not collect User’s personal data for bookings and reservations on its own, since the reservation will be processed by Marriott International on its platform: the User will click on the “reservation option” and will be directly addressed to the third-party web booking engine of Marriott International where the User can proceed with the reservations by inserting his/her personal data pursuant to Marriott International’s own Privacy Policy, that we invite the User to consult at the following link https://www.marriott.com/about/privacy.mi. The personal data related to the reservation will be then communicated by Marriott International to The St. Regis Venice in order to ensure the reservation;

b) Follow us on Twitter (or other social networks): through the Site the User, by voluntary clicking on the specific option, can decide to “follow” The St. Regis Venice on Twitter (or other social networks): in order to follow The St. Regis Venice, the User will click and will be addressed to the third-party social network, where the User can visit The St. Regis Venice profile and seek updates on its products and services, pursuant to the social network’s own Privacy Policy, that we invite the User to consult;

c) Other data voluntarily provided by the User: during the use of the services offered by the Site, the User may also provide The St. Regis Venice with other data, further to those indicated above, in order to receive additional information and/or services (e.g. by requesting information through the contact published on the Site, reporting disservices or dysfunctions on the Site, etc.). Said data will be processed by The St. Regis Venice exclusively for the purpose strictly related to the User’s request. The refusal to provide said data may affect the possibility, for the User, of receiving the service or information requested;

d) Sending of job applications: The User can send via e-mail to The St. Regis Venice his/her application to work in The St. Regis Venice through the contact section of the Site. To this end, The St. Regis Venice will acquire and use the information provided by the User through the spontaneous sending of the CV for the sole purpose of recruitment and managing applications. In any case, the User is asked not to include particular categories of data and/or sensitive data in his/her resume (such as relating to health, political opinions, sex life, etc.), except those strictly necessary for the purposes of complying with legal provisions (such as the belonging to protected categories). The St. Regis Venice will not take into account any excessive data that is not necessary for the aforementioned recruitment purposes.

7. Cookies

A cookie is a little file which a website sends to the browser and saves on the User’s computer when visiting a website. Cookies are used in order to allow or enhance the running of the website, but also to gain information on the Site or on the User’s web-browsing activities.

Generally speaking, the Site uses cookies both for technical purposes and for additional purposes: while technical cookies are used as strictly necessary to the correct running of the Site and to provide the User with the services expressly requested (e.g. language selection, etc.), as illustrated below, the cookies used for additional purposes (e.g. analytics cookies) are used in order to carry out analysis of the User’s behaviour on the Site, in order to develop the content of the Site in line with the preferences showed by the User during the web-browsing of the Site. The legal basis for the collection of data by means of cookies used for additional purposes is the User’s consent, provided by clicking on the informative banner displayed at the homepage/landing page to the Site

a) Technical cookies

These cookies are essential to allow the User to browse on the Site and use its functionalities, such as the access to reserved areas of the Site (cookie of authentication). The strictly necessary cookies are used to record a univocal identifier in order to manage and identify the User with respect to other Users visiting the Site in the same moment, providing the User with a consistent and precise service (e.g. the language selection). These cookies are necessary to the correct working of the Site and to record the choices expressed by the User, to distribute requests on different servers, to record when the User gives his/her authorization or expresses the consent to specific options (e.g. newsletters), to allow the User to visualize contents and video through Adobe Flash Player. These cookies, in particular, are:

Cookie	Provider	Domain	Duration
N/A	www.giosrestaurantvenice.com	www.giosrestaurantvenice.com	N/A

b) First Party Performance and Analytics Cookies

These cookies can be session cookies or persistent cookies and their use is limited to the performance and improvement of the Site. These cookies allow to recognize, measure and keep track of visitors to the Site, thus allowing the improvement of the Site, for example establishing whether the User is able to easily find the desired information, or by identifying which aspects of the Site are of major interest. These cookies are used by The St. Regis Venice to process statistical and anonymous analysis on how Users navigate on the Site, the overall number of pages visited or the number of clicks made on a page while browsing. These first party cookies are considered by the privacy legislation as equal to technical cookies, therefore they do not require the consent of the User.

These cookies, in particular, are:

Cookie	Provider	Domain	Duration
_ga	www.giosrestaurantvenice.com	www.giosrestaurantvenice.com	2 years
_gat_UA-154495669-1	www.giosrestaurantvenice.com	www.giosrestaurantvenice.com	1 day
_gid	www.giosrestaurantvenice.com	www.giosrestaurantvenice.com	1 day

c) Third Party Analytics Cookies

The St. Regis Venice may also use analytics and performance cookies from third parties on the Site, including those of Google Analytics, as indicated below. These cookies collect information on the ways in which the User uses the Site, including, for example, the pages visited by the User. Furthermore, third-party analytics cookies can track the use that Users make of the Site and allow The St. Regis Venice to make improvements to the Site by verifying, for example, whether the User is able to easily find the information sought or, again, identify the aspects of the Site that are most interesting. These cookies, with appropriate mechanisms to reduce the personal data collected (such as deletion of part of the User’s IP address) are used by The St. Regis Venice to process analysis and statistics, exclusively in anonymous mode, on how Users browse the Site, the number of pages visited and clicks made on a page during navigation. The St. Regis Venice treats the results of these analysis only if the third party uses cookies in connection with the browser installed on the computer or on other devices used by the User to browse the Site.

These cookies, in particular, are:

Cookie	Provider	Domain	Duration
_ga	www.giosrestaurantvenice.com	www.giosrestaurantvenice.com	2 years
_gat_UA-154495669-1	www.giosrestaurantvenice.com	www.giosrestaurantvenice.com	1 day
_gid	www.giosrestaurantvenice.com	www.giosrestaurantvenice.com	1 day

For information on how to manage analytics cookies installed by third parties, as well as to refuse them, we recommend consulting the Privacy Policy of these third parties and the options for disabling these cookies at the following links: https://tools.google.com/dlpage/gaoptout

d) How to disable cookies on the browser

Apart from the choice to accept or refuse the cookies used by the Site for additional purposes by means of the mechanism illustrated in this Privacy Policy, in the future the User may disable from the browser the cookies installed by the Site also by means of the setting of the same browser. The majority of web browsers are set to accept cookies. However, if so wished, the User may set his/her browser to limit the number of cookies accepted or to block all cookies, by changing the browser’s settings with the following procedures:

Microsoft Internet Explorer: Click “Tools” in the top right corner and select “Internet settings”. In the pop-up select “Privacy”: here the User may change the cookies settings.
Google Chrome: Click the “wrench” in the top right corner and select “Settings”. Then select “Show advanced settings” and change the “Privacy” settings.
Mozilla Firefox: In the top left menu select “Settings”. In the pop-up window select “Privacy”: here the User may change the cookies settings.
Safari: In the top right menu select “Preferences”. Then select “Security” and change the cookies settings.

In order to carry out such operation in the mobile telephone, please consult the handbook of the device.

Please be aware that by disabling all the cookies on the Site, certain functionalities of the Site may not be available.

e) Further information on cookies

The website www.allaboutcookies.org contains the instructions for the management of cookies of the most used browsers; alternatively, it is possible to consult the documentation related to the software used on the device.

8. Communication of data to third parties

The data provided by the User and those collected by the Site in the providing of the services (e.g. IP address) will not be disseminated and may be communicated, also abroad in Countries outside the EU, exclusively for the purposes and with the modalities above, to the following categories of entities:

collaborators, consultants, professionals, companies of the Group providing to The St. Regis Venice technical or organizational services (e.g. IT service providers), or collaborating with The St. Regis Venice, for the correct providing and execution of its services or for marketing activities;
persons, companies, professionals, companies of the Group providing assistance and advice to The St. Regis Venice, with particular but not exclusive reference to accounting, administrative, legal, tax and financial matters;
subjects and entities legitimated to access the data by law provisions or authorities’ order.

The subjects and entities indicated above will process the data in their quality as autonomous data controllers pursuant to applicable law or as data processors.

The list of names of the subjects to which the data are or may be communicated is available by contacting The St. Regis Venice at the address indicated in part. “Contacts and Users’ rights”.

9. Data Retention

User’s personal data are mainly processed with electronic, telematics and automated tools for the time necessary to achieve the purposes for which they were collected. User’s personal data are stored by The St. Regis Venice for the time necessary to perform the requested service, as well as after the termination of such execution for the fulfillment of the obligations and statutory limitation periods connected to the provision of The St. Regis Venice services and for aggregate analysis activities, pursuit of legitimate interests, legal obligations indicated above. Based on the general criteria for determining the data retention period indicated herein, please note that the Company shall identify specific data retention periods for each processing carried out through the website (e.g. collection of online job application).

10. Contact and Users’ Rights

The User may exercise, in the cases expressly provided for by law and where applicable, the rights provided for by the GDPR. In particular, the User has the right to request:

confirmation that his/her personal data are processed and, in this case, to ask the data controller for access to information relating to the relevant data processing (e.g. purposes, categories of data processed, recipients or categories of recipients of data, data retention period, etc.);
the rectification of inaccurate or incomplete data;
the cancellation of the data (e.g. if the personal data are no longer necessary with respect to the purposes for which they were collected, in the event of withdrawal of the consent on which the processing is based, etc.);
the limitation of the processing (e.g. in case of dispute by the User on the accuracy of the data; if the processing is unlawful and the same opposes the cancellation of personal data; if the data are necessary for the exercise or defense in court of a right of the User, even if the owner no longer needs it; in case of exercise of the right of opposition, for the time necessary to verify the existence of legitimate reasons);
in a structured, commonly used and machine-readable format, the personal data concerning him and to transmit them to another owner, or to obtain direct transmission from one data controller to another, if technically feasible (so-called “data portability”).

The User also has the right to object, in whole or in part, for legitimate reasons, to the processing of his/her personal data.

The rights listed above may be exercised by means of the specific functions available on the Site, or of the links inserted in the email, or by sending an email to the following address: Rocco.Butta@stregis.com

Finally, if the User believes that the processing of his/her personal data through the Site is in violation of the provisions of the GDPR and the applicable legislation on the protection of personal data, the User has the right to lodge a complaint with the Guarantor Authority for the protection of personal data (www.garanteprivacy.it), as provided for in art. 77 of the GDPR or to refer the case to the judicial authorities (art. 79 of the GDPR).

11. Amendments to the Privacy Policy

The St. Regis Venice may amend, from time to time, this Privacy Policy, by publishing the amendments on the Site. We invite Users to check periodically such updates.

In case the amendments are particularly meaningful, The St. Regis Venice may communicate them to the User by means of a different channel (e.g. by sending an email).