INFORMATION ON THE PROCESSING OF PERSONAL DATA COLLECTED FROM THE INTERESTED PARTY – ART. 13 EU REGULATION 2016/679

Kind User and/or Client,
Pursuant to articles 13 and 14 of EU Regulation 2016/679 (GDPR), the following information is provided in order to make you aware of the characteristics and methods of processing your personal data

a) Identity and contact details of the Data Controller, of the Data Processors and of the Data Protection Officer

The Data Controller is Andhaus di Piras Enrico, based in Cagliari (CA), Via San Tommaso d’Aquino 18, Codice Fiscale PRSNRC94H21B354R and VAT number 03711410922, in the person of the head, Enrico Piras; owner of the website www.andhaus.it (hereinafter only the “Site”); certified email (PEC): andhaus.info@pec.it; email: andhaus.info@gmail.com

The person in charge of the treatment, for the achievement of the purposes indicated in the following paragraph c) is Enrico Piras. The Personal Data Protection Officer (DPO) pursuant to art. 37 GDPR is the owner Enrico Piras.

b) Type of data being processed

When contacting through the site, booking a stay, signing the contracts better described in the following par. c), different categories of personal data of the User and/or Client may be collected by Andhaus di Piras Enrico and/or third parties

The data that may be collected are the following: name; surname; place and date of birth; company name or name; email and phone number; Tax ID code; VAT number; residential address; identity documents (such as identity card or passport); navigation data or data relating to preferences collected during the use of the service or website by the User and/or Customer payment information, bank details; billing address; tax data; data relating to the property such as cadastral, contractual, insurance coverage, urban planning compliance data; photographs of the property; documentation and information relating to the legal and economic status of the property,; credentials of the Owner Client referable to access to portals or websites for the exchange of information relating to leases and/or the related authorizations (hereinafter only the “Personal Data”). With regard to information on the collection of data specifically referred to web browsing only and the deactivation of advertisements based on these internet tools, the User and/or Customer is invited to refer to the specific Cookies Policy available separately on the website www.andhaus.it.

c) Purpose and legal basis of the processing

The data is collected by voluntary provision by the User and/or Customer when he decides to contact the Andhaus di Piras Enrico company, through the contact form on the site or to finalize his stay reservation through the booking form , confirming your choice.

The data collected in this way is processed by Andhaus for the following purposes:

Reach for the stipulation of short-term tourist rental management contracts, in the interest of owners and give them subsequent execution, including the provision of services in the manner indicated in the relative contracts. To pursue these purposes, it is necessary to identify the User and/or Customer; contact him by telephone or in writing during the execution of the mandate; acquire data relating to the identification of the property (cadastral, mortgage, state of affairs; transfer the property data to websites – external OTA agencies (e.g., Booking.com, Vrbo Airbnb and similar) for advertising purposes; coordinate the collections of the leases and associated expenses; communicate these data to the counterparty interested in the tourist lease for the purpose of stipulating the contracts better indicated in point c2). The communication of the data to be processed for purposes related to the conclusion or execution of the contract or the execution of pre-contractual measures requested by the User and/or Customer is mandatory in order to reach the conclusion of the contract and/or to execute it . The legal basis of this treatment is the need to stipulate the contract or to subsequently execute it (see art. 6, paragraph 1, letter b GDPR).

Reach the stipulation, in the name and on behalf of the owners of short-term tourist leases towards those who intend to stay in the Andhaus property portfolio. To pursue these purposes, it is necessary to identify the User and/or Customer, contact them, coordinate their payments, report their collections based on the mandate received, manage any issue of tax documents; communicate such data to proprietary Users. The communication of the data to be processed for purposes related to the conclusion or execution of the contract or the execution of pre-contractual measures requested by the User and/or Customer is mandatory in order to reach the conclusion of the contract and/or to execute it. The legal basis of this treatment is the need to stipulate the contract or to subsequently execute it (see art. 6, paragraph 1, letter b GDPR). Individuals who will stay at one of the Andhaus properties will be required to identify themselves, and for these purposes the legal basis of this treatment is the fulfillment of a legal obligation, with particular reference to R.D. 18 June 1931, no. 773 (testo unico delle leggi di Pubblica sicurezza).

Fulfill legal obligations by communicating to the competent authorities data relating to tenants such as: i) sending data of Users and of the people they claim to host, to the Public Safety authorities, and through the Accommodation Portal of the competent Police Headquarters ; ii) sending the data of the Locations to the competent authorities for statistical and/or census purposes of the territory data (in particular, currently the SIRED system); iii) the sending of data relating to contracts stipulated in the form of Short-Term Leases to the Revenue Agency pursuant to art. 4, co. 4, Legislative Decree 50/17 converted by Law 96/17, as well as the inclusion of the Property in the database set up at the Ministry of Agricultural, Food, Forestry and Tourism Policies pursuant to art. 13 quater of the Legislative Decree 34/2019 converted into Law 58/19 for the purpose of attributing the Iun identification code. The communication of the data to be processed for this purpose is mandatory since it is a matter of compliance with a legal obligation. Failure to communicate the mandatory data will not allow the interested party to proceed with the completion of the procedure and the conclusion or execution of the contract. The legal basis of these treatments is the fulfillment of a legal obligation (see art. 6, paragraph 1, letter c GDPR).

Proceed with the profiling and tracking of Users’ preferences in order to increase or improve the functionality and quality of the website. The legal basis of this processing is the legitimate interest of the Data Controller (see art. art. 6, par. 1, letter f GDPR).

Send information for commercial promotion and marketing purposes to Users, even after the execution of contracts. These activities will be preceded by obtaining the express consent of the User and/or Customer to the processing of their data for these purposes. The legal basis of this treatment is the consent of the interested party (see art. 6, paragraph 1, letter a GDPR).

Further information regarding the purposes of the processing by the owner or third parties is provided in the dedicated sections of this information, as well as in the information on the individual services provided by third parties, which you are invited to consult below.

If the Data Controller intends to further process personal data for a purpose other than that for which they were collected, before this further processing the Data Controller will provide the interested party with information regarding this different purpose and any further pertinent information. Furthermore, the Data Controller will ensure that all other requirements necessary for the different purposes of the Processing are adapted.

d) Processing methods and security measures

The processing is carried out using IT and/or telematic tools, with organizational methods and with logic strictly related to the purposes indicated above. Upon uploading the data by the User and/or Customer, these will be archived in hybrid format by Andhaus on digital memory spaces or in paper format at the headquarters in Cagliari (CA), Via San Tommaso d’Aquino 18. The Data Controller adopts the appropriate security measures to prevent unauthorized access, disclosure, modification or destruction of personal data

e) Transfer of data to third parties

The data provided by Users who have confirmed a reservation may be transferred to the owners of the properties reporting the activities carried out by Andhaus, responsible for managing the tourist rentals at their properties. The data provided by proprietary Users, on the other hand, may be transferred, for the purpose of advertising and therefore the execution of contractual obligations, to platforms dedicated to tourist rental (e.g., Airbnb, Vrbo, and the like) and other tools chosen for carrying out the assignment. The execution of the contract with particular reference to the provision of Andhaus services, as indicated in the contracts, may also involve the transfer of data to third parties, such as external suppliers, as foreseen in the relative contract in order to fulfill the cleaning management requests and governance of the property by Users during their stay.

The essential elements of the lease contracts referred to in the previous par. c2 may be transferred to third-party public authorities (Revenue Agency, Sardinia Region, competent Prefecture and/or Police Headquarters, Municipality where the property is located) in order to comply with reporting obligations of a fiscal, administrative nature or otherwise required by law. Furthermore, some User data generated while browsing the Website may be transferred to third parties, to allow them to carry out services used by this Website.

f) Data retention period

The Data are processed and stored for the time required by the purposes for which they were collected and therefore: Personal Data collected for purposes related to the execution of a contract between the Owner and the User will be retained until the execution of this contract and in any case up to and no later than the period required by law for the purpose of keeping the accounting and non-accounting documentation for the exercise of the commercial business activity (10 years);

the Data collected with the consent of the interested User in order to provide commercial, promotional and marketing information, will be retained for a period not exceeding 36 months from the end of the contractual relationship. In this regard, Andhaus may consider the authorization to process such data implicitly confirmed if the receipt of communications is not followed by an explicit request for cancellation by the User with respect to such Data. The User is always guaranteed the right to revoke consent to this treatment. In case of withdrawal of consent, the Data provided by the User for this purpose will be deleted.

g) Rights of data subjects

The User has the right to:

revoke consent to treatment at any time. If the treatment is based on the User’s consent, he has the right to revoke the consent without prejudice to the lawfulness of the treatment based on the consent before the revocation;

oppose the processing of your data when it takes place on a legal basis other than consent. Further details on the right to object are indicated in par. f below;

access your Data, i.e. obtain information on the Data processed by the Data Controller, on certain aspects of the processing and receive a copy of the Data processed.

verify the correctness of your Data and request its rectification, updating or correction at any time;

obtain the limitation of treatment, recurring the conditions referred to in art. 18 GDPR, upon which the Data Controller will not process the data for any other purpose other than their conservation;

obtain the cancellation or removal of their Personal Data, recurring the conditions pursuant to art. 17 GDPR;

receive their data or have them transferred to another holder (right to data portability). The User has the right to receive their Data in a structured format, commonly used and readable by an automatic device and, where technically feasible, to obtain its transfer without obstacles to another holder. This provision is applicable when the data are processed with automated tools and the processing is based on the User’s consent, on a contract of which the User is a party or on contractual measures connected to it;

propose a complaint. The User can lodge a complaint with the competent personal data protection supervisory authority or take legal action.

h) Right to object

The User has the right to oppose the processing of his personal data, for reasons connected to his particular situation, where the processing is based on the need to perform a task of public interest or connected to the exercise of public powers of which the Data Controller is invested, or where the treatment is based on the public interest of the owner or third parties. The User also has the right to oppose the profiling carried out on the assumptions just indicated.

Furthermore, if personal data are processed for direct marketing purposes, the User has the right to object to this processing at any time, including the profiling carried out for these purposes.

Following the User’s opposition to the processing for direct marketing purposes, personal data will no longer be processed for these purposes.

Furthermore, the User has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or which significantly affects his person in a similar way. Certain derogatory hypotheses are reserved, such as the decision necessary for the conclusion or execution of a contract between the User and a Data Controller and the decision based on the explicit consent of the interested party.

i) Details on the right of access

Users have the right to obtain confirmation from the Owner as to whether or not personal data concerning them is being processed. Upon treatment in cursus, Users have the right to obtain access to their personal data and to the following information:

purpose of the treatment(s);

categories of personal data processed;

recipients or categories of recipients to whom the personal data have been or will be disclosed;

data retention period or criteria for determining this period;

existence of the User’s right to request the rectification or cancellation of personal data, or the limitation of the processing of personal data concerning him;

right to object to processing (where the right to object is provided);

right to portability.

The Data Controller is required to respond within 30 days from the date of receipt of the request, a term that can be extended up to 90 days

l) Right to complain

The User has the right to lodge a complaint with the supervisory authority and can contact: andhaus.info@gmail.com. For further information on the right to lodge a complaint, please consult the institutional website of the Privacy Guarantor: www.garanteprivacy.it.

5.12.2019

Last edit: 21.02.2023