Privacy Policy

This page describes how the website processes the personal data of users consulting it. This policy is also provided pursuant to Article 13 of Regulation (EU) 2016/679 applicable from 25 May 2018 - General Data Protection Regulation (GDPR), to anyone using the web services of Hotel Savoia Genova Srl which may be accessed online at:
https://grandhotelsavoiagenova.it/
This policy is provided only for the website https://grandhotelsavoiagenova.it/ and not for any other websites that may be accessed by users via links for which Hotel Savoia Genova Srl accepts no liability.
DATA CONTROLLER 
Pursuant to Article 4(7) GDPR 2016/679, the Data Controller is Hotel Savoia Genova Srl, with its registered office at Via Arsenale di Terra 5 - 16126 Genoa.
When users click on the "Book now" button, they are redirected to the official website of Hilton Worldwide Holdings Inc. From then onwards, the personal data provided by users for the purposes of checking availability, making and managing a reservation, making a payment and joining loyalty schemes or other Hilton services are processed by Hilton as an independent data controller, as indicated in its privacy statement (https://www.hilton.com/en-gb/p/global-privacy-statement/).
DATA PROCESSORS 
Pursuant to Article 28 GDPR 2016/679, the Data Processor for technical assistance and website management activities is the web agency Relactions S.r.l., with its registered office at Via Taranto 21, 00182 Rome.
PLACE OF DATA PROCESSING
Data processing connected to the web services of this website takes place at the head offices of the data controller and the data processors. No data deriving from the web service is disclosed to third parties or published.
Since third-party cookies are used, data may also be processed outside the European Community by Google and companies installing third-party cookies. Please refer to the relevant Cookie Policy.
TYPES OF DATA PROCESSED
Browsing data
In the course of their normal operation, the computer systems and software procedures used to operate this website acquire personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects; however, by its very nature it might entail the identification of users through processing and association with data held by third parties. This category of data includes the IP addresses or domain names of computers used by users connecting to the website, the URI (Uniform Resource Identifier) of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.) and other parameters relating to users' operating system and computer environment. Such data is used only to obtain anonymous statistical information on website usage and to check its proper operation and is deleted immediately after processing. The data may be used to ascertain responsibility in the event of computer crimes against the website: except for this possibility, the data on web contacts is not kept for more than thirty days.
Data provided voluntarily by users
The optional, explicit and voluntary sending of emails to the addresses indicated on this website entails the subsequent acquisition of the sender's address, which is necessary to respond to the latter's requests, as well as any other personal data included in the message.
Data subjects are invited to read this privacy policy when filling in the data acquisition forms on the website.
PROCESSING METHODS
Personal data is processed using automated tools for the period of time required to fulfil the purposes for which it was collected. Specific security measures are taken to prevent the loss of data, its unlawful or improper use and unauthorised access.
PURPOSES, LEGAL BASIS AND TYPE OF DATA PROVIDED
The Personal Data provided on the Website will be processed by Hotel Savoia Genova Srl for the following purposes:
a)     to perform a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract (e.g. reservations, acceptance of special offers, contact requests, etc.). Consent Not Required. The legal basis is Article 6(1) (b) GDPR 2016/679, i.e. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
b)     for purposes related to subscribing to the company's newsletter. Consent Required The legal basis is the consent of the data subject in accordance with Article 6(1)(a) GDPR 2016/679
c)     to send promotional and marketing material via email as soft spam for contracted reservations. Consent Not Required The legal basis is the pursuit, under Article 6(1)(f) GDPR 2016/679, of a legitimate interest by the data controller, in accordance with Article 130(4) of Legislative Decree 196/2003;
d)     to evaluate job applications, acquiring candidates' CVs via email or through online job ads. Express consent is required. The legal basis is Article 111 bis of Legislative Decree 196/2003
e)      for possible profiling purposes, using third-party cookies; Consent required as per Cookie Policy. The legal basis is Article 6(1) (a) GDPR 2016/679 in accordance with Directive 2009/136/EC of 25 November 2009;
f)     for research and statistical analyses on anonymous aggregate data, aimed at monitoring website operation, measuring traffic and evaluating website usability and the possibility of making it more functional and performing; Consent not required as it does not involve the processing of personal data
g)     to comply with laws and regulations; Consent not Required The legal basis is Article 6(1) (c) GDPR 2016/679; 
h)      for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity. Consent not Required The legal basis is Article 6(1) (f) GDPR 2016/679, i.e. processing is necessary for the pursuit of a legitimate interest of the data controller;
CV MANAGEMENT 
We do not acquire CVs or personal data for recruitment purposes through the website in question; however, this section has been included in our privacy policy for any job search or ads on specialized portals in order to redirect the person concerned to the privacy policy in question.
Hotel Savoia Genova Srl may evaluate CVs received by email or through online job ads in accordance with this privacy policy. CVs deemed 'interesting' may be kept for up to 24 months, and will be processed in full compliance with the security measures set out in Regulation (EU) 2016/679.
At the end of this 24-month period, the CVs will be destroyed or the data subject may be contacted to provide an updated curriculum.
CVs will not be disclosed to third parties. In any case, please follow the following instructions when submitting your CV in electronic format:
•    fill in your curriculum vitae in the European format;
•    submit your CV in PDF format;
•    avoid including sensitive information, as defined by Article 9 of Regulation (EU) 2016/679, in your CV (in particular regarding your health, religious, philosophical or political beliefs) that is not relevant to the job offer;
•    consent to the processing of any sensitive data that may be relevant to your application (e.g. if you belong to a protected category under Law 68/99).
The Company will provide adequate privacy information pursuant to Article 13 of EU Regulation 2016/679 during any interviews with candidates.
The data in CVs will be processed for purposes strictly relating to staff evaluation, recruitment or selection for long- or short-term employment or work experiences, or to allow the selected candidate to prepare their degree thesis at our facilities.
TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS
The data controller undertakes to circulate and process personal data (e.g. to store, archive, save data on its servers) only in countries within the European Union and not to transfer it to non-EU countries that do not ensure (or where there is no) appropriate level of protection or where there are no protection measures provided for by Regulation (EU) 2016/679 - CHAPTER V (adequacy decision, Standard Contractual Clauses or the data subject's explicit consent) or where the EU-US Data Privacy Framework has not been endorsed.
COMMUNICATION OF PERSONAL DATA
The personal data acquired through this website may be communicated to:
•    public authorities or offices, in order to meet legal and/or contractual obligations;
•    Hilton Worldwide Holdings Inc., by accessing Hilton's booking platform;
•    data processors within the meaning of Article 28 GDPR (providers of IT technical support, data centres, consultants, providers of management services);
•    the web agency Relactions S.r.l., with its registered office at Via Taranto 21, 00182 Rome, for hosting and technical support on the website;
•    companies providing management and technical support for the IT infrastructure of Hotel Savoia Genova S.r.l.;
•    third parties managing profiling and analytics cookies, such as Google (according to the cookie policy);
•    service providers or consultants, where necessary to allow the data subject to access the hotel's services.
The data controller will provide an updated list of external data processors on request, pursuant to Article 28 GDPR 2016/679.
DATA STORAGE
Hotel Savoia Genova S.r.l. will process users' Personal Data for the time strictly necessary to achieve the purposes indicated in this policy and for as long as permitted by Italian law to protect their interests (Article 2947(1)(3) of the Civil Code).
Users will remain subscribed the company's newsletter until they unsubscribe, which can be done by simply clicking directly on the unsubscribe link in the email.

AUTOMATED PROCESSING
Hotel Savoia Genova Srl does not process data based on an automated decision-making process, including profiling, which produces legal effects or which may have a significant impact on anyone interacting with the website.
For details of the cookies installed by the external technology manager and their interaction with social networks, please refer to the website's Cookie Policy.
RIGHTS OF DATA SUBJECTS
Users may freely exercise the rights referred to in Articles 15 et seq. of GDPR 2016/679; namely, they may:
•    withdraw consent at any time. Users may withdraw consent to the processing of their Personal Data as expressed above;
•    object to the processing of their personal data. Users may object to the processing of their Data where processing is based on a legal ground other than consent;
•    access their Data. Users may obtain information on the Data processed by the Data Controller and on certain aspects of their processing, and receive a copy of the Data processed;
•    verify them and have them rectified. Users may verify the accuracy of their Data and request that it be updated or corrected;
•    ask for restriction of processing. When certain conditions are met, Users may obtain restriction of processing of their Data. In this case, the Data Controller will not process such Data for any purpose other than its storage;
•    obtain the erasure or removal of their Personal Data. When certain conditions are met, Users may have their Data erased by the Data Controller;
•    receive their Data or have it transferred to another data controller. Users may ask to receive their Data in a structured, commonly used and machine-readable format and, where technically feasible, transmit such data to another controller without hindrance. This provision is applicable where Data is processed by automated means and the processing is based on the User's consent, on a contract to which the User is a party or on contractual measures connected to it;
•    lodge a complaint. Users may lodge a complaint with the competent data protection authority or take legal action. 
HOW TO EXERCISE ONE'S RIGHTS
To exercise the aforesaid rights, the data subject may contact the company's management by sending an email to privacy@hotelsavoiagenova.it 
Data subjects may exercise their rights vis-à-vis Hilton International by sending an email to Hilton's Data Protection Officer: DataProtectionOffice@hilton.com
UPDATING AND REVISION
This privacy policy was updated on 24-06-2026 - Revision 4 and may be amended in the future