Owner of the page:
Rifugio Sennes SNC d. Palfrader Moritz & C.
39030 – St. Vigil in Enneberg
Telefon: +39 0474 646355
E-Mail: info@sennes.com
PEC: rifugio.sennes@pec.rolmail.net
REA: BZ-126554
MwSt: 00749160214
Project and programmation:
Trendstudio GmbH
Andreas-Hofer-Straße 5
39100 Bozen
Telefon: +39 0471 975 124
info@trendstudio.it
www.trendstudio.it
MwSt: 03011630211
Links:
All external links were checked for possible legal infringements at the time the links were established. We assume no responsibility for these links. The content of this website is protected and may not be copied without permission.
Images:
© Sennes Hütte
1. Privacy Policy
This Privacy Policy provides information pursuant to Regulation (EU) 2016/679 (“General Data Protection Regulation” or “GDPR”), Italian Legislative Decree No. 196/2003 as amended by Legislative Decree No. 101/2018, and other applicable Italian data protection rules concerning the processing of personal data when visiting and using www.sennes.com.
2. Data Controller
The controller responsible for the processing of personal data is:
Rifugio Sennes SNC d. Palfrader Moritz & C.
39030 San Vigilio di Marebbe, Italy
Telephone: +39 0474 646355
Email: info@sennes.com
Certified email address (PEC): rifugio.sennes@pec.rolmail.net
REA: BZ-126554
VAT number: 00749160214
3. Data Protection Officer
The controller has not appointed a Data Protection Officer because, considering the current nature and scale of the processing activities, there is no statutory obligation to make such an appointment. Privacy-related enquiries may be sent directly to the contact details provided under section 2.
4. Purposes of Processing
Personal data may be processed for the following purposes:
a) providing, operating and technically securing the website;
b) detecting and preventing attacks, misuse, fraud and technical faults;
c) handling contact, information, quotation and reservation enquiries;
d) communicating with prospective guests, guests and contractual partners;
e) taking pre-contractual steps and performing contracts;
f) statistically analysing website use after consent has been provided;
g) displaying external maps, weather information and, where applicable, external webcam content after consent;
h) managing and documenting cookie preferences;
i) complying with legal, tax, accounting and administrative obligations;
j) processing voluntary deposits through an external payment provider;
k) issuing and administering a digital Guest Pass where applicable;
l) establishing, exercising or defending legal claims.
5. Categories of Personal Data
Depending on how the website is used, the following data may be processed:
a) technical access data, including IP address, date and time, requested page or file, referring URL, browser type and version, operating system, device type, language and technical status information;
b) contact details, including first name, surname, email address and telephone number;
c) enquiry and reservation details, including requested arrival and departure dates, message content and other information provided voluntarily;
d) consent information, including selected cookie categories, time of the decision and a technical consent identifier;
e) usage and analytics data, including page views, events, approximate region, device and browser information and website interactions;
f) contractual, transaction, payment and billing information;
g) identification and stay information required for the Guest Pass;
h) the contents of correspondence by email, telephone or certified email.
Please do not submit special categories of personal data within the meaning of Article 9 GDPR through publicly accessible forms unless strictly necessary.
6. Legal Bases
Depending on the relevant processing operation, processing is based on:
a) Article 6(1)(b) GDPR where processing is necessary to handle an enquiry, take pre-contractual steps or perform a contract;
b) Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation;
c) Article 6(1)(f) GDPR for the secure, stable and efficient operation of the website, IT security, prevention of misuse, ordinary business communication and the establishment or defence of claims;
d) Article 6(1)(a) GDPR and the applicable Italian rules governing access to or storage of information on a user’s device for analytics, maps, weather, external media and other non-essential services.
7. Retention Periods
Personal data is retained only for as long as necessary for the relevant purpose or as required by law.
a) Server logs are generally erased after a short period unless longer retention is required to investigate a security incident.
b) Contact and enquiry data is retained until the enquiry has been dealt with and subsequently for as long as necessary for follow-up questions, evidence of the communication or the establishment and defence of claims.
c) Reservation, contractual and payment information is retained for the duration of the relationship and thereafter in accordance with applicable civil, commercial, accounting and tax retention requirements. Tax and accounting documents are generally retained for up to ten years unless a longer period or pending proceeding applies.
d) Records of consent are retained for the duration of the consent and for an appropriate period thereafter in order to demonstrate compliance.
e) Google Analytics event data is configured to be retained for two months and user data for fourteen months.
f) Guest Pass information is retained in accordance with applicable requirements and the privacy notices of the respective independent controllers.
8. Recipients and Categories of Recipients
Where necessary, personal data may be disclosed to:
a) hosting, IT, maintenance, web development and security providers;
b) providers of analytics, map, weather, consent-management and external-content services;
c) payment providers, banks and billing service providers;
d) accountants, tax advisers, lawyers and other professional advisers subject to confidentiality obligations;
e) public authorities, courts and supervisory authorities where required by law;
f) the Mobility Consortium and other bodies involved in issuing and administering the Guest Pass;
g) employees and authorised persons who process data solely within the scope of their duties.
Processors are bound by an agreement pursuant to Article 28 GDPR where required. Personal data is not disclosed to third parties for their own advertising purposes.
9. International Data Transfers
The use of international providers, particularly providers such as Google or Stripe, may involve processing outside the European Economic Area or access to data by authorities in third countries.
Where personal data is transferred to a third country, the transfer is based on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the relevant recipient is validly certified, or on appropriate safeguards pursuant to Article 46 GDPR, particularly the European Commission’s Standard Contractual Clauses. Supplementary safeguards are considered where necessary. Where neither an adequacy decision nor appropriate safeguards are available, transfers take place only under the conditions of Article 49 GDPR.
10. Hosting and Server Log Files
The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When the website is accessed, information is automatically processed in server log files. This includes, in particular, the IP address, date and time of the request, requested page or file, browser type, operating system, referring URL and technical status information.
This processing is necessary to provide the website, ensure security and stability and analyse technical errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website. Log files are generally erased after a short period unless security-related analysis or statutory retention is required.
11. Content Delivery, Security and Technical Logging Services
Where technical delivery, security, backup or maintenance services are used for individual website components, these providers may process IP addresses, technical communication data and log information. Processing is carried out to provide the website securely and efficiently on the basis of Article 6(1)(f) GDPR. Non-essential external content is loaded only after consent.
12. Cookies and Consent Management
The website uses cookies and similar storage or access technologies. Cookies are small pieces of information stored in the browser or on the user’s device and may be read during a later visit.
Strictly necessary cookies are required to provide the website, essential functions, security settings and the storage of cookie preferences. They are not used for behaviour-based advertising or cross-service profiling. Their use is based on technical necessity and, where personal data is processed, Article 6(1)(f) GDPR.
Analytics, marketing and profiling cookies and similar technologies may be used to measure user behaviour, recognise users or devices, create interest profiles, customise content or integrate external services. Such technologies are activated only after prior, freely given, specific and unambiguous consent. The legal basis is Article 6(1)(a) GDPR.
When the website is first visited, all non-essential categories are disabled by default. Refusing consent does not prevent use of the website’s essential functions. Preferences can be changed or withdrawn at any time through the cookie settings available on the website.
13. Google Analytics
Subject to your consent, this website uses Google Analytics, a web analytics service provided by Google. For users in the European Economic Area, the provider is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC and other Google entities may also be involved in providing the service.
Google Analytics enables statistical analysis of website use. The data processed may include IP address, device and browser information, approximate region, pages visited, visit duration, referral source, session information, technical identifiers and triggered events.
The legal basis is consent pursuant to Article 6(1)(a) GDPR. Google Analytics is activated only after consent has been provided through the cookie banner. The configured retention period is two months for event data and fourteen months for user data. Individual cookies may have different technical lifetimes.
Consent can be withdrawn at any time through the cookie settings. Cookies can also be deleted or blocked through the browser. Google additionally provides a browser add-on for disabling Google Analytics.
14. Google Maps
The website may embed maps provided by Google Maps. The provider in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Maps are loaded only after consent has been provided or the relevant map has been deliberately activated.
When Google Maps is loaded, the IP address, browser and device information, location information, the page visited, technical identifiers and interactions with the map may be transmitted to Google. Where the user is signed in to a Google account, Google may associate the information with that account.
The legal basis is consent pursuant to Article 6(1)(a) GDPR. Retention is primarily determined by Google. Consent can be withdrawn through the cookie settings and previously stored cookies can be deleted through the browser.
15. Weather Widget
The website embeds a weather widget that provides current weather information. The widget is loaded only after explicit consent. When it is loaded, the weather provider and its technical service providers may receive the IP address, browser and device information, date and time, the page visited and technical identifiers.
The legal basis is Article 6(1)(a) GDPR. The retention period depends on the configuration and privacy policy of the weather provider identified in the consent manager. Consent can be withdrawn at any time through the cookie settings. Without consent, the widget is not loaded and the other website content generally remains available.
16. Webcam
The website displays webcam images of the surrounding area. Where the images are delivered directly from our own server, only the usual technical access data associated with hosting is processed. Where an external webcam, streaming or image provider is used, that provider is loaded only after consent.
When external content is loaded, the IP address, browser and device information, date and time, page visited and technical identifiers may be transmitted to the provider. The legal basis for the external integration is Article 6(1)(a) GDPR. The retention period is determined by the respective provider. Consent can be withdrawn through the cookie settings.
17. Locally Hosted Google Fonts
The Google fonts used on this website are stored locally on the website’s own server. No connection to Google servers is established for the purpose of loading the fonts, and no personal data relating to font display is transmitted to Google.
18. Contact Form, Enquiries and Reservations
The contact form can be used to submit contact, quotation or reservation enquiries. The data processed includes first name, surname, email address, optional telephone number, requested arrival and departure dates and the content of the message. Google reCAPTCHA is not used in the contact form.
Processing is carried out to handle the enquiry, communicate with the user and, where applicable, take pre-contractual steps or perform a contract pursuant to Article 6(1)(b) GDPR. Where an enquiry is unrelated to a contract, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the proper handling of incoming communications.
Mandatory fields are required in order to assign and respond to an enquiry. Without the required details, the enquiry may not be processed.
19. Contact by Email, Telephone or Certified Email
Where you contact us by email, telephone or certified email, the contact information and content provided are processed in order to handle the matter. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual communication and Article 6(1)(f) GDPR in other cases.
20. Deposits and Stripe Payment Links
The website contains external links to Stripe payment pages through which a deposit may be paid after a reservation has been confirmed. The service is opened only when the user deliberately selects the relevant link. For users in the European Economic Area, the provider is generally Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
Stripe may process the user’s name, email address, billing and payment information, amount, currency, IP address, device information, transaction details and fraud-prevention information. Full card information is generally processed directly by Stripe and is not transmitted to us in full.
The legal basis is Article 6(1)(b) GDPR. Security and fraud-prevention processing may additionally be based on legitimate interests pursuant to Article 6(1)(f) GDPR. Stripe acts as an independent controller for certain processing operations. Retention is determined by statutory requirements and Stripe’s privacy policy.
21. Digital Guest Pass
Where a digital Guest Pass is issued in connection with a stay, the personal data required for that purpose is transmitted to the central Guest Pass coordination body in order to create and administer the Guest Pass and provide the related services.
The required data is transmitted to the Mobility Consortium with VAT number 02735170215. As the guest-card operator and central coordination body, the Mobility Consortium acts as an independent controller for its own processing. Further information may be requested at privacy@moko.bz.it.
The legal basis is Article 6(1)(b) GDPR where the Guest Pass forms part of the booked service or is provided at the guest’s request. Article 6(1)(c) GDPR applies where statutory reporting or documentation obligations exist.
22. External Links
The website contains links to third-party websites and services. Merely displaying a link does not generally result in personal data being transmitted to the linked provider. When a user selects an external link, the user leaves our website and the privacy terms of the respective provider apply. The provider is responsible for its own processing.
23. Newsletter and Promotional Communications
No newsletter service is offered through this website. Personal data is not processed for the regular distribution of newsletters. Information or offers are sent only in response to a specific enquiry, in connection with an existing business relationship or on the basis of separate consent.
24. Requirement to Provide Data and Consequences of Non-Provision
Providing personal data is generally voluntary. Certain information is, however, required to handle an enquiry, enter into or perform a contract, process a payment, issue a Guest Pass or comply with legal obligations. Failure to provide required information may mean that the enquiry, reservation, payment or service cannot be processed.
Consent to analytics, maps, weather or external media is voluntary and is not required for the basic use of the website. Without consent, only the relevant additional content or functionality will be unavailable.
25. Automated Decision-Making and Profiling
The controller does not make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them.
Subject to consent, Google Analytics may statistically analyse usage data and create technical or usage-based groups. The controller does not carry out its own profiling that produces significant legal effects.
26. Data Subject Rights
Subject to the applicable legal requirements, users have the following rights:
a) the right of access under Article 15 GDPR;
b) the right to rectification under Article 16 GDPR;
c) the right to erasure under Article 17 GDPR;
d) the right to restriction of processing under Article 18 GDPR;
e) the right to data portability under Article 20 GDPR;
f) the right to object under Article 21 GDPR;
g) the right not to be subject to a solely automated decision under Article 22 GDPR;
h) the right to withdraw consent under Article 7(3) GDPR.
Requests may be sent to info@sennes.com or to the other contact details provided under section 2. Suitable proof of identity may be requested in order to prevent unauthorised disclosure.
27. Right to Object
Where processing is based on Article 6(1)(e) or (f) GDPR, users have the right to object at any time on grounds relating to their particular situation. Following an objection, the relevant data will no longer be processed unless compelling legitimate grounds can be demonstrated which override the user’s interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.
Users may object to processing for direct marketing purposes at any time without providing reasons.
28. Withdrawal of Consent
Consent may be withdrawn at any time with effect for the future. Cookie and external-service consent can be changed or withdrawn through the website’s cookie settings. Other consent can be withdrawn by contacting info@sennes.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
29. Right to Lodge a Complaint
Users have the right to lodge a complaint with a data protection supervisory authority. The competent Italian supervisory authority is:
Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Rome, Italy
Telephone: +39 06 696771
Email: protocollo@gpdp.it
Certified email address: protocollo@pec.gpdp.it
The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.
30. Data Security
The controller applies appropriate technical and organisational measures to protect personal data against loss, unauthorised access, unlawful alteration, disclosure or destruction. These measures include access restrictions, up-to-date technical safeguards, backups and encrypted transmission of the website where technically implemented. Absolute security of data transmitted over the Internet cannot, however, be guaranteed.
31. Amendments to This Privacy Policy
This Privacy Policy may be updated where the website, the services used, the processing activities or the applicable law change. The version currently published on the website applies.