Privacy

Privacy notice.

What this privacy policy is

This page describes how the website is managed with regard to the processing of the personal data of the users who consult it.

This notice applies only to the website of the company Albergo Annunziata srl, Data Controller, and not to any other websites the user may visit through links.

Information on the processing of personal data provided pursuant to art. 13 of EU Regulation 2016/679

Data controller

The data controller is: Albergo Annunziata S.r.l., registered office at Piazza Repubblica 5, 44121 Ferrara, Italy, VAT no. 00651540387, Tel. 0532.201111, e-mail: info@annunziata.it

Place of data processing

The website is hosted on machines managed by an external company; however, communications are forwarded to the data controller in order to respond to users’ requests and to guarantee bookings.

The processing connected with the web services of this website therefore takes place at the premises of the controller and of the external data processors, each within their area of responsibility.

No data deriving from the web service is disclosed by the two companies to third parties, unless strictly relevant to the purpose of the processing or required by laws or regulations.

Purposes of the processing

The personal data provided voluntarily and optionally by users who send requests for information on the hotel’s services (prices, room availability, etc.) are used solely to perform the service or task requested, and are not disclosed to third parties unless disclosure is required by law or is strictly relevant and necessary to fulfil the requests.

In particular, the personal data provided voluntarily by data subjects will be collected and processed, also by electronic means, directly and/or through delegated third parties (email service companies, website hosting companies) for the following purposes:

• checking the availability of the requested room on the basis of the information entered in the booking form;
• allowing the booking to be made and confirmed by providing, as a guarantee, one’s identification data and credit card details;
• fulfilling current administrative, accounting and tax obligations, and complying with laws and regulations;
• answering questions about our hotel services (room availability, prices, breakfast, hotel services, etc.);
• for the Controller’s defence in court, or in the preliminary stages of any legal proceedings, against abuse arising from unlawful use of the website or of the related services by the User.

Bookings

Personal data relating to bookings will be processed electronically and on paper solely to guarantee the booking of the room under the agreed conditions.

The booking platform is the booking engine of TeamSystem S.p.A., external data processor, which will pass the data subject’s data on to the accommodation facility for the normal activities related to managing the stay.

The data will be recorded in our electronic databases, accessible to personnel duly appointed and trained in the security and confidentiality of personal data.

To confirm the booking, a credit card must be provided as a guarantee, it being understood that the customer may decide to pay in cash at the end of the stay.

Disclosure and dissemination of data

The personal data acquired through this website may be processed exclusively by personnel officially appointed and trained in the confidentiality and security of personal data.

The personal data of data subjects may be disclosed to:

• public bodies or offices, in accordance with legal and/or contractual obligations;
• TeamSystem S.p.A. – Via Sandro Pertini 88 – 61122 Pesaro (PU) – VAT no. 01035310414, provider of the hotel booking engine connected to this website, appointed external data processor for the acquisition of personal data during booking;
• external data processors, being companies or consultants that carry out, on behalf of the controller, activities instrumental to the proper functioning of the website and to the management of the information acquired through it;
• the Italian Postal Police, to identify any activities harmful to the company’s website;
• collaborators or service providers, when disclosure is necessary for the data subject to use the hotel’s services.

Personal data will not be disseminated.

Browsing data

The software applications used to run this website acquire, in the course of their normal operation, some personal data whose transmission is implicit in the normal Internet IP communication protocol.

This information is not collected in order to be associated with identified data subjects, but by its very nature it could, through subsequent processing and association with data held by third parties (providers), allow users to be identified.

This category of data includes the IP addresses or domain names of the computers used by users connecting to the website, the date and time of the request, the URI (Uniform Resource Identifier) addresses of the resources requested, the size of the file obtained in response from the server, the numerical code indicating the status of the server’s response (ok, error, etc.) and other parameters relating to the user’s operating system and computer environment.

These data are used solely to obtain anonymous statistical information on the use of the website and to check that it works correctly, and are deleted immediately after processing.

This website may reveal personal data which, if requested in accordance with the law, may be disclosed to the judicial authorities for purposes of defence of the State or of prevention, detection or prosecution of crimes, to act to ensure the protection of the personal data of data subjects who use the website’s online services, for any defensive investigations under Law no. 397 of 7 December 2000, or in any case to assert or defend a legitimate right and interest of the Controller in court, always in compliance with the principles of relevance and non-excessiveness with respect to the purpose of the processing.

Optional provision of data

Apart from what is specified for browsing data, users are free to provide their personal data in order to make an online booking.

Proceeding with the online booking procedure implies the data subject’s implicit consent to the processing of their personal data in accordance with the privacy policy of this website. Failure to provide the personal data required by the website may make it impossible to obtain what has been requested.

The optional, explicit and voluntary sending of emails to the addresses indicated on this website entails the subsequent acquisition of the sender’s address, which is necessary to reply to requests, as well as of any other personal data included in the message.

Processing methods and retention period

Personal data are processed on paper and/or with automated tools for the time strictly necessary to achieve the purposes for which they were collected.

Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access.

Rights of data subjects

Pursuant to articles 13(2) and 15 to 21 of EU Regulation 2016/679, we inform you that the user, as data subject, may exercise their rights against the Data Controller at any time. In particular, they may:

• request access to their personal data, and its rectification, completion or erasure, or the restriction of processing;
• obtain the portability of their data;
• withdraw, at any time, any consent to the processing of their data previously given;
• object, in whole or in part, to the processing of their data;
• lodge a complaint with a supervisory authority;

The data subject may exercise their rights by written request sent to the data controller at the e-mail address: info@annunziata.it

Cookies

This website uses no cookies or other tracking tools. The details are in the Cookie policy.

Chatbot

[TO BE CHECKED: THIS SECTION APPLIES ONLY IF «ASK ANNUNZIATA» USES KOSMO; OTHERWISE IT MUST BE REWRITTEN FOR THE CHOSEN SERVICE]

Processing of personal data through the KOSMO virtual assistant

Our website features AI KOSMO, a chatbot powered by artificial intelligence (hereinafter the “Chatbot”), to assist you while browsing, provide you with information about our services and answer your questions. This service is developed by AI KOSMO S.r.l., which acts as data processor pursuant to art. 28 of the GDPR, on the basis of a specific agreement governing its tasks and responsibilities. The Data Controller of the data you provide through the Chatbot remains Hotel Annunziata.

The Chatbot uses LLM artificial intelligence systems to understand your requests and provide you with relevant answers.

a. Types of data processed

The processing concerns the following personal data:

• data actively provided by the user: any information you voluntarily type into the chat window, such as questions, requests for information, first name, surname, contact details or stay preferences;
• technical data related to the session: IP address, browser type, operating system and other technical data needed to ensure the chat works properly;
• content of the conversations: the full text of your interactions with the Chatbot.

b. Purposes and legal basis of the processing

Your personal data are processed for the following purposes:

• provision of the chat assistance and support service: to respond to your requests, assist you while browsing and provide you with the necessary information about our services. The legal basis for this processing is the Controller’s legitimate interest in providing an efficient and immediate customer assistance service. In the case of pre-contractual requests (e.g. quotes, availability for bookings), the legal basis is the performance of pre-contractual measures.
• improvement of the service and training of artificial intelligence algorithms: to analyse conversations (in aggregated and anonymised form where possible) in order to improve the accuracy of the Chatbot’s answers and the effectiveness of the service. The legal basis for this processing is the legitimate interest of the Controller and of the Processor in improving the technology and the quality of the service offered, provided that your interests or fundamental rights and freedoms do not prevail.

Providing data for purpose 1 is optional, but necessary in order to use the Chatbot service. For purpose 2, you may object at any time, without this affecting your ability to use the chat service.

c. Processing methods and security measures

Processing is carried out with IT and telematic tools. In line with the principles of data protection by design and by default (art. 25 GDPR), appropriate technical and organisational measures are adopted to ensure a level of security appropriate to the risk, including the pseudonymisation or anonymisation of data where possible, especially for the purposes of algorithm training.

d. Data retention period

Your personal data will be retained in accordance with the principle of storage limitation:

• For assistance purposes, conversation logs will be kept for the time strictly necessary to handle your request and, in any case, for no longer than 6 months from the end of the chat session, unless a dispute arises that justifies further retention.
• for algorithm training purposes, personal data will be kept in a form that allows your identification only for the time strictly necessary to analyse and extract the information useful for improving the model, and will then be irreversibly anonymised or deleted. In any case, this period will not exceed 90 days.

e. Disclosure of data and transfers

The data collected through the Chatbot are processed by our supplier AI KOSMO, appointed as Data Processor. AI KOSMO may use sub-processors (e.g. cloud service providers) to deliver the service, in compliance with the obligations laid down in art. 28 of the GDPR. The use of these services may involve the transfer of your personal data outside the European Economic Area (EEA). Such transfer will take place only where adequate safeguards are in place, such as adequacy decisions of the European Commission or the signing of Standard Contractual Clauses.

f. Use of artificial intelligence systems

The Chatbot service uses artificial intelligence technologies, in particular LLMs. In line with the transparency principles laid down by European legislation (AI Act, GDPR) and by Italian Law no. 132/2025, we wish to provide you with the following information:

• transparency obligation: we inform you that you are interacting with a system that uses AI components. This system has been designed to assist the Hotel’s personnel in interpreting and routing your requests.
• how the system works and its logic: the AI system analyses the text of your requests to understand their content and purpose and route them to the relevant department.
• human oversight and absence of automated decisions: we guarantee that the AI system operates as a support tool for our personnel. No decision producing legal effects or similarly significantly affecting you (within the meaning of art. 22 of the GDPR) is taken solely by automated means. Every complex request, charge or relevant decision is subject to review and validation by a human operator.
• fairness and non-discrimination: the AI systems have been developed and are periodically monitored to minimise the risk of errors and discriminatory effects, in line with best practices and regulatory requirements.

g. Data subject’s rights in relation to the use of AI

In addition to the general rights provided by the GDPR (access, erasure, restriction, portability, objection), we remind you that, in relation to the use of artificial intelligence systems, you are granted specific rights, in line with the guidance of the supervisory authorities:

• right to rectification: if you find that information generated by the Chatbot concerning you is inaccurate, you have the right to have it corrected;
• right to erasure: if correcting inaccurate data is not technically possible, you have the right to have it erased;
• right to object: you may object at any time to the processing of your data for the purpose of algorithm training based on legitimate interest.

To exercise your rights, you can contact Hotel Annunziata at the contact details given in this privacy notice.

QR Digital Concierge

Processing of personal data through the QR Digital Concierge

In our property we have implemented a QR Digital Concierge virtual assistant service (hereinafter “QR Concierge”) to assist you during your stay, provide you with information about our services and answer your questions. This service is developed by AI KOSMO S.r.l., which acts as data processor pursuant to art. 28 of the GDPR, on the basis of a specific agreement governing its tasks and responsibilities. The Data Controller of the data you provide through QR Concierge remains Hotel Annunziata.

QR Concierge uses LLM artificial intelligence systems to understand your requests and provide you with relevant answers.

a. Types of data processed

The “QR Concierge” service processes the following categories of personal data:

• identification and contact data: first name, surname and room number, needed to verify your identity and to charge any paid services to your room bill;
• data relating to your requests: information contained in the requests you send through the service (e.g. booking a table at the restaurant, requesting in-room services, booking SPA treatments, times for cleaning services);
• browsing data: technical data collected while using the service, such as IP addresses, system logs and other data relating to the characteristics of the device and browser you use;
• special categories of personal data: if, in the course of your requests, you voluntarily provide information that may reveal your state of health (e.g. food allergies or intolerances, specific requests for wellness treatments involving health conditions, need for disability aids), such data will be processed only with your prior explicit consent.

b. Purposes and legal basis of the processing

Your personal data are processed for the following purposes:

• provision of the QR Concierge service: managing and following up your requests, booking services and charging the related costs to your room bill. The legal basis for this processing is the performance of a contract to which you are a party. Where it is necessary to handle specific requests involving the processing of health data, the legal basis is your consent.
• security and technical maintenance: ensuring the security of the platform, preventing fraud and abuse and ensuring the service works properly. The legal basis for this processing is the legitimate interest of the Controller and of the Processor in maintaining the security and efficiency of their systems.
• compliance with legal obligations: fulfilling obligations under current legislation (e.g. tax, accounting). The legal basis for this processing is compliance with a legal obligation to which the Controller is subject.
• improvement of the service and training of artificial intelligence algorithms: to analyse conversations (in aggregated and anonymised form where possible) in order to improve the accuracy of QR Concierge’s answers and the effectiveness of the service. The legal basis for this processing is the legitimate interest of the Controller and of the Processor in improving the technology and the quality of the service offered, provided that your interests or fundamental rights and freedoms do not prevail.

Providing data for purpose 1 is necessary for the provision of the service. Without them, it will not be possible to use QR Concierge. Providing special categories of data is optional and subject to your consent; failure to consent will only prevent us from following up those specific requests that require the processing of such data (e.g. preparing meals for people with allergies). For purpose 4, you may object at any time, without this affecting your ability to use the QR Concierge service.

c. Processing methods and security measures

Processing is carried out with IT and telematic tools. In line with the principles of data protection by design and by default (art. 25 GDPR), appropriate technical and organisational measures are adopted to ensure a level of security appropriate to the risk, including the pseudonymisation or anonymisation of data where possible, especially for the purposes of algorithm training.

d. Data retention period

Your personal data will be retained in accordance with the principle of storage limitation:

• for assistance purposes, your personal data will be kept for the time strictly necessary to achieve the purposes for which they were collected. In particular, data relating to your requests will be kept for the duration of your stay and deleted or anonymised within 30 days of your departure, without prejudice to retention obligations for tax and legal purposes (10 years for billing data); conversation logs will be kept for no longer than 6 months from the end of the chat session, unless a dispute arises that justifies further retention.
• for algorithm training purposes, personal data will be kept in a form that allows your identification only for the time strictly necessary to analyse and extract the information useful for improving the model, and will then be irreversibly anonymised or deleted. In any case, this period will not exceed 90 days.

e. Disclosure of data and transfers

The data collected through QR Concierge are processed by our supplier AI KOSMO, appointed as Data Processor. AI KOSMO may use sub-processors (e.g. cloud service providers) to deliver the service, in compliance with the obligations laid down in art. 28 of the GDPR. The use of these services may involve the transfer of your personal data outside the European Economic Area (EEA). Such transfer will take place only where adequate safeguards are in place, such as adequacy decisions of the European Commission or the signing of Standard Contractual Clauses.

f. Use of artificial intelligence systems

The QR Concierge service uses artificial intelligence technologies, in particular LLMs. In line with the transparency principles laid down by European legislation (AI Act, GDPR) and by Italian Law no. 132/2025, we wish to provide you with the following information:

• transparency obligation: we inform you that you are interacting with a system that uses AI components. This system has been designed to assist the Hotel’s personnel in interpreting and routing your requests.
• how the system works and its logic: the AI system analyses the text of your requests to understand their content and purpose (e.g. distinguishing a restaurant booking from a request for extra pillows) and route them to the relevant department (reception, restaurant, room service, SPA).
• human oversight and absence of automated decisions: we guarantee that the AI system operates as a support tool for our personnel. No decision producing legal effects or similarly significantly affecting you (within the meaning of art. 22 of the GDPR) is taken solely by automated means. Every complex request, charge or relevant decision is subject to review and validation by a human operator.
• fairness and non-discrimination: the AI systems have been developed and are periodically monitored to minimise the risk of errors and discriminatory effects, in line with best practices and regulatory requirements.

g. Data subject’s rights in relation to the use of AI

In addition to the general rights provided by the GDPR (access, erasure, restriction, portability, objection), we remind you that, in relation to the use of artificial intelligence systems, you are granted specific rights, in line with the guidance of the supervisory authorities:

• right to rectification: if you find that information generated by QR Concierge concerning you is inaccurate, you have the right to have it corrected;
• right to erasure: if correcting inaccurate data is not technically possible, you have the right to have it erased;
• right to object: you may object at any time to the processing of your data for the purpose of algorithm training based on legitimate interest.

To exercise your rights, you can contact Hotel Annunziata at the contact details given in this privacy notice.

Notice last updated [PUBLICATION DATE OF THE NEW SITE] — version [4]. Previous versions are available on request by writing to info@annunziata.it.