Privacy Policy
Last updated: 14 October 2026
1. Introduction
VT Hospitality S.r.l., the company that operates Hotel Villa Traiano, is committed to protecting the privacy and personal data of all users, guests and visitors of the website and hotel property. This Privacy Policy, provided under Articles 13 and 14 of EU Regulation 2016/679 (GDPR), describes how we collect, use, store and protect personal data, in compliance with the GDPR and Italian Legislative Decree No. 196 of 30 June 2003 (Italian Privacy Code), as amended by Legislative Decree No. 101 of 10 August 2018.
Please read this notice carefully. For cookies and tracking tools used on the site, please refer to the Cookie Policy.
2. Who We Are and Contact Details
The Data Controller of personal data collected through the website and at the hotel (bookings, check-in, stay, dining, SPA, events, newsletter and marketing communications, CCTV, tax obligations) is:
VT Hospitality S.r.l.
Registered office: Viale dei Rettori 9, 82100 Benevento (BN), Italy
VAT / Tax Code: 01892000629
REA: BN - 313670
Certified email (PEC): hospitality@pec.villatraiano.com
Data protection contact:
Email: dpo@villatraiano.com
For bookings: reservations@villatraiano.com.
3. Scope
This Privacy Policy applies to all personal data processed in the context of Villa Traiano's activities, with reference to the following categories of data subjects:
- Hotel guests
- Website visitors
- Clients of events, weddings and meetings
- Customers of the lounge bar, SPA and online shop
- Suppliers and business partners
- Job applicants
4. Types of Data Processed
In the course of our activities, we may process the following categories of personal data:
- Identification data: first name, last name, date and place of birth, nationality, identity document details
- Contact data: email address, phone number, postal address
- Booking data: dates of stay, room type, preferences, special requests
- Payment data: handled by PCI-DSS certified payment providers; we do not store the full card number
- Health-related data: food allergies, accessibility needs, any conditions voluntarily disclosed by the guest
- Browsing data, cookies and online identifiers: IP address, browser type, pages visited, cookie identifiers (see Cookie Policy)
- CCTV data: images recorded by cameras installed in common areas
- Communications: content of emails, messages sent via forms, WhatsApp, the Concierge chat, phone requests
- Applicant data: CV and information provided with the application
5. Collection Methods
Personal data may be collected through the following channels:
- The online booking engine, contact forms, lounge bar reservation and newsletter sign-up forms on the website
- The online shop (vouchers, experiences, tickets)
- The website Concierge chat
- Online Travel Agencies (OTAs) and other third-party booking channels, which send us the booking details
- Communications by email, phone, WhatsApp or social media
- The check-in procedure at the hotel
- Cookies and similar tools while browsing the site, according to the choices made on the banner
6. Purposes, Legal Bases and Retention
Personal data is processed for the following purposes, each with its own legal basis and retention period:
| Purpose | Legal basis | Retention |
|---|---|---|
| Bookings and stays: managing the booking (direct, by phone or via an OTA), check-in, on-site services, payment | Performance of a contract and pre-contractual measures — Art. 6(1)(b) GDPR; legal obligations — Art. 6(1)(c) | For the duration of the relationship; data contained in accounting and tax records for 10 years (see below) |
| Reporting guest details to the police (Questura) ("schedine alloggiati") | Legal obligation — Article 109 of the Italian Consolidated Law on Public Security (TULPS, Royal Decree 773/1931) and Art. 6(1)(c) GDPR | Transmitted via the State Police "Alloggiati Web" portal within 24 hours of arrival. We do not keep copies of identity documents beyond what the law requires |
| Tax and accounting obligations (invoices, receipts, records) | Legal obligation — Art. 6(1)(c) GDPR | 10 years (Article 2220 of the Italian Civil Code and tax legislation) |
| Contact requests, quotes, events, weddings, meetings and groups | Pre-contractual measures at the data subject's request — Art. 6(1)(b) GDPR | 24 months from the last contact; if a contract follows, as for bookings |
| Lounge bar reservations, including any card registered as a guarantee | Performance of a contract and pre-contractual measures — Art. 6(1)(b) GDPR | 24 months from the last contact. The card registered as a guarantee stays saved with the payment provider and can only be used for a possible no-show charge, within 90 days of the reservation date; if a charge is made, tax records for 10 years |
| Online shop purchases: vouchers, experiences, event tickets | Performance of a contract — Art. 6(1)(b) GDPR; tax obligations — Art. 6(1)(c) | For the duration of the relationship and of the voucher's validity; tax records for 10 years |
| Newsletter and promotional communications | Consent — Art. 6(1)(a) GDPR and Article 130 of the Italian Privacy Code; double opt-in sign-up (email confirmation) | Until consent is withdrawn |
| Emails to guests about services similar to those already purchased ("soft spam") | Article 130(4) of the Italian Privacy Code and legitimate interest — Art. 6(1)(f) GDPR | Until you object, which you can do in every message, and in any case no longer than 24 months from the last contact |
| Analytics cookies and tools (Google Analytics 4) | Consent — Art. 6(1)(a) GDPR and Article 122 of the Italian Privacy Code | Durations stated in the Cookie Policy |
| Marketing cookies and tools: remarketing and advertising segmentation (Google Ads, Meta Pixel), tracking of the site journey in the CRM | Consent — Art. 6(1)(a) GDPR and Article 122 of the Italian Privacy Code | Durations stated in the Cookie Policy |
| Sending conversion events from the site's forms to Meta (Meta Conversions API) | Marketing consent — Art. 6(1)(a) GDPR | Not stored by us beyond sending; stored by Meta according to its own terms |
| Managing customers and enquiries in the hotel's CRM (VT Hub): history of stays, requests and preferences | Performance of a contract — Art. 6(1)(b) GDPR; legitimate interest — Art. 6(1)(f) | 24 months from the last contact (except data subject to tax obligations) |
| Website Concierge (AI-based chat): answering visitors' questions | Pre-contractual measures at the user's request — Art. 6(1)(b) GDPR; for general questions, legitimate interest — Art. 6(1)(f) | For as long as needed to handle the conversation and in any case no longer than 24 months from the last contact |
| CCTV surveillance of common areas | Legitimate interest in the safety of people and property — Art. 6(1)(f) GDPR | 7 days, unless needed to investigate an offence or requested by the authorities |
| IT security and prevention of abuse and fraud on the site | Legitimate interest — Art. 6(1)(f) GDPR | For the strictly necessary time, according to the hosting providers' settings |
| Job applications (CVs sent to hr@villatraiano.com) | Pre-contractual measures at the data subject's request — Art. 6(1)(b) GDPR | 12 months from receipt |
| Handling requests to exercise data subject rights | Legal obligation — Articles 12-22 and Art. 6(1)(c) GDPR | For as long as needed to reply and to document how the request was handled |
| Cookie consent log: choice identifier, date and time, choices made, IP address in pseudonymised form (HMAC), truncated user agent | Obligation to demonstrate consent — Art. 7(1) and Art. 6(1)(c) GDPR | 400 days |
| Health-related data provided voluntarily (allergies, accessibility needs) | Explicit consent — Art. 9(2)(a) GDPR | For the duration of the stay or event |
When these periods expire, data is deleted or anonymised, unless it must be kept to establish, exercise or defend legal claims.
6.a Legitimate interest: the balancing test
Where processing is based on legitimate interest, we have assessed that it does not override the data subjects' rights, for the following reasons:
- Emails to guests about similar services: they concern only services similar to those already purchased, use the email address given at the time of purchase, are something customers can reasonably expect, and every message lets you opt out with one click; you can also object when the address is collected.
- Hotel CRM: keeping a history of stays, requests and preferences allows us to offer consistent service to returning guests; the data is what customers themselves provided, access is limited to authorised staff and retention is limited to 24 months from the last contact.
- Website Concierge: answering visitors' questions is the very service they ask for by writing in the chat; we process only the messages entered and do not use them for advertising.
- CCTV: protecting guests, staff and property is a concrete interest; cameras cover only common areas, are signposted, images are kept for 7 days and are accessible only to authorised staff.
- Site security: filtering malicious traffic and abuse also protects users' data; only minimal technical data is used, for short periods.
In all these cases you may object to the processing on grounds relating to your particular situation (Article 21 GDPR) by writing to dpo@villatraiano.com.
6.b Whether providing data is mandatory
- The data requested to book, purchase or receive a quote is necessary: without it we cannot process the request.
- The data for police registration and tax obligations is required by law: without it the stay is not possible.
- Consent to the newsletter and to analytics and marketing cookies, and providing health-related data, are optional: refusing has no consequences for the booking or for browsing.
- In the Concierge and in the forms, any data not marked as mandatory is optional.
7. Marketing Communications
The newsletter and promotional communications are sent only with the data subject's consent, collected through double opt-in: after signing up you will receive an email to confirm. Guests who have already purchased one of our services may receive, at the email address given at that time, communications about similar services without prior consent, with the option to object in every message (Article 130(4) of the Italian Privacy Code).
Consent may be withdrawn, and objection exercised, at any time, without affecting the lawfulness of processing carried out before, via the unsubscribe link in every communication or by writing to dpo@villatraiano.com.
8. Events, Weddings and Meetings
When organising events, weddings and meetings, we may process personal data relating to organisational preferences, contact details of invited guests, special requests (dietary, accessibility, logistics) and contractual details. Such data is processed solely for the proper performance of the requested service and kept for the period stated in section 6. Whoever provides us with guests' data is responsible for informing them.
9. CCTV Surveillance
The common areas of the property are equipped with a video surveillance system, installed for security and asset protection purposes on the basis of the Controller's legitimate interest. Cameras are indicated by appropriate signs. Images are kept for a maximum of 7 days, unless needed to investigate offences or requested by the authorities, and are accessible only to authorised staff. The full CCTV notice is available at reception.
10. Website Concierge (AI Chat)
The site offers a chat, the Concierge, which answers visitors' questions about rooms, services and availability. The service is provided through the VT Hub, the hotel's management system, and is based on artificial intelligence models from third-party providers, which process the messages to generate replies. Replies are generated automatically and may contain inaccuracies: for binding confirmations (prices, availability, terms) what is communicated by our staff or shown by the booking engine prevails.
Messages are processed in order to reply and, if the conversation turns into a booking or quote request, to follow it up. Please do not enter sensitive data (such as health data) or payment data in the chat. Retention and legal basis are stated in section 6.
11. Profiling and Automated Decisions
The site uses Google and Meta remarketing and advertising segmentation, which involve a form of profiling for advertising purposes, only with consent to the "Marketing" category of the banner. We do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals (Article 22 GDPR).
12. Recipients of Data
Personal data may be disclosed to the following categories of recipients, in the role indicated:
- Booking engine: Selfbook, Inc. (USA), which processes on our behalf the data of bookings made on the site. Within the engine the provider integrates Triptease (messages and offer personalisation), Segment, which forwards events to Amplitude, Mixpanel, Statsig and the provider's own Google Analytics, a card tokenisation service (payments), Datadog (monitoring) and Google Pay; these tools are chosen and configured by the provider (see Cookie Policy, section 6).
- Property management system (PMS): Oracle Opera Cloud, with the connected distribution and channel manager systems, as data processor.
- Payments: card payments, online on the Villa Traiano payment page (pay.villatraiano.com) and on the premises, and card registration as a guarantee are handled by authorised payment institutions and banks based in the European Union or in countries with a European Commission adequacy decision. The providers act as data processors and, for certain purposes of their own such as fraud prevention and regulatory obligations, as independent controllers. The up-to-date list of providers is available on request at info@villatraiano.com.
- Hosting and CDN: Cloudflare, Inc., which hosts the site and the VT Hub, as data processor.
- Email: Microsoft (Microsoft 365) for mailboxes and Amazon Web Services (Amazon SES) for sending automated emails, as data processors.
- Messaging: Twilio and WhatsApp (Meta) for messages with guests.
- Concierge: providers of artificial intelligence models used through the VT Hub, as data processors.
- Advertising: Google and Meta, as independent controllers of the data received through their own tools; for collection through the Meta Pixel, Meta Platforms Ireland Ltd. is a joint controller with us (CJEU Fashion ID judgment, C-40/17).
- OTAs and third-party channels: the online travel agencies through which the booking was made, as independent controllers.
- Advisers: accountants, tax and legal advisers, as processors or independent controllers depending on the engagement.
- Authorities: the police (Alloggiati Web), the Italian Revenue Agency, judicial and other authorities, where required by law.
Data is not made public. Authorised staff can access data only within the limits of their duties. An up-to-date list of data processors is available on request at dpo@villatraiano.com.
13. Data Transfers outside the EU
Some providers are established outside the European Economic Area or may access data from third countries. Transfers take place with the following safeguards:
- Google, Meta, Cloudflare, Microsoft, Amazon Web Services, Oracle, Twilio (including Segment): USA, adequacy decision on the EU-US Data Privacy Framework (certified companies).
- Selfbook, the card tokenisation service and the other services integrated in the booking engine (Amplitude, Mixpanel, Statsig, Datadog): USA, EU-US Data Privacy Framework for certified providers, otherwise Standard Contractual Clauses.
- Triptease: United Kingdom, European Commission adequacy decision.
- Payment service providers: European Union; for any provider based outside the European Union, European Commission adequacy decision.
- AI model providers for the Concierge: may process data in the USA; EU-US Data Privacy Framework for certified providers, otherwise Standard Contractual Clauses.
To obtain a copy of or information about the safeguards applied, please write to dpo@villatraiano.com.
14. Security Measures
Villa Traiano adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration. These measures include:
- Encryption of data in transit
- Firewall systems and perimeter protection
- Regular backups
- Access to data limited to authorised staff
- Training of staff authorised to process data
15. Data Subject Rights
Under Articles 15-22 GDPR, data subjects have the right to:
- Access — obtain confirmation of processing and a copy of their personal data
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion of data (right to be forgotten)
- Restriction — restrict processing in certain cases
- Portability — receive data in a structured, commonly used and machine-readable format
- Objection — object to processing based on legitimate interest and, in any case, to processing for direct marketing
- Withdrawal of consent — withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
To exercise your rights, write to dpo@villatraiano.com or to the certified email address hospitality@pec.villatraiano.com. We will reply within one month of receipt, extendable by two months for complex requests (Article 12 GDPR); we may ask for information to verify the requester's identity. You also have the right to lodge a complaint with the supervisory authority (section 21).
16. Cookies and Tracking
The website uses cookies and similar tracking technologies. The full list, purposes, durations and how to manage preferences are set out in the Cookie Policy, which also describes the tools integrated by the booking engine provider.
17. Minors
In Italy, consent to the processing of data in relation to online services (for example newsletter sign-up or non-technical cookies) may be given independently by persons aged 14 or over (Article 2-quinquies of the Italian Privacy Code); for children under 14, consent must be given by the holder of parental responsibility. Data of minors staying at the hotel is processed for legal obligations, such as police registration, and for the performance of the stay, and is provided by the parent or accompanying adult. If we become aware that a minor's data has been collected without the necessary consent, we will delete it.
18. External Links and Social Media
The website may contain links to third-party websites and social media platforms. Villa Traiano is not responsible for the privacy practices or the processing of personal data carried out by such third parties. We invite users to read the privacy notices of third-party websites and platforms before providing their personal data.
19. Changes to the Privacy Policy
Villa Traiano reserves the right to update this Privacy Policy to reflect regulatory, organisational or technological changes. The updated version will always be available on this page, with the date of the last update.
20. Data Not Obtained from the Data Subject
If the booking is made through an online travel agency, a travel agent or a company, or by another guest on your behalf, we receive your data (identification, contact and booking data) from them and process it for the purposes set out in section 6.
21. Complaint to the Supervisory Authority
Data subjects have the right to lodge a complaint with the supervisory authority (Article 77 GDPR):
- Italy: Garante per la protezione dei dati personali — www.garanteprivacy.it
22. Contact
For any questions, requests or clarifications regarding this Privacy Policy or the processing of personal data, please contact our data protection contact:
Email: dpo@villatraiano.com
Certified email (PEC): hospitality@pec.villatraiano.com