Wi-Fi Privacy Policy

1. Introduction

This privacy notice describes how VT Hospitality S.r.l., the company that operates Hotel Villa Traiano, collects, uses and protects the personal data of users who access the Guest Wi-Fi service provided at the Villa Traiano hotel, in compliance with EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.

Accessing the Guest Wi-Fi network involves the processing of certain personal data. Please read this notice carefully before using the service.

2. Data Controller

The Data Controller is:

VT Hospitality S.r.l.
Registered office: Viale dei Rettori 9, 82100 Benevento (BN), Italy
VAT / Italian Tax Code: 01892000629
REA: BN - 313670
Certified email (PEC): hospitality@pec.villatraiano.com
Email: dpo@villatraiano.com

Data Protection Contact:
Email: dpo@villatraiano.com

3. Personal Data Collected

When you use the Guest Wi-Fi service, the following data is automatically collected:

• Device identification data: MAC (Media Access Control) address, device name, operating system
• Connection data: assigned IP address, connection and disconnection date and time, session duration, data volume transferred
• Browsing data: DNS query logs, categories of websites visited
• Authentication data: email address or room number provided during captive portal login, used solely to grant access to the service
• Approximate location data: the access point used within the property

4. Technology Infrastructure

The Guest Wi-Fi service is managed through the Cisco Meraki platform, which acts as a data processor pursuant to Article 28 of the GDPR. Cisco Meraki provides network management, user authentication, traffic monitoring and security policy enforcement.

Data collected by the Meraki platform may be processed and stored on servers located within the European Economic Area (EEA) and/or the United States of America. Transfers to the USA are safeguarded by Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.

5. Purposes and Legal Bases

Personal data collected through the Wi-Fi service is processed for the following purposes:

Balancing of interests: recording connection logs is necessary to protect the network, guests and the property against unauthorised access, cyber attacks and unlawful use of the service, and to be able to cooperate with the judicial authorities if requested. It is limited to the essential technical data, does not include the content of communications, is accessible only to authorised staff and appointed technical providers, and is kept for a limited period. We therefore consider that this interest does not override the rights and freedoms of users, who may in any case object to the processing as described in section 9.

The property is under no legal obligation to identify Guest Wi-Fi users or to retain traffic data: the data requested at login is used only to enable the connection.

6. Retention Periods

Data collected through the Wi-Fi service is retained for the following periods:

• Connection logs: for as long as strictly necessary for network security purposes and in any case no longer than 6 months from the date of recording
• Authentication data (email, room number): for as long as strictly necessary and in any case no longer than 6 months from the date of access
• Session and diagnostic data: 30 days from the date of collection
• Meraki Dashboard logs: in accordance with Cisco Meraki's data retention policies, within the maximum periods stated above for data relating to individual users

Once retention periods expire, data is deleted or irreversibly anonymised.

7. Data Sharing

Data collected through the Wi-Fi service may only be shared with:

• Cisco Systems, Inc. / Cisco Meraki (USA) — Wi-Fi network management platform provider, acting as data processor
• Judicial and law enforcement authorities — in response to lawful requests under applicable legislation
• IT service providers — for maintenance and technical support of the network infrastructure, bound by confidentiality agreements

Data is never sold or shared with third parties for commercial, marketing or profiling purposes.

8. Security Measures

Villa Traiano implements the following technical and organisational measures to protect data collected through the Wi-Fi service:

• WPA3/WPA2 encryption for wireless traffic protection
• Network segmentation (VLAN) to isolate guest traffic from the hotel's internal network
• Firewall and intrusion detection/prevention systems
• Multi-factor authentication (MFA) for Meraki management platform access
• Periodic audits of network configuration and administrative access

9. Your Rights

Under Articles 15-22 of the GDPR, Wi-Fi service users have the right to:

• Access — obtain confirmation of processing and a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of data, in the cases provided for by Art. 17 GDPR
• Restriction — restrict processing in certain circumstances
• Portability — receive data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21 GDPR)

To exercise your rights, please contact our Data Protection Contact at dpo@villatraiano.com.

10. Supervisory Authorities

You have the right to lodge a complaint with the relevant supervisory authority:

• Italy: Garante per la Protezione dei Dati Personali — www.garanteprivacy.it

11. Contact

For any questions regarding the processing of personal data in connection with the Wi-Fi service, please contact:

Data Protection Contact
Email: dpo@villatraiano.com

For the general privacy policy of the website and hotel, please refer to our Privacy Policy.