Privacy Policy

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Dear Guest/Customer,

The protection of your personal data is a priority for our property. Below you will find all the information regarding the methods and purposes of the processing of the personal data collected in the course of our hospitality, accommodation, and security activities.

The Data Controller is QT SERVICE SRL, with its registered office at Via Tornabuoni 1, 50122 Florence (FI), Italy.

Telephone: +39 055 2658161
E-mail: info@tornabuoni1.com
Legal Representative: Marco Rusconi Clerici

Your personal data are entered into our databases and processed for the following purposes:

• Performance of contractual obligations: management of reservations, accommodation, and related services.
  Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Administrative and accounting purposes: issuance of invoices and receipts, and payment management.
  Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Legal obligations: mandatory communications to the Public Security Authorities (Alloggiati Web Portal) and compliance with tax regulations.
  Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Video surveillance: protection of company assets and the safety of staff and guests.
  Legal basis: the Data Controller's legitimate interest (Art. 6(1)(f) GDPR), with the presence of surveillance indicated by appropriate signage on the premises.
• Newsletter and Marketing: sending commercial communications, promotional offers, special deals, and updates about events at the property via e-mail.
  Legal basis: your explicit and optional consent (Art. 6(1)(a) GDPR).

• Contractual, administrative, and legally required data: providing these data is mandatory. Failure to provide them will make it impossible for us to accommodate you or provide the requested services.
• Video surveillance data: processing takes place automatically in monitored areas. Refusal to be subject to video surveillance will make it impossible to access the areas of the property covered by the surveillance system.
• Newsletter/Marketing data: providing these data is optional. Refusing consent will not affect your stay in any way; however, we will not be able to send you future offers and promotional communications.

Personal data are processed both manually in paper format and through electronic, IT, and telematic systems. The data are protected by appropriate technical and organisational security measures designed to minimise the risks of destruction, accidental loss, unauthorised access, or unlawful processing.

The personal data processed are ordinary personal data (e.g. identification details, contact information, identity document details, payment information, and video recordings). No special categories of personal data (Article 9 GDPR) are collected, except where expressly requested by the guest for specific needs (e.g. accessibility requirements or allergies).

Your personal data will not be disclosed to the public but may be communicated to third parties involved in the performance of our business activities, including:

• Professionals and the Company's tax and legal advisers.
• External service providers responsible for IT services or newsletter management platforms (appointed as Data Processors).
• Banking institutions for payment processing.
• Public Security Authorities and supervisory bodies where required by law.

The updated list of Data Processors is available upon request at the Company's registered office.

Your personal data will be retained as follows:

• Contractual and tax-related data: for the duration of the contractual relationship and for the following 10 years, in accordance with legal obligations.
• Video surveillance recordings: recordings are automatically overwritten within a maximum of 24–48 hours from recording, except during holiday periods, business closures, or where retention is required by the Judicial Authority.
• Newsletter/Marketing data: until you withdraw your consent or unsubscribe (opt-out).

At any time, you may exercise the rights provided for in Articles 15 to 22 of the GDPR by sending a written request to info@tornabuoni1.com.

These rights include:

• Right of access: to obtain confirmation as to whether your personal data (including video recordings, where still available) are being processed and to receive a copy of them.
• Right to rectification: to request the correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): to request the deletion of your personal data or withdraw your consent to receive newsletters.
• Right to restriction of processing and right to object: to object to processing on legitimate grounds or request that processing be restricted.
• Right to data portability: to receive your personal data in a structured, commonly used, and machine-readable format.

Please note that you also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) if you believe that the processing of your personal data infringes the applicable data protection legislation.