Privacy Policy

1. Introduction

For Just Hotel S.r.l. a socio unico, your privacy and the security of your personal data are of utmost importance. For this reason, we collect and process them with the greatest care and attention, while adopting specific and appropriate technical and organizational measures to guarantee the full security of the processing. We hereby inform you, pursuant to Art. 13 of European Regulation 2016/679 ("GDPR" or "Regulation") and the Privacy Code ("Privacy Code"), as amended by Legislative Decree 101/2018 (collectively, the "Regulations"), that the processing of your personal data takes place according to methods suitable to guarantee security and confidentiality, and is carried out using paper, computer, and electronic supports, as detailed in this privacy policy.

2. Data Controller

The processing of your personal data is carried out by Just Hotel S.r.l. a socio unico (hereinafter also referred to as “Just Hotel” or “Data Controller”), with registered office in Via Ceresio, 49 - 22074 Lomazzo (CO), as Data Controller pursuant to and for the purposes of the Regulation. For any questions or requests related to the processing of your personal data, you can contact the Company at any time by sending a request to the following contacts:

Data Controller

Company Name: Just Hotel S.r.l. a socio unico
Registered Office Address: Via Ceresio, 49 - 22074 Lomazzo (CO)
E-mail Contact: justhotelsrl@legalmail.it

3. Types of Data Processed, Purposes, and Legal Basis of Processing

The personal data that the Company processes are those you provide to us while browsing or using the online services offered by the Company through the website www.justhotelgroup.it The Company may therefore collect data about you, such as personal data like name and surname, email, telephone number, your requests, and browsing data. Special categories of data pursuant to Art. 9 GDPR or data relating to criminal convictions and offenses pursuant to Art. 10 GDPR are not processed. Once collected, your personal data are processed for the following purposes:

A) To monitor your user experience of our websites, the services we offer, as well as to ensure the correct functioning of our web pages and their contents. Processing carried out for these purposes is based on a legitimate interest of the Data Controller and does not require specific consent from the data subject.

B) To comply with obligations under laws, regulations, and European legislation. Processing carried out for these purposes is necessary for the fulfillment of legal obligations and to make the requested service available to you, and does not require specific consent from the data subject.

C) Registration for our Newsletter service. Processing carried out for these purposes is performed with the specific and free consent provided by the user.

D) To carry out direct promotional activities, including the periodic sending of newsletters and other promotional tools to the email address you voluntarily provided upon registration on the Site. Processing carried out for this purpose is performed with the specific consent provided by the user, except for commercial communications relating to products and/or services similar to those already purchased and/or subscribed to by the user, for which the processing is based on a legitimate interest of the Data Controller.

Your personal data are processed exclusively by Company personnel specifically authorized and designated pursuant to Art. 4 paragraph 10 of the Regulation and Art. 2-quaterdecies of the Privacy Code, who have been adequately trained in relation to Privacy Regulatory compliance and who process data following precise instructions from the Data Controller.

4. Data Processors pursuant to Art. 28 and Data Recipients

Your personal data will also be transmitted to third parties whose services we employ. These parties have been selected by us and offer an adequate guarantee of compliance with the regulations on the processing of personal data. In the event that they process data in the name and on behalf of Just Hotel S.r.l. a socio unico, they have been appointed as Data Processors pursuant to Art. 28 of the Regulation and are required to carry out their activities according to the specific instructions given by the Company and under its control. Such third parties may belong to the following categories: financial operators; internet providers; companies specialized in IT services, consulting companies, cloud service providers. Furthermore, your data may be communicated to third-party companies operating in the publishing sector and to companies operating in the following sectors with which Just Hotel S.r.l. a socio unico could conclude partnership agreements related to the hotel digital marketing activities carried out. A specific and updated list of these subjects is available at the Data Controller's head office and can be consulted upon request of the data subject. For administrative purposes, we inform you that your data may be communicated by the Data Controller to other Group companies. It is understood that your personal data will not be communicated to third parties so that they can use them for their own promotional purposes and will not be disseminated in any way. Your data may also be transmitted to Public Entities for legal compliance or to the Police Forces and the Judicial and Administrative Authority, in accordance with the law, for the investigation and prosecution of crimes, prevention and protection from threats to public safety, as well as to allow the Company to exercise or protect its own right or that of third parties before the competent Authorities, as well as for other reasons connected to the protection of the rights and freedoms of others.

5. Mandatory or Optional Nature of Providing Data

Without prejudice to the freedom of the data subject to provide personal data, please note that:

The communication of data for purposes A) and B) mentioned in paragraph 4 is mandatory. Failure to communicate the data will make it impossible for the Company to establish any relationship with you and to allow you to use the site;

The communication of data for purposes C) and D) mentioned in paragraph 3 is optional. Failure to communicate the data will make it impossible to subscribe to the newsletter service and benefit from the promotional services offered by the Company.

6. Transfer of Data Outside the EU

Some of the third parties to whom the data are transferred may be based in countries outside the European Union, also due to the use of cloud services implemented by the Company. Such transfer is carried out towards countries that offer an adequate level of data protection, as established by specific decisions of the European Commission. The transfer of your personal data to third parties residing or located in countries that do not belong to the European Union and that do not ensure adequate levels of protection will be carried out only with your consent or after the conclusion between the Company and said parties of specific agreements, containing safeguards and appropriate guarantees for the protection of your personal data, known as "standard contractual clauses", also approved by the European Commission, or if the transfer is necessary for the conclusion and execution of a contract between you and the Company or for the management of your requests.

7. Data Retention

We inform you that your data will be kept for a limited period of time, which varies depending on the type of processing activity and its specific purposes, as indicated below:

Data collected in the context of using services offered by the Company: these data are kept for the entire duration of the service until its termination or the cancellation of the subscription to the service by the User or the relative revocation of consent;

Data collected for sending informative material via newsletter or for carrying out promotional activities (purposes C and D mentioned in paragraph 3): until the user requests to stop the activity and in any case within 2 years from the last interaction of any kind of the data subject with the Company. At the end of these periods, your data will be permanently deleted or, in any case, irreversibly anonymized by the Company.

8. Your Rights

We inform you that you have the right to exercise the following rights in relation to the personal data covered by this policy, as provided and guaranteed by the Regulation:

Right of access and rectification (Articles 15 and 16 of the Regulation): you have the right to access your personal data and to request that they be corrected, modified, or integrated. If you wish, we will provide you with a copy of your data in our possession.

Right to erasure (Art. 17 of the Regulation): in the cases provided for by current legislation, you can request the deletion of your personal data. Having received and analyzed your request, it will be our care to stop the processing and delete your personal data, if found legitimate.

Right to restriction of processing (Art. 18 of the Regulation): you have the right to request the restriction of the processing of your personal data in the case of unlawful processing or dispute of the accuracy of personal data by the data subject.

Right to data portability (Art. 20 of the Regulation): you have the right to request to obtain your personal data from the Data Controller in order to transmit them to another Controller, in the cases provided for by the referenced article.

Right to object (Art. 21 of the Regulation): you have the right to object at any time to the processing of your personal data carried out on the basis of our legitimate interest, explaining the reasons that justify your request; before accepting it, the Company will have to evaluate the reasons for your request.

Right to lodge a complaint (Art. 77 of the Regulation): you have the right to lodge a complaint before the competent Data Protection Authority if you believe that a violation of your rights has occurred, or is ongoing, in reference to the processing of your personal data.

At any time you can exercise your rights with reference to the specific processing of your personal data by the Company. Without prejudice to what has been expressed so far, we remind you that the above rights can also be exercised by anyone who has their own interest, or acts for your protection, as your agent, or for family reasons deserving protection, pursuant to Art. 2-terdecies of Legislative Decree 101/2018. These rights can be exercised via email to justhotelsrl@legalmail.it or ordinary mail to the address: Just Hotel S.r.l. a socio unico, Via Ceresio, 49 - 22074 Lomazzo (CO). Further information about the rights of the data subject can be obtained by asking the Data Controller for a full extract of the articles mentioned above.

9. Security Measures

The Company adopts appropriate security measures to safeguard the confidentiality, integrity, completeness, and availability of the data subject's personal data. Technical, logistical, and organizational arrangements are put in place with the aim of preventing damage, even accidental loss, alteration, improper, and unauthorized use of the processed data. Furthermore, the Data Controllers cannot be held responsible for untruthful information sent directly by the user (example: correctness of the email address or postal address), as well as information concerning them that has been provided by a third party, even fraudulently.

10. Changes to This Policy

The constant evolution of our services may involve changes in the characteristics of the processing of your personal data described so far. This privacy policy may undergo updates and additions over time, as necessary due to new regulatory interventions regarding the protection of personal data, or the evolution/modification of our services. We therefore invite you to periodically check the contents of our policy: where possible, we will try to inform you promptly about the changes made and their consequences. The updated version of the privacy policy, in any case, will be published on the Company page, indicating the date of its last update.

11. Date of Last Update

Lomazzo, 21/05/2026