Privacy Policy of B&B Ánemos
This Privacy Policy describes how the personal data of visitors and guests of the B&B Ánemos website is collected, used, and protected, in accordance with the General Data Protection Regulation (GDPR - Regulation EU 2016/679) and applicable Italian legislation.
1. Data Controller
The Data Controller of your personal data is:
Stefania Cannarsa
Address: via Luigi Einaudi, 6 – 86039 Termoli (CB) Italy
Phone: +39 0875 881 236
WhatsApp: +39 347 942 5541
Email: info@anemos-termoli.it
CIN Code: IT070078C19LSPOQUC
2. Types of Data Processed and Purposes
We process the following categories of personal data for the indicated purposes:
- Contact Form: We collect your name, email address, telephone number, and any information voluntarily entered in your message. These data are used exclusively to respond to your requests for information, quotes, or bookings.
- AI Chatbot: The website integrates a virtual assistant (AI chatbot) that processes text messages entered by the user in real time. This processing is performed via OpenRouter APIs. No persistent saving of the conversation texts is performed on the site's database. Solely for security and abuse prevention purposes (rate limiting), a salted MD5 hash of the visitor's IP address is generated and temporarily stored on the server. This hash does not allow the plain IP address to be reconstructed in any way and is automatically removed at the end of the session or within 24 hours.
- Navigation Logs: Web servers record visit logs for security and diagnostic purposes. IP addresses are masked at the source (anonymized in compliance with the GDPR) before writing. Therefore, the logs do not contain clear personal data and do not allow the identification of users.
3. Legal Basis for Processing
The processing of personal data is based on the following legal grounds:
- The execution of pre-contractual or contractual measures, for the management of information and booking requests.
- The consent of the data subject, expressed through the voluntary use of the contact form and the AI chatbot.
- The legitimate interest of the Data Controller, with reference to website security, the prevention of abuse (via rate limiting), and the optimization of the service.
4. Data Recipients and Transfer
Personal data is not sold, shared, or communicated to third parties for marketing purposes. It may be transmitted to third parties only in the following cases:
- Technology Service Providers: OpenRouter, solely for the temporary processing of queries sent to the chatbot (in compliance with their privacy policies, which exclude the use of data for model training).
- Legal Obligations: Public safety authorities (communication of guest details via the state police portal "Alloggiati Web", as required by Italian law).
Processing requests via the OpenRouter service may involve the temporary transfer of data to servers located outside the European Economic Area (specifically to the United States), which is governed by Standard Contractual Clauses (SCC) approved by the European Commission.
5. Data Retention Period
Data will be stored for a period that varies depending on the purpose:
- Contact data will be kept for the time strictly necessary to handle the request (maximum 12 months in the absence of a subsequent booking).
- Data relating to confirmed bookings will be kept for 10 years in compliance with tax, administrative, and public safety obligations prescribed by Italian law.
- The salted MD5 hash of the IP used for chatbot rate limiting is deleted within 24 hours.
- Anonymized server logs are kept for a maximum of 30 days.
6. Rights of the Data Subject
As a data subject, the user has the right to:
- Access their personal data and receive a copy.
- Obtain the rectification of inaccurate data or the integration of incomplete data.
- Request the deletion of data (right to be forgotten) if it is no longer necessary for the purposes or if there are no other legal obligations requiring its retention.
- Obtain the restriction of processing or object to it for legitimate reasons.
- Request the portability of data in a structured, commonly used, and machine-readable format.
- Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise these rights, the user can send a written request to the Data Controller at the email address info@anemos-termoli.it. If the user believes that the processing violates current regulations, they also have the right to lodge a complaint with a supervisory authority (such as the Italian Garante per la Protezione dei Dati Personali).