Privacy without compromise.

This notice explains how Reservation Hotels Italy S.r.l. ("R.H.I.", "we") processes personal data collected through this website, as required by Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and by Legislative Decree 196/2003 (Italian Privacy Code).

Data controller

Reservation Hotels Italy S.r.l., Via dei Prati Fiscali 201, 00141 Rome, Italy. VAT no. 12822941006. Email: incoming@rhigroup.it. Telephone: +39 06 8620 0036.

Requests sent through the contact form

Data. Your name, email address and message, and your telephone number if you give it; the programme, product or trade fair your request is about, if any; the page of this website from which you sent the request (without any query string); and how you found us: the type of source that brought you to the site (for example a search engine, an AI assistant, a campaign link or another website), the domain of that source, the first page you visited, the campaign name of a tagged link, and your optional answer to "How did you hear about us?".

Purposes and legal basis. To answer your request and prepare a proposal or quotation at your request (Article 6(1)(b) GDPR: steps taken before a contract), and to understand which channels bring us requests, in our legitimate interest in organising our business (Article 6(1)(f) GDPR). We send you an automatic confirmation that we have received your request, and the request is delivered by email to our office.

Retention. Requests are deleted from the website database automatically 24 months after they are received. Correspondence that continues by email or leads to a booking is handled outside this website, under the terms that apply to that relationship.

Job applications

Data. Your full name, your email address if you give it, the short description you write, your CV file, and the date and time at which you confirmed that you had read this notice.

Purpose and legal basis. To assess your application for a position with us, at your request (Article 6(1)(b) GDPR). Consent is not required for CVs sent on the candidate's own initiative (Article 111-bis of the Italian Privacy Code). Please do not include data about your health, religion, political opinions or trade-union membership, or a photo, unless they are relevant to the role.

Retention. Your CV is emailed to the staff responsible for recruitment and deleted from the website storage as soon as the email has been delivered, and in any case within 30 days. A CV whose application was not completed is deleted within one hour. The application record, without the CV, is deleted automatically 12 months after it is received.

Website statistics

We measure visits with Umami, an open-source analytics tool that runs on our own server in Italy. It sets no cookies and stores nothing on your device. Your IP address and browser information are used only at the moment of the visit, to work out an approximate location (country, region and city) and a pseudonymous visit code that changes every day; the IP address itself is not stored. We record the pages viewed, the referring website, campaign parameters in the page address (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the browser, operating system, device type, screen size and language, interactions such as clicks on contact links and form submissions (never what you type), and page-speed measurements. We only look at aggregated statistics. Legal basis: our legitimate interest in understanding how the website is used (Article 6(1)(f) GDPR). Statistics are deleted automatically after 25 months.

Cookies and similar technologies

We do not use profiling cookies, and this website sets no cookies for visitors. Google may set its own cookies only if you choose to load the map (see "Map" below). When our editors preview unpublished content, they receive technical cookies needed for the preview, and the website stores a setting in their browser so that their own visits are not counted in the statistics. The statistics tool only reads that setting and writes nothing to your device.

Server logs and security

Our web server records technical information about each request (date and time, the address requested including any parameters in it, the page you came from, response code, browser type and language, and a shortened IP address with the last part removed) to keep the website secure and working. These logs are deleted automatically after 14 days. To protect our forms from abuse, your full IP address is kept in the server's memory for up to 10 minutes when you send a form, and is never written to disk. Legal basis: our legitimate interest in the security of the website (Article 6(1)(f) GDPR).

Map

Our contact pages load a Google Maps map only if you click "Show map". Google then receives your IP address and browser information and may set its own cookies; it processes these data as an independent controller under its own privacy policy and may transfer them to the United States under the EU-U.S. Data Privacy Framework. If you do not click, no data is sent to Google.

Who receives the data

Data are handled by the members of our staff who need them for the purposes above. The website, its database and our email service are hosted by Aruba S.p.A. in Italy, which acts as our data processor. The provider that maintains the website on our behalf may access the data only to give technical support, also as our data processor. We do not sell personal data or share it for advertising.

Transfers outside the European Union

We do not transfer personal data outside the European Union, except through the map described above if you choose to load it.

Backups

To protect against data loss, copies of the website database are made every day and kept for up to 93 days; copies stored away from our server are encrypted. Data deleted from the website remain in these copies until the copies expire.

Your rights

You can ask us at any time for access to your data, for rectification or erasure, for restriction of processing and for data portability, and you can object to processing based on our legitimate interest (Articles 15 to 22 GDPR). Write to incoming@rhigroup.it. If you believe your data are processed unlawfully, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Giving us your data is not compulsory, but without the data marked as required we cannot answer your request or assess your application. We do not take decisions based solely on automated processing.