Chatbot privacy policy

1. Data controller

The data controller is Hotel Arabesque, Piazza Cappello da Prete 50, 17024 Varigotti — Finale Ligure (SV), Italy. Email: info@hotelarabesque.it. Phone: +39 019 2077206. VAT: 01900880095.

2. Data processed

The chatbot may process: the content of conversations (messages you type, which may include contact details, preferences and requests); restaurant booking data if you use this feature (first and last name, phone number, optional email, date, time, number of people, optional notes such as intolerances or preferences); technical data (date and time of interaction, browser language).

Please do not enter special category data (ethnic origin, political or religious opinions, data on health or sexual life). Such data is not necessary for the service and, if entered, will be deleted as soon as possible.

3. Purposes and legal basis

Response to information requests — legal basis: explicit consent (Art. 6.1.a GDPR) given when the chatbot is opened.

Registration of restaurant bookings — legal basis: pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR).

Retention of history for operational management — legal basis: legitimate interest of the controller (Art. 6.1.f GDPR) for the correct management of bookings.

4. Recipients and extra-EU transfers

To generate automatic replies, the content of conversations is transmitted to OpenAI, L.L.C. (USA) as an external data processor. The extra-EU transfer takes place on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission and the Data Processing Addendum signed with the controller. OpenAI does not use the data received via API to train its models.

Booking data may also be transmitted to the SMTP provider for sending the email notification to the hotel and to authorised hotel staff who manage bookings.

5. Retention period

Chat conversations: not stored permanently, kept only for the duration of the browsing session.

Restaurant bookings: kept for up to 24 months from the booking date, for accounting and operational management purposes, after which they are automatically deleted.

6. Rights of the data subject

You have the right, at any time, to request from the controller access to your data, rectification, erasure, restriction of processing, portability, as well as to object to processing or withdraw the consent given (without affecting the lawfulness of processing already carried out).

To exercise your rights you can write to info@hotelarabesque.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

7. Nature of the provision

Providing data through the chatbot is optional. Failure to consent will prevent the use of the virtual assistant service; direct contact remains available by phone (+39 019 2077206), WhatsApp or email (info@hotelarabesque.it).

8. Automated decision-making

The chatbot uses an artificial intelligence model to generate text replies, but does not make automated decisions with legal effects on the data subject. Replies are purely informational and do not replace confirmation by hotel staff.