Chatbot privacy policy

1. Data controller

The data controller is Hotel Arabesque, Piazza Cappello da Prete 50, 17024 Varigotti — Finale Ligure (SV), Italy. Email: info@hotelarabesque.it. Phone: +39 019 2077206. VAT: 01900880095.

2. Data processed

The chatbot processes: the content of conversations (the messages you write, which may include contact details, preferences and requests); if you ask to forward a request to the hotel, the name and the email or phone number you provide; technical data (date and time, page language, browser type and a pseudonymous code derived from the IP address, used only against abuse). To work, the chatbot stores in your browser's memory a random identifier, the ongoing conversation and the consent you gave. The chatbot does not record restaurant reservations: to book, it directs you to the website's form, whose data is processed as described in the website privacy policy.

Please do not enter special categories of data (ethnic origin, political or religious opinions, health or sex life data). Such data is not needed for the service and, if entered, will be deleted as soon as possible.

3. Purposes and legal basis

Answering your information requests — legal basis: explicit consent (Art. 6.1.a GDPR) given when opening the chatbot.

Forwarding one of your requests to the hotel by email, if you ask for it — legal basis: pre-contractual measures taken at your request (Art. 6.1.b GDPR).

Quality control and correction of the assistant's replies by authorised hotel staff — legal basis: the Controller's legitimate interest (Art. 6.1.f GDPR).

4. Recipients and extra-EU transfers

The chatbot is provided by EASYLOOP S.R.L. through its ChatBoss service, data processor under Art. 28 GDPR, which stores conversations on servers located in the European Union (Germany). To generate automatic replies, messages are sent to OpenAI (USA), acting as sub-processor: the transfer outside the EU is based on the EU-US Data Privacy Framework and the Standard Contractual Clauses approved by the European Commission. OpenAI does not use data received via its API to train its models.

If you ask to forward a request, the data passes through the email provider that delivers the message to the hotel. Conversations may be read by authorised hotel staff.

5. Retention period

Chat conversations: 90 days after the last message, then deleted automatically. Requests forwarded to the hotel through the chatbot: 24 months, then deleted automatically. Conversations held up to 31 October 2026 with the previous assistant are kept for the period stated at the time (up to 24 months) and then deleted automatically.

6. Rights of the data subject

You have the right, at any time, to request from the controller access to your data, rectification, erasure, restriction of processing, portability, as well as to object to processing or withdraw the consent given (without affecting the lawfulness of processing already carried out).

To exercise your rights you can write to info@hotelarabesque.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

7. Nature of the provision

Providing data through the chatbot is optional. Failure to consent will prevent the use of the virtual assistant service; direct contact remains available by phone (+39 019 2077206), WhatsApp or email (info@hotelarabesque.it).

8. Automated decision-making

The chatbot uses an artificial intelligence model to generate text replies, but does not make automated decisions with legal effects on the data subject. Replies are purely informational and do not replace confirmation by hotel staff.