Personal data processing notice

1. Data controller

Massimo Esposito. Address for the purposes of this notice: Pescoluse (LE), Strada Comunale Salve-Pescoluse, s.n.c. For any information or request concerning the processing of personal data and the exercise of the rights provided by the GDPR: info@villailgigliodelsud.it.

2. No cameras inside the villa

There are no active cameras inside the villa intended for the video surveillance of guests. The indoor spaces made available to guests during their stay are therefore not subject to video surveillance. In this way the Controller intends to guarantee guests full privacy inside the house.

3. Outdoor camera under the loggia

There is an outdoor camera facing the area under the loggia of the villa, above the laundry room, at the top left when facing the door of that room. Although this device is installed for the security of the property, during guests' stays its field of view is masked/disabled, so that no video surveillance of guests takes place in the loggia area. This is a further measure adopted by the Controller to protect guests' privacy.

4. Perimeter outdoor cameras active for security reasons

For the security of the property and its appurtenances, only cameras placed in specific outer and peripheral areas of the property remain present and operational. In particular, the following areas are under video surveillance:

• the side of the villa along the access driveway;
• the rear of the villa, in the area where the water cistern is located.

These areas are duly marked with video surveillance signs, placed so as to inform people in advance of the presence of the cameras. The cameras are used exclusively for the security and protection of the property, and for the prevention and investigation of any unauthorised access, damage, theft, vandalism or other events liable to harm people or the property.

5. Types of data processed

The system may capture images of people passing through the outdoor areas actually under video surveillance. No data beyond what is strictly necessary for the security purposes described above is intentionally collected. The system is not used to profile guests, nor to monitor their habits, behaviour or activities during their stay.

6. Purposes and legal basis of the processing

Images are processed exclusively for:

• the protection and safety of people;
• the protection of the villa and its appurtenances;
• the prevention and, where necessary, the investigation of theft, damage, intrusion, vandalism or other unlawful events;
• the protection of the Controller's rights in the event of incidents that may give rise to civil or criminal liability.

The legal basis for the processing is the legitimate interest of the Controller, pursuant to Article 6(1)(f) of the GDPR, in the safety of people and the protection of the property and the goods within it. The system is used according to the principles of necessity, proportionality and data minimisation.

7. How the data is processed

Images are processed by electronic means and video surveillance systems. The cameras are positioned and oriented so as to limit recording to the areas actually necessary for the security purposes set out above. The processing is carried out with technical and organisational measures designed to prevent, as far as reasonably possible, unauthorised access to the images, their disclosure, alteration or use for purposes incompatible with those stated in this notice.

8. Retention period of the images

Any recorded images are kept solely for the period necessary for the security purposes for which they are collected and are in any case automatically deleted no later than 15 days after the end of the stay and the guests' departure from the villa. Images may be kept for a longer period only where this is necessary in relation to a specific security incident, to the defence of a legal claim, or following a request or order from the judicial authorities, the police, public security authorities or another competent public authority. Once the applicable period has elapsed, the images are deleted or overwritten.

9. Disclosure of and access to the images

The images are not disseminated and are not made available to the public. Access is limited to the Controller and to any persons specifically authorised or entrusted with the technical management of the system. The images may be disclosed to the judicial authorities, the police, public security authorities or other competent authorities where this is provided for by law or requested in the exercise of their institutional functions.

10. Transfers of data to third countries

The Controller does not intend to transfer the images to countries outside the European Economic Area. Should the technological services used to operate the system involve a transfer of data to third countries, such a transfer may take place only in compliance with the conditions and safeguards laid down in Articles 44 et seq. of the GDPR.

11. Nature of the provision of data

Images are recorded as a result of passing through the limited outdoor areas under video surveillance. The presence of the cameras and the identification of the monitored areas are indicated by dedicated signage.

12. Rights of the data subject

Within the limits and under the conditions laid down by the GDPR, data subjects may exercise the rights granted by Articles 15 et seq. of the Regulation, in particular to:

• obtain confirmation as to whether or not personal data concerning them is being processed;
• obtain access to their personal data;
• request the erasure of the data where the relevant conditions are met;
• request the restriction of the processing;
• object, on grounds relating to their particular situation, to processing based on legitimate interest;
• obtain the further information provided for by applicable law.

Given the particular nature of data captured by video surveillance, the exercise of some rights may be subject to limitations arising from the technical characteristics of the processing and from the need to protect the rights and freedoms of other people who may appear in the images. Any request should be addressed to info@villailgigliodelsud.it. To make it possible to identify the images concerned, it may be helpful to state in the request the date, the time range and the area of the villa involved.

13. Right to lodge a complaint

If data subjects believe that the processing of their personal data infringes the GDPR, they have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali), pursuant to Article 77 of the GDPR, without prejudice to any other administrative or judicial remedy provided by law.

14. Information provided by signage

Dedicated information signs are placed near the areas actually under video surveillance, to give advance notice of the presence of the cameras. This document constitutes the extended notice and supplements the summary information shown on that signage.