Privacy Policy

Effective date: August 2, 2026

This privacy policy for Hotel La Baita ("We" or "Us") describes how we collect, use and share your data when you visit our website https://hotellabaita.com/.

We're glad you've decided to use our website https://hotellabaita.com/ and to entrust us with your valuable personal data. In this document, we try to explain our privacy practices as clearly as possible. We strongly encourage you to read this document (and any related documents) carefully before using the website. If you disagree with any part of this document, please do not use the website or, if you are already using it, please stop using it immediately. By using the website, you accept and agree to the practices described in this privacy policy.

What data do we collect about you?

We collect data to make sure you can use our service smoothly. For this reason, we collect the following personal data:

• Name
• Email address
• Room preference
• Check-in and check-out dates
• Number of adults and children
• Children's ages
• Message/special requests

How do we collect this data?

We may use any of the following three ways to obtain information about you.

1. Data you give us
2. Data we automatically collect from you
3. Data we collect from third parties

Before going into why we collect this information, we want to explain what the three terms above mean.

a. Data you give us

When you fill out the booking request or contact form on our website, we ask for some information, such as your name, email address and stay details. This is the data you give us directly.

b. Data we automatically collect from you

When you access our website from a device, we may automatically collect some data from your device, for example through the use of cookies.

c. Data we collect from third parties

These third parties can include data aggregators, online directories, data marketplaces or exchanges, etc., from which we may collect data about you.

Cookies and similar technologies

Cookies are small packets of information placed on your device that allow us to retrieve data about you, such as your login information, your choices on our website and other information.

For more information about cookies and similar technologies, see our Cookie Policy.

Do Not Track requests

We respond to "Do Not Track" requests as follows:

Our website does not currently respond to "Do Not Track" (DNT) browser signals, as there is not yet a universally accepted technical standard for handling them. Cookie preferences can still be managed at any time via the cookie consent banner on the site.

Why do we collect data about you?

We collect data about you for a number of reasons, which help us, among other things, serve you better. Below are the ways in which we use the data we collect about you:

• To provide and maintain the service
• To perform a contract with us
• To contact the user
• To manage user requests related to business transfers, such as when our business is acquired, merged, restructured, or otherwise sold or transferred to another entity, in whole or in part
• To evaluate and improve our services

How long do we keep your data?

We will only keep your personal data for as long as necessary, unless a longer retention period is required or permitted by law (for example, for tax or accounting reasons or other legal requirements). This notice does not identify any purpose that requires us to keep your personal data for longer than the period during which you have an ongoing relationship with us.

Where we no longer have a legitimate business need to process your personal data, we will delete or anonymise it, or, if this is not possible (for example, because your personal data has been stored in backup archives), we will securely store your data and prevent any further processing until deletion is possible.

Do we share your data?

We may share your data with third parties in the following ways:

1. Sharing with your consent: when you give consent, we may share your data with third parties for the purposes mentioned in the consent request.
2. Legal obligations: we may disclose data where we are legally required to do so in order to comply with applicable law, requests from government bodies, judicial proceedings, or a court order, including in response to requests from public authorities for national security or law enforcement purposes.
3. Business transfers: we may share your personal data in connection with, or during negotiations for, a merger, sale of company assets, financing or acquisition of all or part of our business by another party.

Sharing/selling of information

We do not sell or share the data we collect from our users.

GDPR Disclosures

Cross-border data transfer

The data we collect from you, including your personal data, may be processed in places outside the European Union, where data transfer laws may differ from those in force in your jurisdiction. In some cases the transfer may be to countries classified as "adequate" by the European Union (see here for information on adequate countries). Where the transfer is not to an adequate country, however, we have adopted the following legal measures under the General Data Protection Regulation to ensure that your personal data is well protected.

Standard Contractual Clauses: when we transfer data collected from you, including personal data, to third countries not considered adequate, we have entered into agreements that include the Standard Contractual Clauses required by the GDPR with the parties processing data in those countries. For more information on Standard Contractual Clauses, read here.

Automatic data processing

We do not use any automated processing of the personal data we collect.

Legal basis for the collection

The General Data Protection Regulation requires us to identify and state the legal basis — in other words, a legal justification — for processing your personal data. Below are the legal bases that justify the processing of your personal data.

Consent: we may process your data, for the purposes set out in this privacy policy, with your consent to the processing of the personal data collected from you for those purposes.

Performance of a contract: where we have entered into a contract with you, we may use the personal data collected from you to fulfil the obligations of that contract.

Legal obligations: we may disclose data where we are legally required to do so in order to comply with applicable law or government requests, in the event of judicial proceedings, a court order or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).

Legitimate interests: we may process your data when it is reasonably necessary to pursue a legitimate business interest of ours. The controller has a legitimate interest in processing data to ensure the correct functioning and security of the website, to respond to information and booking requests submitted through the contact form, and for statistical and service-improvement purposes.

Your rights

Under Articles 12 to 23 of the General Data Protection Regulation, you, the data subject, have the following rights:

1. Right to object to the processing of personal data in certain circumstances. See here for details.
2. Right to request the data we have collected about you and to receive a copy of it in an accessible format.
3. Right to restrict processing for a limited period, in certain circumstances. See here for details.
4. Right to rectify data collected about you that you consider outdated, incomplete or inaccurate.
5. Right to object to automated processing of your data.
6. Right to erasure of your personal data, also known as the right to be forgotten.

To exercise any of the rights mentioned above, you may use the contact details provided in this privacy policy.

Consequences of not giving consent

We need your consent to collect data, in order to provide you with our services smoothly. You may, however, choose not to give consent. Please note that refusing consent may have consequences, including being unable to complete a booking request through the website's form.

Children's privacy

We do not knowingly provide our services to minors through the website. If you are a parent or legal guardian and believe your child has provided us with data without your consent, please contact us: after verifying the circumstance, we will remove such data from our database.

Security of your personal data

We make sure that the data we collect from you is stored carefully and as securely as possible. However, no measure can guarantee absolute security, since no method of internet transmission or digital storage is completely secure. We work to keep your data safe using commercially acceptable security systems, but we cannot promise absolute security.

Links to other websites

Our website may include links to external websites or services. These are not operated by us and are not covered by our privacy policy. We recommend reading the privacy policies of such websites before interacting with them, to avoid inadvertently providing personal data.

Changes to this privacy policy

We may make changes to our privacy policy from time to time, to reflect regulatory changes or changes in our practices. We recommend checking it periodically. This privacy policy will be in effect from the date it is published on this page.

Contact us

For any questions or concerns about privacy, or to exercise any of your rights, you can contact us at the following details:

Data controller: Hotel La Baita VAT number: IT00836870220 Address: Piazza Brenta Alta, 17 — Madonna di Campiglio (TN), Italy Email: info@hotellabaita.com Phone: +39 0465 441066