Privacy notice
Information on the processing of personal data under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Last updated: 21 October 2026
This notice explains how Paradise Pictures srl processes the personal data of people who visit the Cinema Boutique Collection website, ask for information, book or stay at the property.
Data controller
Paradise Pictures srl
- Address
- Via Ezio Vanoni 15, 80011 Acerra (NA)
- VAT number
- 07749601212
- info@cinemaboutiquecollection.com
- Phone
- +390697637728
What data we process
- Identification and contact details: first and last name, email, phone, language and, where needed for the invoice, address and tax details.
- Booking and stay details: dates, room, number and type of guests, special requests, amounts and payments.
- If you tell us about your health (for example allergies or accessibility needs), we use it only to meet your request and with your explicit consent (Art. 9(2)(a) GDPR).
- Payment details: full card details are handled directly by the payment provider; we only receive the outcome and the transaction references.
- Identity document details and personal details of every guest (place and date of birth, citizenship), which the law requires us to collect at check-in.
- The content of the messages you send us, including through the site's chat agent.
- The details you choose to leave in the chat (for example name, email or phone) to be contacted back or receive an offer.
- If you choose to talk to the agent by voice, your voice is processed to transcribe it and answer you; it is not used to identify you.
- Browsing data: IP address, browser and device type, pages visited, date and time of requests, collected automatically by the systems that run the site.
- Your email address and preferences, if you subscribe to the newsletter.
- If you book through a portal (for example Booking.com, Airbnb or Expedia), we receive the booking details from that portal.
Why we process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your requests for information and quotes. | Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). |
| Managing the booking, the stay, payments, any access to the property and service communications before, during and after the stay. | Performance of a contract (Art. 6(1)(b) GDPR). |
| Reporting guests' details to the police (Questura) through the State Police's Alloggiati Web service. | Legal obligation: Art. 109 of Royal Decree 773/1931 (TULPS) (Art. 6(1)(c) GDPR). |
| Sending arrival and overnight-stay data to the regional statistics offices and ISTAT, without guests' names or documents. | Legal obligation: Legislative Decree 322/1989 and regional law (Art. 6(1)(c) GDPR). |
| Applying, collecting and declaring the tourist tax to the municipality, where it applies. | Legal obligation: Art. 4 of Legislative Decree 23/2011 and municipal regulations (Art. 6(1)(c) GDPR). |
| Meeting tax and accounting obligations: invoices, receipts and registers. | Legal obligation (Art. 6(1)(c) GDPR). |
| Answering the questions you ask the site's chat agent. | Pre-contractual steps taken at your request and our legitimate interest in providing quick assistance (Art. 6(1)(b) and (f) GDPR). |
| Sending you the newsletter with news and offers, if you subscribe. | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the link in every email. |
| Keeping the site and payments secure and preventing abuse and fraud. | Legitimate interest (Art. 6(1)(f) GDPR). |
| Establishing, exercising or defending legal claims. | Legitimate interest (Art. 6(1)(f) GDPR). |
| Statistics, external content and marketing through cookies, as described in the Cookie Policy. | Consent (Art. 6(1)(a) GDPR and Art. 5(3) of Directive 2002/58/EC), which you can withdraw at any time. |
Do you have to provide your data?
The data needed to book is essential: without it we cannot confirm the booking. The data requested at check-in is required by law: without it the property cannot host you. All other data is optional.
Who we share data with
- Our authorised and trained staff (Art. 29 GDPR).
- Providers that process data on our behalf as processors (Art. 28 GDPR), bound by contract: the platform that runs the site, bookings and messages, and hosting, email and messaging services.
- For the chat agent, providers of artificial intelligence services that process messages to generate answers, also as processors.
- The payment provider and card networks, as independent controllers.
- The booking portals the booking comes from, as independent controllers.
- Authorities when the law requires it: the police (Alloggiati Web), regional statistics offices and ISTAT, the municipality for the tourist tax, the Italian Revenue Agency.
- Advisers and professionals (for example the accountant), bound by confidentiality.
We do not sell your data and we do not publish it.
Transfers outside the European Union
Some providers may process data outside the European Economic Area, in particular in the United States. Transfers only take place to countries covered by a European Commission adequacy decision (for the United States, the EU-US Data Privacy Framework) or under standard contractual clauses approved by the Commission (Articles 45 and 46 GDPR).
How long we keep data
- Information requests: as long as needed to answer and to handle any booking that follows.
- Bookings, invoices and accounting records: 10 years, as required by law (Art. 2220 of the Italian Civil Code).
- Copies of identity documents uploaded for online check-in are deleted automatically after they are sent to Alloggiati Web; the transmission receipt is kept for the period set by law.
- Messages and chat conversations: as long as needed to handle the request and our relationship with you.
- Newsletter: until you unsubscribe.
- Browsing data and technical logs: only as long as strictly needed for security, unless needed to investigate offences.
- Cookies: for the duration stated in the Cookie Policy.
After that, data is deleted or anonymised.
Your rights
At any time you can ask to access your data, to correct or erase it, to restrict its processing, to receive it in a structured format (portability) and to object to processing based on legitimate interest (Articles 15–21 GDPR). You can withdraw consent at any time, without affecting processing already carried out. To exercise your rights write to info@cinemaboutiquecollection.com: we reply within one month.
Complaints
If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.
Automated decisions and artificial intelligence
We do not take decisions based solely on automated processing that produce legal or similarly significant effects on you (Art. 22 GDPR).
The site's chat agent is an artificial intelligence system and says so at the start of the conversation. Its answers may contain mistakes and do not replace the booking terms.
Cookies
For the cookies and similar tools used by the site, and to change your choices, read the Cookie Policy.
Changes to this notice
We may update this notice: the date at the top shows the latest change.