1. Collect data
2. How we use your information
3. How we share your information
4. Security of your information
5. Cookies and tracking technologies
6. Your data protection rights
7. Changes to this Privacy Policy
1.1 Personal information
1.2 Non-personal information
2.2 Non-personal information
3.1 Third Party Service Providers
3.2 Legal requirements
2.1 Personal information
Privacy Policy
Website Privacy Policy
Welcome. Your privacy is important to us. This privacy policy explains how we collect, use, disclose and protect your information when you visit our hotel and use our services.
Last updated: 23 October 2026
- Name
- Address
- E-mail address
- Phone number
- Payment Information
- Identification documents (e.g. passport, identity card)
- To process your bookings and reservations
- To communicate with you about your stay
- To provide customer service and support
- To comply with legal obligations
- To personalize your experience
We may disclose your information to comply with applicable laws, regulations or legal requests, including:
- To respond to subpoenas or court orders
- To protect the rights, property or safety of our hotel, our guests or others
- To prevent or investigate possible wrongdoing in relation to our services
- To comply with legal obligations or regulatory requirements
We implement various security measures to protect your personal data. However, no method of transmission over the Internet or method of electronic storage is completely secure, so we cannot guarantee its absolute security.
We use cookies and similar tracking technologies to monitor activity on our website and to store certain information. You can set your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some parts of our website.
Measuring our ads on ChatGPT (OpenAI)
Only with marketing consent: when you book on the booking engine, the email address and phone number you enter are turned in your browser into irreversible encrypted codes (SHA-256) before they leave the page. These codes, your country, the booking reference and amount and the chosen apartment are sent to OpenAI to understand whether the booking comes from one of our ads. The same data also pass through our server on prenota.10manzoni.com (Cloudflare), which adds your IP address and browser type and forwards them to OpenAI without keeping them; we keep only the event code for 8 days, so as not to send it twice. The same happens, without email and phone, when you start a booking or contact us via WhatsApp or phone. First and last names are never sent. The encrypted codes stay in your browser only in the booking tab and are deleted once sent. If you do not accept marketing, nothing is sent. Details and withdrawal of consent in the Cookie policy.
Only with consent to marketing cookies, we also use Google Ads and the Meta Pixel. Google receives the identifier of the click on one of our ads (gclid), the page and the event and, for a booking, its amount and reference, to know which ads bring bookings and contacts. Meta receives page views, apartment pages, the start of a booking, contacts via WhatsApp or phone and the booking (amount and reference), to measure our ads on Facebook and Instagram and show them to people who have already visited the site. We do not send your email address or phone number to Google or Meta, not even encrypted. Cookies, durations and the providers' policies are in the cookie policy.
Depending on your location, you may have the following rights regarding your personal data:
- Right of access – You have the right to request copies of your personal data.
- Right to rectification – You have the right to ask us to correct any information you believe is inaccurate.
- Right to erasure – You have the right to request that we erase your personal data, under certain conditions.
- Right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
- Right to object to processing – You have the right to object to the processing of your personal data, under certain conditions.
We may update our privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page. We encourage you to periodically review this policy for updates.
Information on the processing of personal data "video surveillance"
Last updated: February 7, 2025
1. Who is the Data Controller (who decides what data to process and how)?
The Data Controller, as defined by Art. 4. par. 1, n. 7 of EU Regulation 2016/679 (General Data Protection Regulation, hereinafter referred to as GDPR) is Floor srl, with registered office in Via Ghisleri, 22 - 26100 Cremona (CR), CF and PI 01658620198, hereinafter referred to as the “Company”.
Pursuant to Art. 13 of the GDPR, the following information is provided regarding the processing of personal data.
2. Who are the interested parties (the recipients of this information)?
The interested party is the natural person to whom the personal data processed by the Company refers.
For the purposes of this disclosure, the interested party is anyone who accesses the Company's facility or who enters the range of the video cameras, hereinafter referred to as the "Interested Party".
3. What data is collected, the purposes and legal bases of the processing (for what reason is the data collected)?
Video surveillance (images and related footage) is carried out for organizational and production needs and/or for the protection of company assets and/or for security.
The legal basis that legitimises the processing is the legitimate interest of the Company (Art. 6(1)(f) GDPR).
4. Is the provision of data mandatory or optional?
The provision of data, with regard to the processing referred to in the previous point 3, must be considered optional.
Any refusal by the interested party to be filmed implies that the same will not access the facility or will remain at a safe distance from the video-monitored areas.
5. Where is the data processed, how and for how long?
The data collected are processed at the Company's headquarters or at the offices of the subjects authorised to process them.
The data collected will be processed using electronic or otherwise automated, computerized and telematic tools, or through manual processing with logic strictly related to the purposes for which the personal data were collected and, in any case, in a way that guarantees their security in any case.
The data is stored for the time strictly necessary to manage the purposes for which the data is processed (“principle of limitation of storage”, art. 5, EU Regulation 2016/679) or in compliance with the deadlines set by current regulations and legal obligations. Specifically, with reference to the purposes indicated in point 3, the retention period of the recordings is 2 days.
In any case, the Company practices rules that prevent the storage of data for an indefinite period and therefore limits the storage time in compliance with the principle of minimization of data processing.
6. Who is authorised to process the data and to whom can they be communicated?
The processing of the collected data is carried out by internal personnel of the Company in compliance with current legislation.
The data collected, within the limits strictly relevant to the indicated processing purposes and if it is necessary or instrumental for the execution of the purposes themselves, may be processed by third parties appointed as external Data Processors, or, depending on the case, communicated to the subjects who will be necessary for the correct execution of the purposes set out in point 2 of this information.
The data collected may be provided in the event of a legitimate request, only in the cases provided for by law, by the Judicial Authority.
Under no circumstances and for no reason will your data be disclosed in any way.
7. Can the processed data be transferred to non-EU countries?
The data may be transferred abroad to non-European countries, and in particular to the United States, only after verification of the standard contractual clauses (Standard Contractual Clauses) adopted/approved by the European Commission pursuant to art. 46, par. 2, letters c) and d) of the GDPR or the binding rules for the company pursuant to art. 47 of the GDPR or, in their absence, pursuant to one of the derogating measures pursuant to art. 49 of the GDPR.
The transfer to the United States is authorized under the specific agreement called EU-US Data Privacy Framework (available here), for which no further consent is required.
8. What are the rights?
In relation to the personal data communicated, the interested party has the right to exercise the following rights:
- (art. 7.3 EU Regulation 679/2016 – GDPR) withdrawal of consent;
- (art. 15 EU Regulation 679/2016 – GDPR) access and request a copy;
- (art. 16 EU Regulation 679/2016 – GDPR) request rectification;
- (art. 17 EU Regulation 679/2016 – GDPR) request cancellation (“right to be forgotten”);
- (art. 18 EU Regulation 679/2016 – GDPR) obtain the limitation of the processing;
- (art. 20 EU Regulation 679/2016 – GDPR) receive them in a structured, commonly used and machine-readable format for the purposes of exercising the right to portability;
- (art. 21 EU Regulation 679/2016 – GDPR) to oppose the processing.
The interested party may exercise his/her rights, as well as request further information relating to his/her Personal Data, by sending an email to info@10manzoni.com specifying in the subject the content of his/her request.
Requests relating to the exercise of the rights of the Interested Party will be processed without unjustified delay and, in any case, within one month of the request; only in cases of particular complexity and of the number of requests, this term may be extended by a further 2 (two) months.
We remind you that it is your right (pursuant to art. 77 of EU Regulation 679/2016 – GDPR) to lodge a complaint with the Data Protection Authority, whose contact details are available here.
9. Simplified information pursuant to art. 3.1 of the Video Surveillance Provision
The video-surveillance areas are indicated with special signs, in accordance with art. 3.1 of the Video Surveillance Provision, clearly visible in all ambient lighting conditions, where the purposes pursued are also recalled. These signs are placed before the range of action of the cameras or in any case in their immediate vicinity.
We may share your information with third-party service providers who assist us in:
- Payment Processing
- Marketing and advertising
- Website hosting and maintenance
- Customer Service
- OpenAI (measurement of our ads on ChatGPT, only with marketing consent) and Cloudflare (our server on prenota.10manzoni.com, which forwards the events to OpenAI)
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), for Google Ads: measures whether a booking or a contact comes from one of our ads on Google, only with consent to marketing cookies. Data may be transferred to Google LLC in the United States under the EU-US Data Privacy Framework. Privacy policy: https://policies.google.com/privacy?hl=en
- Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland), for the Meta Pixel: measures our ads on Facebook and Instagram and shows them to people who have already visited the site, only with consent to marketing cookies. For collecting data with the pixel and transmitting them to Meta, FLOOR S.R.L. and Meta are joint controllers (art. 26 GDPR) under Meta's Controller Addendum (https://en-gb.facebook.com/legal/controller_addendum). Further processing is Meta's, as controller. Data may be transferred to Meta Platforms, Inc. in the United States under the EU-US Data Privacy Framework. Privacy policy: https://en-gb.facebook.com/privacy/policy/
- To analyze website traffic and usage patterns
- To improve our services and the functionality of the website
- For marketing and advertising purposes in aggregate form
- To ensure the security and performance of the website
- Browser type
- IP address
- Cookies and tracking technologies
- Aggregated data on website usage


