Privacy Policy

WHAT’S PRIVACY POLICY
This page describes the website’s management methods as concerns the handling of the personal data of users visiting it.
This notice is provided pursuant to Art. 13 of Legislative Decree. N. 196/2003 – Personal Data Protection Code to those who interact with web services of the company Blue Bay Company Ltd, electronically accessible from this website.

We inform that, pursuant to Art. 13 of The General Data Protection Regulation (GDPR) (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, all personal data provided will be processed in compliance with the regulations referred to and with all binding obligations of confidentiality.

All contents of this Site are owned and / or controlled by Blue Bay Company Ltd. and are protected by International Copyright laws.

THE DATA “CONTROLLER”
Pursuant to Article. 28 of Legislative Decree no. 196/2003, Controller of the Data is the Blue Bay Company Ltd registered office at PO box 46578 – 00100 – Nairobi – Kenya

THE DATA “PROCESSOR”
Pursuant to Article. 29 of Legislative Decree no. 196/2003, Data Processor is Blue Bay Company Ltd

Pursuant to Article. 29 of Legislative Decree no. 196/2003, the external data Controller for the site management and personal data acquisition during booking is the Company FASTBOOKING > Tour SEQUANA > 82 Rue Henry Farman CS 20077 > 92445 Issy Les Moulineaux Paris, France, owner of the hotel booking engine (www. fastbooking.com) incorporated into this website.

DATA PROCESSING LOCATION
The site is hosted on machines operated by an external company; however, the reports are forwarded to the data controller for the purpose of replying to users’ requests and guaranteeing the reservation.
The processing connected to this site’s web services, therefore, takes place on the premises of the controller and external processors in the relevant areas.
No data from the web service is communicated by the two companies to third parties unless strictly relevant to the purpose of the processing or imposed by law or regulation.

PURPOSE OF THE DATA PROCESSING
The personal data you make available may be utilised for the following:

without your express consent (art. 6 lett. b,e GDPR), for the following Service Purposes:
– to conclude of the contracts for the services of the Owner;
– to fulfil all pre-contractual, contractual and tax obligations deriving from relations with you;
– to fulfil the obligations established by law, by a regulation, by community legislation or by an order of the Authority;
– to exercise the rights of the owner, for example the right to defense before the Court;
– allow the user to use the Site.
with your specific and distinct consent (article 7 of the GDPR), for the following Marketing Purposes:
– to send via e-mail, mail and / or sms and / or telephone contacts, newsletters, commercial communications and / or advertising material on products or services offered by the Owner and recognition of the degree of satisfaction on the quality of services;
– send via e-mail, mail and / or sms and / or telephone contacts commercial and / or promotional communications of third parties (for example, business partners, insurance companies, etc.).
With reference to the purpose of direct marketing, the recipient has the right, at any time and free of charge, to oppose such processing pursuant to art. 21 GDPR.
If the recipient opposes to processing for direct marketing purposes, all Data are no longer processed for these purposes.

BOOKINGS
Personal data for the reservations shall be processed in electronic and paper format for the sole purpose of guaranteeing the rooms are booked in the conditions agreed.
The booking platform is owned by FastBooking, the external processor, which will communicate the data of the party concerned to the hotel for the normal activities related to managing the accommodation
The data shall be recorded in our electronic databases accessible to staff properly instructed and trained in personal data security and confidentiality.
To confirm the booking a credit card given as firm guarantee must be provided, it is understood that the customer can choose to pay in cash at the end of the stay.

CURRICULA MANAGEMENT
This Statement prepared in accordance with Art. 13 of Legislative Decree no. 196/2003 can be used by the company Blue Bay Company Ltd including for eventual advertisements on sites or portals not directly managed by the company Blue Bay Company Ltd to recruit staff.
The Company shall process the curricula received by e-mail or through third-party recruiting companies (publications on portals, etc.) to evaluate the potential applications inside the company or that might be made in the near future.
The processing occurs electronically excepting curricula received by post.
The curricula considered “interesting” shall be stored at the company headquarters for a period not exceeding one year and shall be processed while fully complying with the minimum security measures referred to in Art. 33, 34 and 35 of Legislative Decree no. 196/2003.
The curricula deemed irrelevant, as well as those retained over 12 months, shall be trashed.
The curricula shall be retained at the headquarters of the company and not disclosed to unauthorized third parties.
The same may be assessed by the company’s employees or collaborators appointed to be responsible for the processing (Art. 30 of Legislative Decree no. 196/2003).
However, the applicants are still invited to respect the following rules in transmitting the curricula in electronic format:
Fill in your own CV in European format; transmit the curriculum in pdf format; avoid putting sensitive data (relating, in particular, to state of health, religious, philosophical, or political beliefs) not relevant to the job offer in the curriculum; give consent to the processing.
The company reserves the right to trash the curricula that do not meet the above requirements.
The Company shall provide appropriate information pursuant to Art. 13 of Legislative Decree no. 196/2003 during any interviews with the applicants.
The purpose of the processing relating to managing the curricula shall concern activities closely relating to the appraisal, recruitment, or selection of personnel, for the purposes of collaboration, hiring on a temporary or permanent basis, internships, or rather to enable the successful applicant to prepare his degree thesis at our headquarters.

COMMERCIAL COMMUNICATIONS VIA E-MAIL
The society Blue Bay Company Ltd reserves the option of sending promotional and commercial e-mails in accordance with Art. 130 paragraph 4 of Legislative Decree no. 196/2003:
“if in the context of a sale of goods or of a service the Data Controller uses the customer’s e-mail address, the same address may be used for sending commercial and promotional material without seeking prior consent, provided the customer is duly informed at every mailing of promotional and marketing material and that he is able easily and freely to exercise the right to discontinue this processing.”
In that case, having received the first promotional message the data subject shall be able to cancel his subscription from the hotel newsletter with a simple click.
Sending these messages is entrusted to a third-party provider of email services.

DATA COMMUNICATION AND DISSEMINATION
Personal data collected from the website in question can be treated only by persons officially appointed and trained in the field of personal data privacy and security.
The contexts for communicating data subjects’ personal data may relate to:
Organizations or Public Offices on the basis of legal and / or contractual obligations; FastBooking companies; external processors as companies or consultants who carry out activities for the proper functioning of the site and management of the information acquired through the same on the controller’s behalf;
the Postal Police for determining whether any activities may be harmful to the company website;
to employees or service-providing companies when the communication is necessary for the person concerned to use the hotel services.
Personal data shall not be disclosed.

NAVIGATION DATA
During their normal operation software applications designed to run this website acquire some personal data whose transmission is implicit in the normal IP protocol of Internet communication.
While it is not collected to be associated directly with the data subjects, by its very nature through processing and subsequent correlation with data held by third parties (providers) this information could allow users to be identified.
This category of data includes IP addresses or domain names of computers used by users connecting to the site, the date and time of the request, the URI (Uniform Resource Identifier) of requested resources, the size of the files obtained in reply from the server, the digital code indicating the status of the response from the server (ok, error, etc..) and other parameters regarding the operating system and computer environment.
This data is used only to obtain anonymous statistical information about website usage and to check the site is functioning correctly; they are deleted immediately after processing.
This site may disclose personal data which, if required in accordance with law, may be communicated to the judicial authorities for the purposes of defending the State or the prevention, detection or suppression of crime, serve to ensure the protection of the personal data of data subjects’ enjoying online services of the site, for eventual defensive investigations as per Law no. 397 of 7 December 2000, or in any event to assert or defend a legitimate right and interest of the Controller in court while still complying with the principles of relevance and proportionality with respect to the processing’s purpose.

NON-OBLIGATORY NATURE OF THE DATA PROVISION
Unless otherwise specified as concerns navigation data, the user is free to provide personal data to make an online reservation.
The advancement of the online booking procedure implies the data subject’s consent to the processing of his personal data following the privacy policy of this website.
The possible acquisition of other personal data via dedicated forms (e.g. recording in the newsletter) shall require the data subject’s explicit awareness of the information as authorization for processing his personal data.
Failure to provide the personal information provided by the website may make it impossible to fulfill the request.
Sending an optional, explicit, and voluntary e-mail to the addresses indicated on this website entails the subsequent acquisition of the sender’s address, which is necessary to respond to requests, as well as any other personal data included in the message.

PROCESSING METHODS
The personal data are processed in paper format and/or by automated tools for the time strictly necessary for the purpose for which they have been collected.
In order to prevent data loss, abuse, incorrect use, and unauthorized access specific security measures are observed.

DATA VOLUNTARILY PROVIDED BY THE USER & RIGHTS OF ACCESS BY THE DATA SUBJECT
Sending an optional, explicit, and voluntary e-mail to the addresses indicated on this website entails the subsequent acquisition of the sender’s address, which is necessary to respond to requests, as well as any other personal data included in the message.

Pursuant to art. 15 GDPR, the data subject shall have the right to obtain from the Controller confirmation as to whether or not Personal Data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular
recipients in third countries or international organisations;
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
the right to lodge a complaint with a supervisory authority;
where the personal data are not collected from the data subject, any available information as to their source;
the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
The right to obtain a copy referred to in this article shall not adversely affect the rights and freedoms of others.

COOKIES
Cookies are small files stored on your hard drive. This allows easier navigation and makes the site easier to use.
Cookies usually allow access to information already stored on the computer of the person concerned for purposes which may be of a commercial nature (e.g. profiling) or technique (to ensure proper operation of the site visited).
According to Directive 2009/136 / EC no explicit consent shall be required for the use of cookies because only session cookies will be used, or cookies for the proper functioning of the website.
Cookies for transmitting personal information shall not be used, nor the so-called persistent cookies of any kind, that is user tracking systems.
The use of the so-called session cookies (which are not permanently stored on the user’s computer and disappear when the browser is closed) is strictly limited to the transmission of session identifiers (consisting of random numbers generated by the server) necessary to allow safe and efficient browsing of the site.
The so-called session cookies used in this website avoid using other computer techniques that potentially impair the confidentiality of user browsing data and which do not allow the user’s personal identification data to be acquired.

DATA SUBJECT RIGHTS
You have the rights set forth in art. 7 of the Privacy Code and art. 15 and ss. GDPR and precisely the right of:

i. obtain confirmation of the existence or not of personal data concerning you, even if not yet registered, and their communication in an intelligible form;
ii. obtain the indication:
a) of the origin of personal data;
b) of the purposes and methods of the processing;
c) of the logic applied in case of treatment carried out with the aid of electronic instruments;
d) of the identification details of the owner, the managers and the designated representative pursuant to art. 5, paragraph 2 of the Privacy Code and art. 3, paragraph 1, GDPR;
e) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it in their capacity as designated representative in the territory of the State, managers or agents;
iii. obtain the:
a) updating, rectification or, when interested, modification of Personal Data;
b) the cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed;
c) the attestation that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case where such fulfilment is it proves impossible or involves a use of means manifestly disproportionate to the protected right
iv. Right to object:
a) The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, including profiling based on those provisions. In this case, the Controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
b) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
Where applicable, it also has the rights referred to in Articles 16-21 GDPR (Right of rectification, right to be forgotten, right of limitation of treatment, right to data portability, right of opposition), as well as the right of complaint to the Guarantor Authority.