PRIVACY POLICY

(pursuant to Articles 13 and 14 of EU Regulation 2016/679)

This information describes the methods of processing the personal data of users who consult the website http://www.otiumrooftop.it/ and/or who use the services, contents and contact channels available on the site.

This information applies exclusively to this website and not to other websites that may be accessed via external links.

1. Data controller

The Data Controller is OTIUM srl. (PI 12375140014), with registered office in Turin, Corso Massimo D'Azeglio n. 60, represented by its legal representative pro tempore, a company wholly owned by TO BE srl. 

Contact: privacy@tobecompany.com

The project/site “Otium Rooftop” identifies the venue, the catering services, lounge bar, swimming pool, events and hospitality promoted through the site.

2. Types of personal data processed

The following categories of personal data may be processed through the site.

a) Browsing data

The computer systems and software procedures used to operate this website may acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This category includes, for example:

• IP address; 
• domain names of devices used by users; 
• URI/URL addresses of the requested resources; 
• date and time of the request; 
• method used to submit the request to the server; 
• size of the file obtained in response; 
• numeric code indicating the status of the response given by the server; 
• other parameters relating to the user's operating system and computing environment. 

This data is not collected to directly identify the user, but could, through processing and association with data held by third parties, allow for their identification.

b) Data provided for restaurant, lounge bar, swimming pool or other service reservations

If the interested party uses the forms or contact channels available on the site to request a reservation or information relating to the services offered, data such as:

• name and surname; 
• e-mail address; 
• mobile number, required for the operational management of the booking and for any communications relating to confirmations, changes, cancellations, delays or other needs related to the requested service;
• type of service requested, for example restaurant, lounge bar, swimming pool, aperitif, experience or other available option; 
• any special notes or requests entered by the user; 
• any data necessary to confirm, modify or cancel the reservation. 

This data is necessary to manage the interested party's request and to allow the Data Controller to correctly organize the requested service.

c) Data provided for requests relating to private or corporate events or dedicated initiatives

For requests for information or quotes relating to private or corporate events, anniversaries, presentations, dinners, aperitifs, parties, photo shoots, promotional activities, or other initiatives to be organized at Otium Rooftop, the following may be processed:

• name and surname of the contact person; 
• e-mail address; 
• telephone number; 
• any company, organization or entity represented; 
• role or qualification of the contact person; 
• type of event or initiative requested; 
• indicative number of participants; 
• organizational, logistical, set-up or food & beverage needs; 
• any additional information included in the request.

d) Data relating to allergies, intolerances or dietary needs

For reservations, events, catering services, aperitifs, lounge bars, or food & beverage experiences, interested parties may voluntarily provide information regarding allergies, food intolerances, dietary requirements, or other special needs, including through the notes or other fields available in the booking form.

This information will be processed exclusively to the extent necessary to manage the booking or provide the requested service.

Since such data may reveal information relating to the data subject's health, processing will be carried out, where necessary, based on the data subject's explicit consent or other appropriate basis set forth in Article 9 of the GDPR.

e) Data relating to gift cards, vouchers, gift experiences 

In the event of the purchase or activation of gift cards, vouchers, gift experiences or similar formulas, the following may be processed:

• identification and contact details of the buyer or applicant; 
• identification and contact details of the potential recipient; 
• type of gift, voucher, experience or membership requested; 
• amount, validity and conditions of use; 
• any personalized message; 
• payment data, where applicable. 

The interested party who communicates data of third parties, such as recipients of gift cards or vouchers, declares that he or she is authorized to do so and undertakes, where necessary, to inform such parties of the processing of their data.

f) Data relating to payments, deposits, penalties or administrative documentation

In the event that the booking, purchase of services, gift cards, memberships, events, or other experiences involves payments, deposits, pre-authorizations, penalties, or the issuance of tax documents, the following may be processed:

• customer identification and contact details; 
• tax or administrative data; 
• amount, reason and date of payment; 
• accounting details; 
• data relating to invoices, receipts or tax documentation; 
• any information managed by credit institutions or payment service providers. 

The Data Controller does not necessarily process the complete payment instrument data, which may be managed directly by authorized third parties, such as credit institutions or payment service providers.

g) Data provided for newsletter subscription and promotional communications

If the interested party subscribes to the newsletter or consents to receive informational and promotional communications, the following may be processed:

• e-mail address; 
• name and surname; 
• telephone number, where required; 
• date and time of registration or consent collection; 
• IP address and technical logs relating to consent collection; 
• any data relating to the opening of communications or interaction with content, where measurement tools are used. 

Communications may concern updates, initiatives, offers, events, experiences, services, promotions, commercial proposals, and activities relating to Otium Rooftop and/or other projects, services, or initiatives of the Data Controller, within the limits of the consent given.

h) Images, photographs, videos and promotional content

The site may publish images, photographs, videos or other content relating to the environments, services, events, experiences and activities carried out at Otium Rooftop.

The use of panoramic or general images, without a specific focus on an individual person, may be used for informational, documentary, and promotional purposes, in compliance with the principles of fairness, minimization, and protection of the data subjects' dignity.

For images, videos, interviews, or content in which the person is clearly identifiable and constitutes the main subject of the recording, the Data Controller will, where necessary, obtain specific consent or release.

During specific events, additional brief information or information signs may be provided at the venues where the events are held.

the) Cookies and tracking tools

The site may use technical cookies and, where applicable, analytical, functional, advertising, profiling, marketing, social plugins, or other tracking tools.

For further information, please refer to the specific Cookie Policy available on the site.

3. Purposes and legal bases of the processing

Personal data will be processed for the following purposes.

Purpose of the processing	Legal basis
Allow navigation and correct technical functioning of the site	Legitimate interest of the Data Controller in the technical management and security of the site
Ensure the security of the site, prevent illicit use, unauthorized access or fraudulent activity	Legitimate interest of the Data Controller in IT security and the protection of its systems
Respond to requests for information, reservations, availability, modification or cancellation of reservations relating to the restaurant, lounge bar, swimming pool or other services	Execution of pre-contractual measures requested by the interested party or execution of the requested service
Manage requests for quotes, information or organization of private, corporate events or dedicated initiatives	Execution of pre-contractual measures requested by the interested party
Organize and manage private and corporate events, anniversaries, parties, commercial initiatives, or personalized experiences	Execution of the contract or pre-contractual measures requested by the interested party
Process any data relating to allergies, intolerances or dietary requirements communicated by the interested party for the correct provision of the service	Explicit consent of the interested party, where necessary; execution of the requested service within the limits permitted by applicable legislation
Manage gift cards, vouchers, gift experiences, memberships or similar formulas, where available	Execution of pre-contractual or contractual measures requested by the interested party
Manage payments, deposits, pre-authorizations, penalties, receipts, invoices, and administrative documentation	Contract execution; legal obligation for tax and accounting compliance
Respond to spontaneous communications, complaints, administrative requests or other communications sent by the user	Execution of measures requested by the interested party or legitimate interest of the Data Controller in responding to communications received
Send newsletters, informative, promotional and commercial communications relating to initiatives, events, services, experiences, offers and activities of the Data Controller	Consent of the interested party
Create and publish photographic, video, promotional or documentary content relating to the environments, services, events and activities of the Owner	Consent, release, legitimate documentary/promotional interest or other suitable legal basis, depending on the context
To ascertain, exercise or defend a right in judicial, extrajudicial or administrative proceedings	Legitimate interest of the Data Controller in protecting its rights
Manage cookies and technical tracking tools necessary for the functioning of the site	Legitimate interest of the Data Controller in the correct technical functioning of the site
Manage non-anonymized analytical cookies, advertising cookies, marketing, profiling, social plugins or other non-technical tracking tools	Consent of the interested party, where required by applicable law

4. Nature of data provision

Providing the data requested for reservations, information requests, event requests, purchases, gift cards, memberships, or similar services is necessary to allow the Data Controller to process the request and/or provide the requested service. Providing your telephone or mobile number in the booking form is necessary to allow the Data Controller to process your request and contact you for confirmations, changes, cancellations, delays, changes, or other communications strictly related to the requested service.

Failure to provide the data marked as mandatory may make it impossible to submit the request, confirm the booking, purchase the service, or enjoy the requested experience.

Providing data relating to allergies, intolerances, or special needs is optional, but may be necessary to allow the Data Controller to properly manage the service and protect the interested party during the experience.

Providing data for newsletter, promotional, or marketing purposes is optional. Failure to provide consent will not affect your ability to browse the site, make reservations, request information, or purchase services.

5. Treatment methods

Personal data will be processed using computerized, electronic, and, where necessary, paper-based tools, using methods strictly related to the purposes indicated above.

The Data Controller adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in order to prevent the loss, illicit or incorrect use of data, unauthorized access, disclosure, modification or destruction thereof.

6. Recipients of personal data

6.1. Intragroup transfers 

The data may be communicated and shared with companies belonging to the TO BE Group, in compliance with the conditions of lawfulness of the processing and the rights of the interested parties for administrative, accounting, organizational and internal management purposes of the group.

6.2. External transfers

Personal data may be processed by personnel, collaborators, and individuals authorized by the Data Controller, within the limits of their respective duties and according to specific instructions.

The data may also be communicated, where necessary, to the following categories of subjects:

• IT service providers, hosting, maintenance and website management; 
• providers of email services, newsletters, CRMs, booking systems or management tools; 
• administrative, tax, accounting, legal or employment consultants; 
• banking institutions and payment service providers; 
• suppliers and parties involved in providing the requested services, managing reservations, events, catering, reception, logistics, or set-ups; 
• subjects involved in the management of gift cards, vouchers, memberships or experiences, where applicable; 
• photographers, video makers, communications agencies or individuals involved in the creation of promotional or documentary content; 
• public authorities, bodies or subjects to whom communication is mandatory by law; 
• persons in charge of debt collection or the protection of the Data Controller's rights. 

External parties processing personal data on behalf of the Data Controller will, where necessary, be appointed as data processors pursuant to Art. 28 of the GDPR.

Personal data will not be disclosed, except in the case of images, videos, or content published on the Data Controller's website or channels, where this occurs based on an appropriate legal basis.

7. Transfer of data outside the European Economic Area

Personal data will be processed mainly within the European Economic Area.

If, for technical reasons related to the use of IT services, hosting, email, management platforms, or similar tools, it becomes necessary to transfer data to third countries, the transfer will take place in compliance with Articles 44 et seq. of the GDPR, based on an adequacy decision by the European Commission or, failing that, through adequate safeguards, such as the Standard Contractual Clauses approved by the European Commission.

8. Retention period

Personal data will be retained for the time strictly necessary to achieve the purposes for which they were collected.

In particular:

Data category	Retention period
Browsing data	For the time necessary for the technical management and security of the site, except for the need to ascertain illegal activities
Data relating to requests for information or spontaneous contacts	For the time necessary to respond to the request and, normally, no longer than 12 months from the last contact, unless a further relationship is established
Data relating to restaurant, lounge bar, swimming pool or similar service reservations	For the time necessary to manage the booking and, subsequently, for a reasonable period connected to organizational, administrative or rights protection needs
Data relating to private, corporate events or dedicated initiatives	For the time necessary to manage the request or event and, subsequently, for the period necessary to fulfill legal obligations or protect the rights of the Data Controller
Special data relating to allergies, intolerances or dietary needs	Only for the time necessary to manage the booking, event or service requested, unless otherwise required by law
Data relating to gift cards, vouchers, memberships or experiences	For the time necessary to manage the service and, subsequently, for the period necessary to fulfill legal obligations or protect the rights of the Data Controller
Data relating to payments, invoices, receipts and administrative-accounting documentation	For the period required by civil, fiscal and accounting legislation, normally 10 years
Data relating to newsletters and promotional communications	Until you revoke your consent or request to unsubscribe
Newsletter or marketing consent logs	For the time necessary to demonstrate the correct collection of consent
Images, photographs, videos or content published	For the time of publication consistent with the informational, documentary or promotional purposes pursued, unless consent is revoked where the processing is based on consent
Data processed for the protection of rights	For the time necessary to manage the dispute and in any case within the limits of the applicable limitation periods

Upon expiration of the retention periods, the data will be deleted, anonymized, or retained exclusively where necessary to fulfill legal obligations or protect the Data Controller's rights.

9. Links to third-party sites or social networks

The site may contain links to third-party websites, social media pages, external platforms, mapping tools, booking systems, payment systems, commercial partners, or other online services.

This policy does not apply to data processing carried out by third parties or external platforms, for which the interested party is invited to consult the relevant privacy policies.

10. Rights of the interested party

The interested party may exercise, within the limits and under the conditions set forth in Articles 15 et seq. of the GDPR, the following rights:

• obtain confirmation as to whether or not personal data concerning him or her is being processed; 
• access your personal data; 
• obtain the rectification of inaccurate data or the integration of incomplete data; 
• obtain the deletion of data, in the cases provided for by the legislation; 
• obtain restriction of processing; 
• oppose the processing, in the cases provided for by the legislation; 
• receive the data in a structured, commonly used and machine-readable format, where applicable; 
• revoke the consent given, without prejudice to the lawfulness of the processing carried out before the revocation; 
• lodge a complaint with the Italian Data Protection Authority. 

Requests may be sent to the Data Controller at the addresses indicated in this policy.

11. Complaint to the Supervisory Authority

The interested party who believes that the processing of his/her personal data is in violation of the applicable legislation has the right to lodge a complaint with the Guarantor for the protection of personal data, according to the methods indicated on the Authority's institutional website.

12. Updates to this policy

This information may be updated over time, including due to regulatory, technical, or organizational changes.

The interested party is therefore invited to consult this page periodically.

Last updated May 2026