PRIVACY POLICY

1. IDENTIFICATION

• Identity: ICT GROUP S.R.L. (hereinafter “ICT GROUP”)

• VAT number: IT 10790910011

• Postal address: Strada Carignano 32 Bis, 10024 Moncalieri (TO)

• Data Protection Officer (DPO, “Data Protection Officer”): you can contact our DPO at the following address

• Email: dpo@saintpaulrelais.com

• Registered office: Strada Carignano 32 Bis, 10024 Moncalieri (TO)

• Please indicate in the subject “Data Protection Officer”.

2. INFORMATION AND CONSENT

By accepting this Privacy Policy, the user is informed and provides his / her free, informed, specific and unequivocal consent regarding the personal data provided on the website www.saintpaulrelais.com (hereinafter the “Website”) which will be processed by ICT GROUP, together with its navigation data and any other data provided to ICT GROUP in the future. The user is required to carefully read this Privacy Policy, drawn up in a clear and simple way to improve understanding, in order to decide freely and voluntarily if they wish to provide their personal data to ICT GROUP.

3. OBLIGATION TO PROVIDE DATA The data requested in the website forms are usually mandatory (unless otherwise indicated in the required field) and capable of fulfilling the stated purposes. Therefore, if they are not provided or are provided incorrectly, this will affect the free display of the content on the website.

4. FOR WHAT PURPOSES WILL ICT GROUP TREAT USERS ‘PERSONAL DATA?

The personal data provided through the website will be processed by ICT GROUP for the following purposes: 1. The data provided for making reservations, both through the website and the contact center (call center, email or chat) for receptive requests individual and group: • Management of booking requests made by users. • Sending the confirmation or documentation of the reservation made. • Sending of commercial communications by ICT GROUP, in case the relative consent has been given. • Analysis of the use of the website and verification of user preferences and behavior. 2. Data provided for registration as a user with ICT GROUP: • Management of requests for registration or cancellation of registration in the category chosen by the user. • Verification, based on the judgment of ICT GROUP, that the user meets the requirements for registration in the selected category. • Management and responses to potential requests for information made by the user. • Search for promotions that meet the needs selected by the user. • Sending of personalized commercial communications by ICT GROUP. • Analysis of the use of the website and verification of user preferences and behavior. 3. Data provided through the Best price module: • Management of contact requests and information from users through the channels available for this purpose on the ICT GROUP websites. • Management of requests made. • Analysis of the use of the website and verification of user preferences and behavior. 4. Data provided for publications on the BLOGs belonging to the ICT GROUP: •Management of the publication of comments on the website. • Management of registration and / or cancellation of the Blog Newsletter at the request of the user. • Analysis of the use of the website and verification of user preferences and behavior. • If necessary, monitoring the content of user comments and, if necessary, deleting those whose content does not meet the conditions of the website at the discretion of ICT GROUP. 5. The data provided to modify or cancel reservations: • Management of requests for modification or cancellation of the reservation made to ICT GROUP by the user. • Sending the relative reply to ICT GROUP. • Analysis of the use of the website and verification of user preferences and behavior. 6. Data provided for sending the Newsletter: • Management of subscription and / or cancellation from the Newsletter, carried out through the channel provided on the ICT GROUP website. 7. Data provided for the Saint Paul Rewards Program: • Management of the loyalty program and processing of the registration request, assignment of the Cardholder number, access to the keys of the private online area and the ability to accumulate and use Points. • Adapt the services of the Program to the preferences and tastes of the Owner, as well as measure the degree of satisfaction with the service provided in our hotels. This purpose may include sending surveys on the quality, adaptation and personalization of the services provided by the Saint Paul Relais. • Send communications relating to the Account, including but not limited to: Points balance, Card category, notifications and any other information on the status of your Account. • Send personalized commercial communications via e-mail or equivalent methods relating to the offer and services relating to the Program, unless the user objects to such processing. 8. Data provided on contact forms and company websites:
• Management of contact requests and information from users through the channels available for this purpose on the ICT GROUP websites. • Management of requests made. • Analysis of the use of the website and verification of user preferences and behavior.

5. WHAT USER DATA WILL THE SAINT PAUL RELAIS PROCESS?

ICT GROUP will process the following categories of user data: 1. The data provided for making reservations, both through the website and the contact center (call center, email or chat) for individual and group accommodation requests: • Identification data: name, surname, nationality. • Contact information: email address, telephone number. • Data on transactions for goods and services with ICT GROUP: Products and services purchased or those on which interest is expressed. • Stay preferences. • Economic, financial and insurance data. • Other data: data provided by interested parties in free fields or during telephone calls. • Browsing data. 2. Data provided for registration as a user with ICT GROUP: • Identification data: name, surname, nationality. • Contact information: email address, telephone number. • User and / or owner identification codes or keys. • Employment data: profession, sector. 3. Data provided through the Best price form: • Identification data: name and surname. • Contact information: email address, telephone number. • Transaction data for goods and services. • Other data: data provided by interested parties in the free fields of the forms available on the website or of the attached documents. • Browsing data. 4. Data provided for publications on ICT GROUP BLOGs:
• Identification data: name and surname. • Contact information: country of residence, e-mail address. • Browsing data. 5. Data provided to modify or cancel reservations: • Identification data: name and surname. • Contact information: email address, telephone number. • Transaction data for goods and services. • Economic, financial and insurance data. • Other data: data provided by interested parties in the free fields of the forms available on the website or of the attached documents. • Browsing data. 6. Data provided for sending the Newsletter: • Identification data: name and surname. • Contact information: country of residence, e-mail address. • Data on personal characteristics: language. 7. Data provided for the Saint Paul Rewards Program: • Identification data: name, surname, identity card, signature, address, nationality. • Data on personal characteristics: date of birth, gender. • Contact information: email address, telephone number. • User and / or owner identification codes or keys. • Transactions for goods and services in ICT GROUP: Products and services purchased or those in which interest is expressed. • Stay preferences • Browsing data. 8. Data provided on contact forms and company websites: • Identification data: name and surname. • Contact information: email address, telephone number. • Transaction data for goods and services. • Other data: data provided by interested parties in the free fields of the forms available on the website or of the attached documents. • Browsing data. If the user provides third party data, he declares that he has their consent and undertakes to transmit the information in the Privacy Policy to them, thus exempting ICT GROUP from any liability in this regard. However, ICT GROUP reserves the right to carry out periodic checks to confirm the above, adopting due diligence, in compliance with data protection regulations.
6. WHAT IS THE JUSTIFICATION FOR THE PROCESSING OF USER DATA?

The justification for the processing of users’ personal data concerns the following: 1. For making reservations, both through the website and the contact center (call center, email or chat) for individual and group accommodation requests: execution of the contract Between the parts. To analyze the use of the website, the legitimate interest of ICT GROUP 2. For the management of user registration: the consent required and, during the verification phase, the observance by users of the terms and conditions and for the analysis of the use of the website, the legitimate interest of ICT GROUP. However, in the event of withdrawal of consent, the lawfulness of the treatments carried out previously will not be affected. 3. For the Best Price module: the requested consent can be revoked by the user at any time. However, in the event of withdrawal of consent, the lawfulness of the treatments carried out previously will not be affected. To analyze the use of the website, the legitimate interest of ICT GROUP 4. To manage and publish comments or publications sent by users on the BLOGs belonging to the ICT GROUP: the consent provided by the user and, in the analysis of the website, confirmation of user preferences and behavior and monitoring of the content of comments, the legitimate interest of ICT GROUP. In case of revocation of consent to the processing of the publication of comments, these will be deleted by ICT GROUP from the website. 5. For encodings and / or cancellation of the reservation: the execution of the contract between the parties. To analyze the use of the website, the legitimate interest of ICT GROUP 6. For sending the Newsletter: the consent provided by the user. 7. For registration and management as a Holder of Saint Paul Rewards: the execution of the contract between the parties, while the consent of the Holder will form the basis for sending commercial communications. To analyze the use of the website, the legitimate interest of ICT GROUP 8. For the management of contact forms and company website: the consent provided by the user. To analyze the use of the website, the legitimate interest of ICT GROUP 9. To send the reminder on “cart recovery”: the consent provided by the user. To analyze the use of the website, the legitimate interest of ICT GROUP The consents obtained for the aforementioned purposes are not bound to each other and the user can revoke one without invalidating the others. To withdraw consent, the User can contact ICT GROUP using the following methods: dpo@saintpaulrelais.com
7. WITH WHICH RECIPIENTS WILL USER DATA BE SHARED?

User data may be disclosed to: 1. The data provided for making reservations, both through the website and the contact center (call center, email or chat) for individual and group accommodation requests: • Companies belonging or affiliated with ICT GROUP who need access to data for the correct provision of the chosen services. Your data will also be communicated to the hotel owners, who will then be made aware of the conditions of the stay (price, dates, services included, etc.). Some of these subjects may be located outside the European Economic Area, even in countries that do not offer a level of protection comparable to that of Italy. The sole purpose of this communication is to provide you with the services in the most correct manner. 2. Data provided for registration as a user with ICT GROUP: • Company of the group to which the ICT GROUP belongs, exclusively for internal purposes and / or for the purposes mentioned above. 3. Data provided through the Best price form: • Company of the ICT GROUP belonging group, exclusively for internal purposes and / or for the purposes mentioned above. 4. Data provided for publications on BLOGs belonging to ICT GROUP: • data provided by users will be published on the website and will be accessible to all its visitors. 5. The data provided to modify or cancel reservations: • Companies belonging or affiliated to ICT GROUP that need access to data for the correct provision of the chosen services. The data will also be communicated to the hotel owners, who will then be made aware of the conditions of the stay (price, dates, services included, etc.), for the sole purpose of providing the services in the most correct way. Some of these subjects may be located outside the European Economic Area, even in countries that do not offer a level of protection comparable to that of Italy. 6. The data provided for sending the Newsletter will not be disclosed to third-party companies.
7. Data provided for the Saint Paul Rewards Program: • Companies belonging to the Saint Paul Rewards Program who need access to data for the proper provision of the Program’s services. These companies will therefore be made aware of the conditions of the stay (price, dates, services included, etc.) and of the information relating to the Holder’s Account (balance of Points, Card category) in order to carry out the Saint Paul Rewards Program correctly. Some of these subjects may be located outside the European Economic Area, even in countries that do not offer an equivalent level of protection. 8. Data provided for contact forms and company website: • Company of the group to which ICT GROUP belongs, exclusively for internal purposes and / or for the purposes mentioned above. These data may also be used by ICT GROUP suppliers, where required for the correct fulfillment of legal obligations and / or for the purposes indicated above. The aforementioned suppliers will process your data only for the purposes indicated by ICT GROUP.

8. INTERNATIONAL TRANSFERS OF DATA
Please note that your data will be transferred to third parties located in the European Economic Area, specifically in Italy. These transfers concern the provision of services in relation to the management of the back office related to the company’s invoicing. In this regard, we inform you that the transfer is governed by standard contractual clauses.

9. DATA ARCHIVING Your data will be stored for the following periods: 1. The data provided for making reservations, both through the website and the contact center (call center, email or chat) for individual and group: will be kept for the entire duration of the contractual relationship and, after its termination, for the limitation period relating to the legal actions that could derive from it. 2. Data provided for registration as a user with ICT GROUP: until the user withdraws the consent provided. However, in the event of withdrawal of consent, the lawfulness of the treatments carried out previously will not be affected. 3. Data provided through the Best price form: for the time necessary to manage the request. 4. Data provided for publications on BLOGs belonging to ICT GROUP: the data will be kept until the user withdraws the consent provided. 5. The data provided to modify or cancel bookings: will be kept for the entire duration of the contractual relationship and, after its termination, for the limitation period relating to any legal actions that may arise from it. 6. The data provided for sending the Newsletter: will be kept until the user withdraws the consent provided. 7. Data provided for the Saint Paul Rewards Program: will be kept for the entire duration of the contractual relationship and, after its termination, for the limitation period relating to any legal actions that may arise from it. 8. Data provided for contact forms and company website: will be kept for the period necessary to process and respond to your request and, once completed, for the limitation period relating to the legal actions that could derive from it.

10. USER’S RESPONSIBILITY The user: • Guarantees that he is over eighteen (18) years of age and that the information provided to ICT GROUP is true, accurate, complete and up-to-date. To this end, the user is responsible for the truthfulness of all data communicated and undertakes to provide the information in a timely manner, so that it corresponds to the real situation. • He guarantees that he has informed the third parties whose data he has provided, if applicable, of the topics covered in this document. It also guarantees that it has obtained authorization to provide such data to ICT GROUP for the purposes indicated. • The user will be held responsible for any false or inaccurate information provided on the website and for direct or indirect damage caused to ICT GROUP or to third parties.

11. EXERCISE OF THEIR RIGHTS Users can write to ICT GROUP, at the postal address indicated at the top of this Notice or by e-mail at dpo@saintpaulrelais.com, including a copy of their identity document, in any moment and free of charge. • Revoke the consent already granted. • Receive confirmation on whether or not your personal data is being processed by ICT GROUP. • Access them. • Correct any inaccurate or incomplete data. • Request the cancellation of their personal data if, for any reason, they are no longer necessary for the purposes for which they were obtained. • Request that ICT GROUP limit data processing where one of the conditions in the data protection regulations is met. • Request the portability of the data provided by the user in the cases provided for by the law. • Contact the ICT GROUP DPO. • File a complaint with the Italian Data Protection Agency when it believes that ICT GROUP has violated the rights recognized by data protection legislation.

12. SECURITY MEASURES ICT GROUP will treat the user’s data in an absolutely confidential manner at all times and maintaining the obligation of secrecy towards him, in compliance with the provisions of the implementing regulations, adopting the technical and organizational measures necessary to guarantee the data security and avoiding alteration, loss, treatment or unauthorized access, taking into account the state of technology, the nature of the data stored and the risks to which they are exposed.

Last updated: July 2020.