Privacy Policy | 4 Star Bologna

This privacy notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) and of Legislative Decree no. 196/2003 (“Italian Privacy Code”), as amended by Legislative Decree no. 101/2018, and describes how the personal data of guests, prospective customers and users of the website www.4starbologna.com are processed. The data are collected directly from the data subject; should they also be obtained from third parties (for example, booking portals), the provisions of Article 14 GDPR shall apply.

1. Data Controller and contact details

The Data Controller is Active Media SRL (VAT no. IT03312370798), with registered office in Pizzo (VV) and operating office in Bologna, which operates in the hospitality sector (rooms for rent and holiday homes) under the “4 Star Bologna” brand, with reception at Viale Angelo Masini 20, 40126 Bologna.

For any matter relating to the processing of data and for the exercise of rights, the Data Controller may be contacted at the following details:

The Data Controller has not appointed a Data Protection Officer (DPO), as the conditions making such appointment mandatory under Article 37 GDPR do not apply; for any matter relating to the protection of personal data, the Data Controller may be contacted at the details indicated above.

2. Categories of personal data processed

Depending on the relationship with the Data Controller, the following categories of personal data may be processed:

Booking and identification data: first name, surname, date and place of birth, citizenship, identity document details, address of residence or domicile.
Contact data: email address, telephone number and other contact details provided for the booking, for assistance or through the website forms.
Stay data: arrival and departure dates, the property and accommodation booked, number of guests, any requests or preferences communicated.
Payment data: data relating to the payment instrument used (Visa, Mastercard, American Express credit cards; Satispay; bank transfer) and amounts. Payment card data are entered and managed directly within the secure environment of the payment service provider integrated into the booking engine: the Data Controller does not store the full card number. The data necessary to manage the optional “BeSafe Rate” insurance rate, if selected, are also processed.
Browsing data: data collected automatically while browsing the website (for example, IP address, device and browser identifiers, pages visited and interaction data) and information detected through cookies and tracking tools (see Section 6).

The Data Controller does not request special categories of data within the meaning of Article 9 GDPR and asks that such data not be provided. Should the guest, however, spontaneously communicate data relating to health or accessibility needs (for example, to request accessible accommodation or to report specific requirements), such data will be processed only to the extent strictly necessary to provide the requested service, on the basis of the data subject’s consent (Article 9(2)(a) GDPR).

3. Purposes of the processing and legal bases

Personal data are processed for the following purposes, each based on the relevant legal basis:

Management of the booking and of the stay (confirmation, self check-in, assistance, management of payment and of the optional “BeSafe Rate” insurance rate). Legal basis: performance of the contract and of pre-contractual measures requested by the data subject (Article 6(1)(b) GDPR).
Compliance with legal obligations, including the mandatory communication of guests’ data to the Police Headquarters (Questura) through the “Alloggiati Web” portal of the State Police (Polizia di Stato) (Article 109 TULPS), the obligations relating to the municipal tourist tax and the tax and accounting obligations. Legal basis: legal obligation to which the Data Controller is subject (Article 6(1)(c) GDPR).
Responding to enquiries sent through the contact form. Legal basis: where the enquiry concerns a potential booking or a quotation, the performance of pre-contractual measures (Article 6(1)(b) GDPR); for general information requests, the legitimate interest of the Data Controller in responding to the enquiries received (Article 6(1)(f) GDPR).
Sending the newsletter and promotional communications relating to the Data Controller’s services and offers. Legal basis: the data subject’s consent (Article 6(1)(a) GDPR), which is freely given, specific and revocable at any time as easily as it was given (Article 7 GDPR).
Non-necessary cookies and tracking tools (analytics, marketing and profiling) on the website, for which the legal basis is the data subject’s consent (Article 6(1)(a) GDPR); technical cookies, by contrast, are processed on the basis of the legitimate interest in the proper functioning of the website (Article 6(1)(f) GDPR). Further details are set out in Section 6.
Security and proper functioning of the website and prevention of abuse and fraud. Legal basis: the legitimate interest of the Data Controller in the security of the network and systems and in the prevention of unlawful uses (Article 6(1)(f) GDPR); in respect of such processing, the data subject may exercise the right to object (see Section 10).

4. Nature of the provision of data and consequences of refusal

The provision of the data necessary for the booking, for carrying out the stay and for compliance with legal obligations (in particular the communication to “Alloggiati Web” and the tax and tourist-tax obligations) is mandatory: failure to provide such data makes it impossible to conclude the contract or to provide the service.

The provision of data for sending the newsletter and for marketing purposes, the sending of enquiries through the contact form, as well as consent to analytics and marketing cookies, are optional: any refusal does not affect the booking or the provision of the service.

5. Methods of processing

The data are processed using electronic tools and, where necessary, paper-based tools, adopting technical and organisational measures appropriate to ensure their security, confidentiality and integrity and to prevent unauthorised access, loss or destruction. The processing is carried out exclusively by authorised personnel and by persons designated as Data Processors.

6. Cookies and tracking tools

The website www.4starbologna.com (built on WordPress, multilingual through WPML and hosted with SiteGround) uses cookies and similar technologies, in accordance with the Guidelines on the use of cookies of 10 June 2021 issued by the Garante per la protezione dei dati personali (the Italian Data Protection Authority). In particular:

Technical/necessary cookies: for example the WPML cookie for language management (wp-wpml_current_language). These do not require the user’s consent, being necessary for the functioning of the website.
Third-party analytics cookies: Google Analytics 4 (cookies _ga, _ga_B5Z5KLQ32Y, _gid), a third-party tool provided by Google used to analyse the use of the website; its use may entail the transfer of data to the United States of America (see Section 8). Microsoft Clarity (domain clarity.ms) is a Microsoft tool for analysing browsing behaviour, which may include the recording of the user’s interactions with the pages (so-called session replay). Both are installed only after consent has been given.
Marketing and profiling cookies: Google Ads (cookie _gcl_au) and Meta/Facebook Pixel (cookie _fbp), used for advertising and campaign-measurement purposes. They are installed only after consent has been given.
The website may also embed Google Maps, the display of which may entail the placement of cookies and the connection to the relevant provider’s servers.

Consent to non-necessary cookies is obtained through the dedicated banner on first access; neither merely closing the banner nor scrolling the page amounts to consent, and non-necessary cookies (analytics, marketing and profiling) are not installed before consent has been obtained. Refusal is as easy as acceptance. At any time it is possible to amend or withdraw one’s choices, free of charge, through the cookie-management link or icon always accessible from the website, or by acting on the browser settings. The complete details of the cookies, with their respective purposes and durations, are set out in the consent banner, accessible at any time from the website.

7. Recipients and Data Processors

The data may be communicated or made accessible, within the limits of the purposes indicated above, to the following parties:

KrossBooking, provider of the management system and of the booking engine (book.4starbologna.com), acting as Data Processor.
SiteGround, provider of the website hosting service, acting as Data Processor.
Payment service providers integrated into the booking engine, for the management of payments made by card (Visa, Mastercard, American Express networks), via Satispay or by bank transfer, and the relevant banking institutions. Such parties act as independent data controllers or as data processors depending on the contractual relationships in place; the card networks constitute the accepted payment instruments.
Provider of the “BeSafe Rate” insurance service, where the guest chooses the relevant rate option.
State Police (Polizia di Stato) / competent Police Headquarters (Questura), through the “Alloggiati Web” portal, for compliance with the legal obligation (Article 109 TULPS).
Competent Municipality, for the management and collection of the tourist tax.
Google (Google Analytics, Google Ads), Meta (Facebook Pixel) and Microsoft (Clarity), for statistical analysis and marketing services, within the limits of the consent given. With regard to the Meta/Facebook Pixel, for the operations of collection and transmission of data, Meta Platforms Ireland Ltd. may act as joint controller within the meaning of Article 26 GDPR, in accordance with the relevant joint-controllership arrangement.
Public authorities and bodies, as well as any consultants and professionals engaged by the Data Controller (for example, for accounting and tax compliance), within the limits provided for by law.

The updated list of Data Processors is available on request from the Data Controller. The data are not subject to dissemination.

Any use of the WhatsApp channel for assistance, indicated among the contact details, entails the processing of contact data and of the content of the messages by the service provider (Meta Platforms Ireland Ltd.) in accordance with its own privacy notice, with a possible transfer of data outside the European Union (see Section 8). The use of this channel by the user is optional.

8. Transfer of data to non-EU countries

The use of services provided by Google, Meta and Microsoft, as well as of the WhatsApp channel, may entail the transfer of personal data to third countries, in particular the United States of America. Such transfers take place where appropriate safeguards are in place pursuant to Articles 44 et seq. of the GDPR, such as an adequacy decision of the European Commission (for example the “EU-U.S. Data Privacy Framework”, where the provider adheres to it) or the Standard Contractual Clauses approved by the European Commission (Article 46 GDPR), where appropriate supplemented by additional measures. A copy of the safeguards applied by each provider may be requested from the Data Controller.

9. Data retention periods

The data are retained for the time strictly necessary to achieve the purposes for which they were collected and in compliance with the time limits set by law:

Booking, stay and payment data: for the duration of the contractual relationship and, thereafter, for the time necessary to comply with legal obligations, in particular tax and accounting obligations (as a rule 10 years, pursuant to Article 2220 of the Italian Civil Code).
Data communicated to “Alloggiati Web”: the data are transmitted to the Police Headquarters (Questura) and retained by it in accordance with the applicable public-security legislation; on the property’s side, any receipt or record of the transmission having taken place is retained for the time necessary to document compliance and to address possible disputes.
Data relating to the tourist tax: for the time provided for by the applicable tax legislation and municipal regulations.
Data relating to enquiries through the contact form: for the time necessary to handle the enquiry and, as a rule, up to 24 months from the last contact, save where retention is necessary for defensive purposes or for legal obligations.
Data for the newsletter and marketing: until consent is withdrawn or a request for erasure/unsubscription is made.
Data collected through cookies and tracking tools: in accordance with the durations of the individual cookies indicated in the consent banner (by way of guidance: _ga approximately 2 years, _gid approximately 24 hours, _fbp approximately 3 months, _gcl_au approximately 90 days).

At the end of the periods indicated, the data are erased or anonymised.

10. Data subject’s rights and how to exercise them

The data subject may exercise at any time, within the limits and under the conditions provided for by Articles 15-22 of the GDPR, the following rights:

Access to their personal data (Article 15);
Rectification of inaccurate data or completion of incomplete data (Article 16);
Erasure of data (the “right to be forgotten”), in the cases provided for (Article 17);
Restriction of processing (Article 18);
Portability of the data provided, in a structured, commonly used and machine-readable format (Article 20);
Objection to processing based on legitimate interest and, in any event, to processing for direct-marketing purposes (Article 21);
Withdrawal of consent at any time, without affecting the lawfulness of the processing based on consent given before its withdrawal (Article 7(3)).

To exercise these rights or for any request relating to data protection, the Data Controller may be contacted at the details indicated in Section 1, in particular at the email address booking@4starbologna.com. The Data Controller will respond within the time limits provided for by the applicable legislation. To unsubscribe from the newsletter, it is also possible to use the dedicated link included in each communication.

The Data Controller does not carry out automated decision-making, including profiling, that produces legal effects concerning the data subject or similarly significantly affects them within the meaning of Article 22 GDPR.

11. Right to lodge a complaint with the Supervisory Authority

A data subject who considers that the processing of their data is carried out in breach of the GDPR has the right to lodge a complaint with the Supervisory Authority (Article 77 GDPR), without prejudice to any other administrative or judicial remedy: Garante per la protezione dei dati personali (the Italian Data Protection Authority), Piazza Venezia 11, 00187 Rome; website www.garanteprivacy.it; email garante@gpdp.it.

12. Amendments to this notice

The Data Controller reserves the right to update this privacy notice in order to bring it into line with regulatory or organisational changes. The version in force is the one published on the website www.4starbologna.com.

Last updated: 13 June 2026.