Privacy policy

PRIVACY POLICY

CRV s.r.l. – Sportcamping & Glamping Resort Rio Vantone

Last updated: October 2026

1. Data controller

The controller responsible for processing personal data is:

CRV s.r.l.
At: Sportcamping & Glamping Resort Rio Vantone
Via Vantone 45, Idro (BS), Italy
Email: privacy@sportcamping.eu
Website: www.lakeidro.com

In this Privacy Policy, CRV s.r.l. is referred to as the “Controller”.

2. General principles

The Controller processes personal data in accordance with Regulation (EU) 2016/679 (“GDPR”), applicable Italian data protection legislation and other relevant legal requirements.

This Privacy Policy explains which personal data may be processed, for what purposes, on which legal bases, with whom the data may be shared and what rights individuals have.

Personal data is processed lawfully, fairly and transparently, for specified purposes and in accordance with the principles of data minimisation, accuracy, storage limitation, integrity and confidentiality.

3. Categories of personal data

Depending on the relationship with the Controller and the services used, the following categories of data may be processed:

• identification and contact details, such as name, address, email address and telephone number;
• booking and stay information, including arrival and departure dates, number of guests, accommodation or pitch booked and special requests;
• information required to comply with legal obligations relating to guests;
• vehicle and registration plate information, to the extent necessary for access control;
• payment and transaction information, to the extent required for administrative and accounting purposes;
• communications with the Controller;
• technical website usage data, where collected;
• access credentials, access logs and security-related system events, where applicable;
• images recorded by video surveillance systems, as described in this Privacy Policy.

The Controller does not intend to collect special categories of personal data unless this is necessary and legally permitted.

4. Bookings, stays and guest management

Personal data is processed to handle enquiries, bookings, amendments and cancellations, guest reception, check-in and check-out, stays and communications necessary for the provision of services.

Property-management and booking systems may be used for these purposes, including ASA Hotel and connected booking services such as Seekda, where actually in use.

The legal basis is the performance of a contract or taking steps at the request of the individual before entering into a contract, pursuant to Article 6(1)(b) GDPR. Where necessary, processing is also based on compliance with legal obligations under Article 6(1)(c) GDPR.

5. Guest communications

Contact details may be used for communications relating to bookings and stays, operational information, requests for clarification, assistance and the handling of complaints.

Digital tools and external services, including Reguest where actually used, may be involved in managing these communications.

The legal basis is the performance of a contract, compliance with legal obligations or, where appropriate, the Controller’s legitimate interest in organising and documenting communications with guests.

Marketing communications are handled separately, as described in the marketing section below.

6. Electronic access systems

The Resort may use electronic access-control systems, including SALTO systems, to manage access permissions for relevant areas and facilities.

Depending on the system configuration, the data processed may include card or credential identifiers and the date and time of access.

Where applicable to the current configuration, access logs are retained for 30 days, unless a longer period is necessary to investigate a security incident, establish, exercise or defend legal claims, or comply with legal obligations. Any different retention period must be verified against the actual system configuration.

The purposes are access management, the safety of individuals and property, and the prevention of unauthorised access. Depending on the circumstances, the legal basis is the performance of a contract and/or the Controller’s legitimate interests under Article 6(1)(f) GDPR.

7. Video surveillance

The Resort may use video surveillance for security purposes, to protect guests, employees and property, prevent unauthorised access and investigate incidents.

Depending on the actual installation, cameras may cover entrances and gates, reception and office areas, parking areas, pitches and other operational areas of the Resort. Camera views must be limited to areas necessary for the stated purposes and must not cover unrelated public areas.

The system may include Ubiquiti/UniFi Protect equipment and local recording. According to the stated configuration, audio is not recorded.

Recorded images are accessible only to authorised persons and are retained only for as long as necessary for security purposes. The specific retention period must be determined in accordance with the actual system configuration, the assessment of security needs and applicable law. Where an incident requires investigation, relevant footage may be retained for as long as necessary to deal with the incident or protect a legal claim.

The legal basis is the Controller’s legitimate interest under Article 6(1)(f) GDPR, taking into account the rights and freedoms of individuals. Specific information about video surveillance is also provided through notices displayed in the relevant areas.

8. Registration plate recognition at the entrance and exit

An automatic registration plate recognition system is used at the Resort’s entrance and exit exclusively for vehicle access control.

The system is intended to allow authorised vehicles to enter and to deny access to unauthorised vehicles. This measure is designed to protect the property of CRV s.r.l. and the property of guests and to contribute to the security of the Resort.

The registration plate and information strictly necessary to verify access authorisation may be processed for this purpose. The system is not intended for general movement surveillance or the creation of movement profiles.

The legal basis is the Controller’s legitimate interest under Article 6(1)(f) GDPR, subject to an assessment of necessity and proportionality. Data is retained only for as long as necessary for access control and security purposes, unless further retention is justified by legal obligations or legitimate requirements. The actual recording methods and retention periods must reflect the system’s real configuration.

9. Returning guests and booking history

The Controller may retain information about previous bookings and stays to manage subsequent reservations, respond to guest enquiries, improve service organisation and comply with administrative and legal obligations.

Such information is used only for relevant purposes and to the extent necessary. Any use for marketing purposes is subject to the conditions described in the marketing section.

10. Website, technical data and logs

When a user visits the website, technical systems necessary for its operation may process technical data such as IP address, date and time of the request, browser and device information, requested pages and technical logs.

This data may be processed to ensure the website’s operation, security and stability, prevent misuse and diagnose technical problems.

The legal basis is the Controller’s legitimate interest in operating a secure website and, where applicable, compliance with legal obligations.

Analytics and marketing technologies are described in the separate Cookie Policy.

11. Website analytics and online advertising

The website and marketing activities may use analytics, campaign measurement and online advertising services, including Google Analytics, Google Ads and Meta, as well as other tools where configured.

These tools may process information about website usage, online identifiers, device information, interactions with advertising content and the source of a website visit.

Non-essential cookies and similar technologies are used only with the user’s consent where required by applicable law. Users may manage their preferences through the consent management system available on the website, where provided.

Details of the technologies actually used, the relevant providers, their purposes and consent-management arrangements must be reflected in the updated Cookie Policy.

12. Payments and administration

Payment-related data is processed to manage amounts due, verify transactions, issue refunds, comply with accounting and tax obligations and prevent fraudulent transactions.

Reheg GmbH may be involved in the technical processing of payment workflows and related integrations. For the activities entrusted to it by CRV s.r.l., Reheg GmbH acts as a processor within the scope of the relevant agreement under Article 28 GDPR.

Electronic payments may also involve Adyen as a payment service provider. The specific role of each party and the data processed depend on the payment method and the applicable contractual arrangements.

Payment card data is processed in accordance with the procedures and responsibilities of the payment provider. CRV s.r.l. does not intend to retain full payment card details beyond what is permitted by applicable law and security requirements.

The legal basis is the performance of a contract and compliance with legal obligations. The Controller or payment provider may also rely on legitimate interests to prevent fraud, as applicable.

13. Legal obligations, guest registration and tourist tax

The Controller processes and discloses data necessary to comply with legal obligations applicable to accommodation providers, including the identification and reporting of guest information to the competent authorities through the required systems, such as Alloggiati Web, where applicable.

Data may also be processed for statistical reporting required by the competent authorities, including applicable regional systems, and for the administration and reporting of tourist tax, where due.

The legal basis is compliance with legal obligations under Article 6(1)(c) GDPR. Data is disclosed to the competent authorities to the extent required by law.

14. Accompanying guests and minors

Where a booking includes several guests, the Controller may process the information necessary for each guest to manage the stay and comply with legal obligations.

The person making the booking must provide accurate information and, where necessary, inform the other guests about this Privacy Policy. Providing information about other guests does not automatically constitute their consent to optional purposes such as marketing.

Personal data relating to minors is processed only to the extent necessary for managing the stay, ensuring safety and complying with legal obligations, taking into account applicable law and the role of parents or legal guardians.

15. Disclosure of data and service providers

Personal data may be disclosed, to the extent necessary, to:

• employees and authorised personnel of the Controller;
• providers of property-management, booking and communication systems, such as ASA, Seekda and Reguest, where used;
• providers of access-control and security systems, such as SALTO and Ubiquiti/UniFi Protect, where used;
• payment and technical support providers, such as Reheg GmbH and Adyen, according to their actual roles;
• IT, hosting, maintenance and security providers;
• professional advisers, accountants and legal advisers, where necessary;
• banks, public authorities and other parties where required by law or necessary to protect legal rights.

Where providers process personal data on behalf of the Controller, they are appointed as processors where required by Article 28 GDPR. Sub-processors may be used subject to the applicable contractual arrangements.

The actual involvement of each provider depends on the services enabled and the configuration in use.

16. Transfers to third countries

Where personal data is transferred to countries outside the European Economic Area, the transfer is carried out in accordance with the GDPR, for example on the basis of an adequacy decision by the European Commission or appropriate safeguards, where required.

Specific information about transfers depends on the providers and services actually used.

17. Data retention

Personal data is retained for as long as necessary to fulfil the purposes for which it was collected and, thereafter, for the period required by law or necessary to establish, exercise or defend legal claims.

Retention periods vary according to the category of data, purpose, system used and applicable legal requirements. Where no single period can be specified, retention is determined according to these criteria.

At the end of the applicable retention period, data is deleted, anonymised or otherwise rendered non-identifiable, where technically and legally possible.

18. Data subject rights

Subject to the conditions and limitations of the GDPR, individuals may:

• obtain confirmation as to whether their personal data is being processed;
• access their personal data and obtain a copy;
• request rectification of inaccurate data or completion of incomplete data;
• request erasure where the relevant legal conditions are met;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive their data in a structured format and, where applicable, request its transfer to another controller;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with the competent supervisory authority.

Requests may be sent to privacy@sportcamping.eu. The Controller may request information necessary to verify the requester’s identity and will respond within the time limits established by law.

Individuals may lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), without prejudice to other legal remedies.

19. Data security

The Controller implements technical and organisational measures appropriate to the risks to protect personal data against loss, destruction, alteration, unauthorised disclosure and unlawful access.

Measures may include access controls, restricted permissions, system protection, operational procedures and security measures imposed on service providers. No system can guarantee absolute security; measures are reviewed and updated as necessary.

20. Changes to this Privacy Policy

This Privacy Policy may be updated following changes in legislation, organisation, technology or the services used. The updated version will be published on the Resort’s website with the relevant update date.

For questions about personal data protection, please contact privacy@sportcamping.eu.

COOKIE POLICY

1. What are cookies?

Cookies are small text files or similar identifiers that may be stored on a user’s device when visiting a website. Similar technologies may be used to operate a website, remember preferences, measure usage or support advertising activities.

2. Types of cookies and technologies

Depending on the actual configuration, the website may use:

• Technical or strictly necessary cookies: required for the website to function or to provide a service requested by the user.
• Preference cookies: used to remember user choices, where applicable.
• Analytics cookies: used to understand website usage and improve performance, subject to applicable requirements.
• Marketing cookies and technologies: used to measure advertising campaigns, personalise advertisements or analyse interactions with advertising content.

The website may use Google services, including Google Analytics and Google Ads, and Meta services for measurement and marketing. The tools and cookies actually active must be verified against the current website configuration.

3. Consent and preference management

Non-essential cookies and technologies are activated only with the user’s consent where required by applicable law. Refusing optional cookies should not prevent use of the website’s essential functions.

Users may change or withdraw their preferences through the consent management system available on the website, where provided. Cookies may also be managed through browser settings; however, disabling technical cookies may affect certain website functions.

4. Third-party providers

Where third-party tools are used, data may be processed by the relevant providers in accordance with their privacy policies. Any transfers to countries outside the EEA are subject to the requirements of applicable law.

5. Cookie duration

Cookie duration varies according to the cookie’s purpose and provider. Session cookies are generally deleted when the browser is closed, while other cookies may remain on the device for longer. Actual retention periods must be verified through a technical scan of the website.

6. Updates and contact

This Cookie Policy may be updated when the website or the technologies used change. Questions may be sent to privacy@sportcamping.eu.

Pre-publication check: verify the cookies actually present, the product internally referred to as “GA+”, the consent banner configuration, active providers and applicable retention periods.