Last updated: 28 August 2026.

1. Data Controller

The Data Controller for personal data collected through the website www.ducadeste.com is Fincres S.p.A., with registered office at Viale Palmiro Togliatti 1587, 00155 Rome, VAT No. 01435741002, Tax Code 05709490584. The accommodation facility is the Grand Hotel Duca d'Este, Via Nazionale Tiburtina 330, 00019 Tivoli Terme (RM).

Contact details: telephone (+39) 0774 3883 — e-mail info@ducadeste.com.

If a Data Protection Officer (DPO) has been appointed, their contact details must be added to this Privacy Policy.

2. Scope of this Privacy Policy

This Privacy Policy is provided pursuant to Articles 12 and 13 of Regulation (EU) 2016/679 (“GDPR”) and describes the processing of personal data carried out through the website, online forms, booking services, newsletter and external services that may be activated by the user. For cookies and other tracking technologies, please also refer to the Cookie Policy.

3. Categories of data processed

Browsing and security data: IP address, date and time of the request, requested URL, browser and device information, technical logs and data required for security, diagnostics and the proper operation of the website.
Data provided by the user: first name, surname, e-mail, telephone number, content of messages and any other information voluntarily entered in contact forms, information requests, quote requests or similar tools.
Booking and stay data: arrival and departure dates, number of guests and, during the booking process through Simple Booking, any additional data required to complete and manage the booking.
Newsletter data: first name, surname, e-mail, mobile telephone number where required, proof of consent, date and technical information strictly necessary to document the subscription and manage withdrawal.
Privacy/cookie preference data: the user's choice regarding non-essential services, the version of the policy and the date of the choice, stored locally on the device and/or, where necessary, in the Data Controller's systems to document consent.
Data processed through optional external services: technical information and data that may be communicated to providers when the user enables or uses services such as the booking engine, assistant/chat, maps, anti-spam systems or measurement and marketing tools.

4. Purposes of processing and legal bases

4.1 Website browsing, operation and security

Strictly necessary technical data is processed to enable page display, prevent misuse, ensure system security and diagnose malfunctions. The legal basis is the legitimate interest of the Data Controller in the security and proper management of its systems pursuant to Article 6(1)(f) GDPR, without prejudice to the application of Article 122 of Italian Legislative Decree 196/2003 regarding access to or storage of information on the user's device.

4.2 Requests for information, quotes and contact

Data is processed to respond to user requests and carry out pre-contractual activities requested by the data subject. The legal basis is Article 6(1)(b) GDPR. Mandatory data is the information required to handle the specific request; failure to provide such data may prevent the Data Controller from responding.

4.3 Bookings and management of the stay

Data is processed to check availability, complete and manage bookings, provide hotel services, manage payments, guest requests and related obligations. The legal basis is the performance of pre-contractual and contractual measures (Article 6(1)(b) GDPR) and, for obligations required by law, Article 6(1)(c) GDPR. The booking engine may be provided by Simple Booking/QNT; the provider's own privacy policies may also apply within its platform.

4.4 Newsletter and promotional communications

Newsletters, offers and promotional communications are sent only with the specific, freely given and withdrawable consent of the data subject, pursuant to Article 6(1)(a) and Article 7 GDPR. Failure to provide consent does not affect the ability to use the other website services or make a booking.

Consent may be withdrawn at any time via the unsubscribe link included in communications, where available, or by writing to info@ducadeste.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4.5 Optional external services, measurement and marketing

Services that are not strictly necessary for browsing — for example external widgets, chat/assistant services, embedded maps, measurement systems, advertising tools or pixels — are activated only after a positive choice by the user in the privacy/cookie preferences. The legal basis is consent pursuant to Article 6(1)(a) GDPR and, for cookies or equivalent technologies, Article 122 of the Italian Privacy Code.

5. Processing methods and security measures

Processing is carried out using electronic tools and, where necessary, manually, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation and integrity. The Data Controller adopts technical and organisational measures appropriate to the risk in order to protect data against unauthorised access, loss, alteration, disclosure or destruction.

6. Nature of the provision of data

Providing the data required to respond to a request, prepare a quote or process a booking is necessary in order to act upon the user's request. Providing data for newsletters, marketing and non-essential external services is optional, and refusal does not prevent normal use of the website.

7. Recipients and parties who may process the data

Data may be processed, within the scope of their respective functions, by:

authorised personnel of Fincres S.p.A. and Grand Hotel Duca d'Este;
hosting, infrastructure, maintenance and IT security providers;
e-mail and communication service providers;
booking engine providers, including Simple Booking/QNT where used;
providers of assistance/chat services, maps, anti-spam systems and web functionalities;
providers of analytics, tag management, advertising and social media tools, exclusively where the user has provided the required consent;
professional, administrative, tax and legal advisers;
public authorities and other parties where disclosure is required by law.

Depending on the circumstances, these parties act as data processors pursuant to Article 28 GDPR, authorised persons or independent data controllers. An up-to-date list of data processors may be requested from the Data Controller.

8. Transfers of data to third countries

Some technology providers may process data in countries located outside the European Economic Area. In such cases, transfers are carried out in accordance with Articles 44 et seq. GDPR, on the basis of an adequacy decision by the European Commission, Standard Contractual Clauses approved by the Commission or another mechanism provided for by applicable law, together with any supplementary measures that may be required. Information on the applicable safeguards may be requested from the Data Controller.

9. Data retention periods

Requests and quotes: for the time necessary to handle the request and, subsequently, for the period necessary to protect the Data Controller's rights and comply with applicable obligations.
Bookings and stays: for the duration of the relationship and, subsequently, for the periods required by applicable civil, tax, accounting and public security legislation.
Newsletter: until consent is withdrawn or the user unsubscribes, without prejudice to the retention of information strictly necessary to document the withdrawal and prevent further communications.
Privacy/cookie consents: for the time necessary to document the user's choice and in accordance with the rules set out in the Cookie Policy; the preference stored on the device will in any case be renewed or requested again where required by applicable legislation.
Technical logs: for a limited period proportionate to security and diagnostic requirements, unless further retention is necessary in the event of incidents, fraud or requests from public authorities.

10. Rights of the data subject

In the cases provided for by the GDPR, the data subject may exercise the rights set out in Articles 15–22, including access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. The data subject may also request information regarding the source of the data, the purposes of processing, recipients and transfers to third countries.

Requests may be sent to info@ducadeste.com.

11. Complaint to the Supervisory Authority

The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or, where applicable, with the competent supervisory authority pursuant to Articles 77 et seq. GDPR, without prejudice to any other administrative or judicial remedy.

12. Automated decision-making

Unless otherwise stated in connection with a specific service, the website does not carry out decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject pursuant to Article 22 GDPR.

13. Minors

The website and online hotel services are not specifically aimed at minors for marketing purposes. Where processing is based on the consent of a minor in relation to information society services, the conditions established by applicable law will apply.

14. Changes to this Privacy Policy

The Data Controller may update this Privacy Policy to reflect regulatory, organisational or technical changes. The updated version is published on this page together with the date of revision.