Privacy notice
Ca' Nigra Lagoon Resort · Hotel Ai Due Fanali · San Simeon Apartments
Last updated: 8 October 2026
This notice explains how we process the personal data of people who visit our websites, write to us, book and stay at our properties, in accordance with Article 13 of Regulation (EU) 2016/679 ("GDPR"). Cookies and tracking tools on the website are covered on a separate page: the Cookie Policy.
1. Who processes your data
The data controller is SAN SIMEON S.r.l. · Sestriere Santa Croce 927, 30135 Venezia (VE) · P.IVA 02668160274, which runs the three properties.
For any question about your data, write to info@hotelcanigra.com.
2. What data we process
- Contact and booking data: first and last name, email, phone number, dates of stay, number of guests, room or apartment, rate, and any requests or preferences you share with us.
- Payment data: online payments take place on the secure page of the payment provider, and we never see the full card number. If you leave a card as a guarantee, its details remain in the booking system and are used only for the charges set out in the rate conditions.
- Identity document data at check-in, for you and the other guests, including minors: this is required by law (see section 3).
- Information you give us during your stay, such as a food allergy or an accessibility need: we use it only to serve you better and only if you tell us.
- Browsing data: as described in the Cookie Policy, collected only with your consent, except for technical data.
If you book for other people as well, please let them know about this notice.
3. Why we process it, on what legal basis and for how long
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering your requests for information or quotes, including suggesting another of our properties when the one you chose is full | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) | As long as needed to reply and, if you do not book, up to 12 months |
| Managing your booking and stay: confirmation, pre-arrival messages, online check-in, requested services | Performance of the contract (Art. 6(1)(b)) | For the duration of the relationship, then as set out below |
| Payments, invoices and accounting | Legal obligation (Art. 6(1)(c)) | 10 years (Art. 2220 of the Italian Civil Code) |
| Reporting guest details to the police through the Alloggiati Web portal | Legal obligation (Art. 109 of the Italian public safety law, TULPS) | As long as required by law |
| Mandatory tourism statistics (ISTAT, Veneto Region) and the Venice city tourist tax | Legal obligation (Art. 6(1)(c)) | The periods set by law |
| Sending you newsletters and offers from our properties, by email or messages | Consent (Art. 6(1)(a)), which you can also give when booking | Until you withdraw consent or ask us to delete your data |
| Optional guest satisfaction surveys, whose results we use in aggregate form | Consent (Art. 6(1)(a)) | Until you withdraw consent |
| Answering contact forms filled in through our ads on Facebook and Instagram | Pre-contractual steps at your request (Art. 6(1)(b)) | As long as needed to reply; afterwards only if you consented to marketing |
| Measuring the results of our campaigns and showing you relevant ads | Consent given through the cookie banner (Art. 6(1)(a)) | See the Cookie Policy |
| Defending our rights in case of disputes and keeping our systems secure | Legitimate interest (Art. 6(1)(f)) | Until the relevant limitation periods expire |
Information about health or allergies that you share with us is used only for the request you made, and is not kept after your stay ends.
4. Who we share your data with
Your data is processed by authorised members of our staff and, on our behalf, by suppliers acting as data processors (Art. 28 GDPR):
- the provider of our online booking system and guest management software (MyGuestCare, MyComp);
- the payment provider (Nexi);
- the company that manages and hosts the websites (Nozio);
- the email platform (Brevo) and the service that connects ad contact forms to it (Zapier);
- the consultants who handle revenue, marketing and campaigns for us;
- our accountant and banks, for accounting and tax obligations.
We also share data with public authorities when the law requires it: police, the City of Venice, ISTAT and the Veneto Region.
If you book through a portal such as Booking.com or Expedia, the portal processes your data as an independent controller under its own privacy notice, and sends us what is needed for the booking.
Meta (Facebook, Instagram) and Google process the data collected with your consent as described in the Cookie Policy.
We never sell your data.
5. Data transferred outside the European Union
Some suppliers (Zapier, Meta, Google) may process data in the United States. Transfers are made to companies certified under the EU-U.S. Data Privacy Framework, which the European Commission recognised as adequate on 10 July 2023, or on the basis of the standard contractual clauses approved by the Commission.
6. What is required and what is not
Booking data and the data required by law at check-in are necessary: without them we cannot confirm your booking or welcome you. Consent to newsletters, surveys and marketing cookies is optional, and refusing it changes nothing about your stay.
We do not make decisions based solely on automated processing that produce legal effects concerning you.
7. Your rights
You can ask at any time to access, correct or delete your data, restrict its processing, receive it in a machine-readable format, and object to processing based on legitimate interest or to marketing (Articles 15–22 GDPR). You can withdraw any consent at any time; this does not affect the lawfulness of what happened before. Just write to info@hotelcanigra.com: we reply within one month.
If you believe the processing breaks the law, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
8. Updates
We may update this notice when our services or the law change. The date at the top shows the latest version.
