Privacy Policy

This Privacy Policy explains how the personal data of visitors to victoriatermehotel.it are processed in accordance with Regulation (EU) 2016/679 (GDPR).

Data controller

Acque Albule S.p.A.
Via Tiburtina Valeria km 22,700 — 00011 Tivoli Terme (RM)
Tax ID 00435290580 — VAT No. 00891651002
Telephone (+39) 0774 4088 — info@victoriatermehotel.it

Data we collect

Contact form

The contact form on the Contact page sends your data to our website, which forwards it by e-mail to info@victoriatermehotel.it without storing it in a database; to limit abuse, the server only records, for one hour, the times of submissions from the same IP address. We process the data included in the message — name, email address, optional telephone number and the text of the request — in order to respond.

Legal basis: taking steps at the data subject’s request prior to entering into a contract, and our legitimate interest in responding to requests received.
Retention: for the time required to handle the request and for the period required by applicable civil and tax obligations.

Bookings

Bookings are not completed on this website: the booking engine is provided by Simple Booking (Qnt S.r.l.), and the data entered to make a booking are processed within that service in accordance with the privacy notice shown to you. We receive from Simple Booking the data required to manage your stay.

Browsing data

The server hosting the website records technical connection data (IP address, date and time of the request, requested page and browser type) in log files for security and operational purposes.

Google Analytics 4, Google Ads and Meta Pixel

With the user’s prior consent, the website may activate Google Analytics 4 to measure page usage and produce statistics, as well as Google Ads, Google Hotel Ads, Google remarketing and the Meta Pixel to measure campaign effectiveness, attribute conversions and carry out advertising profiling. These tools are not loaded before the user makes an explicit choice through the banner.

Legal basis: the data subject’s consent. Consent is optional, may be provided separately for the analytics and marketing categories, and may be withdrawn at any time using the “Manage cookies” control.

The site includes a WhatsApp link for writing to us. It is a plain link: it sets no cookies and transmits no data until it is used. Opening it takes you to the WhatsApp service, operated by Meta Platforms Ireland Ltd., under that service's terms and privacy notice. Any conversation that follows is processed by us in order to answer your enquiry, for the same purposes and for the same periods indicated for the contact form.

Virtual assistant (chat)

The website offers a virtual assistant based on artificial intelligence, developed and operated by Acque Albule S.p.A., which provides initial information on rooms, services, offers and how to book. It does not confirm bookings, does not make diagnoses or health assessments and does not take automated decisions producing legal effects on the user. The assistant is not activated automatically: no data is transmitted until the user opens the chat and sends a message.

Data processed: the text of the messages written by the user and of the replies, date and time, language, the page from which the conversation is started, browser type and an encrypted fingerprint of the IP address, which does not allow the address itself to be traced and is used only to prevent abuse. The chat does not use cookies; in the browser it keeps, only for as long as the tab is open, a conversation identifier and the message history. As with any website, the server's technical logs also record the IP address of requests, for security purposes only.

Purposes and legal basis: providing the information requested by the user (pre-contractual measures taken at the user's request, Art. 6(1)(b) GDPR); preventing abuse, ensuring system security and improving the quality of replies (legitimate interest of the controller, Art. 6(1)(f) GDPR).

Special categories of data: please do not enter unnecessary personal data in the chat, and in particular health data, medical reports or prescriptions; for spa treatments, the direct contacts shown on the website are available. If entered nonetheless, such data are processed solely to answer the request and deleted within the periods indicated below.

Providers: the service is hosted on servers of Hetzner Online GmbH in Germany. Replies are generated by Anthropic PBC (United States), which receives the text of the conversation and acts as data processor; Anthropic does not use data received through the service to train its models.

Retention: conversations are automatically deleted thirty days after the last message; the server's technical logs are automatically deleted after fourteen days.

Cookies

The website uses local storage tools to record the preferences selected through the banner. The virtual assistant does not use cookies and relies only on the storage of the open tab. The booking engine, maps, Google Analytics 4, Google Ads and Meta Pixel are loaded only after consent has been given for the relevant category. Further details are provided in the Cookie Policy.

Who we share data with

Simple Booking (Qnt S.r.l.) — booking engine;
Google — Google Analytics 4, Google Ads, Google Hotel Ads, remarketing and maps, only for the categories accepted;
Meta — Meta Pixel, only with prior marketing consent;
Anthropic PBC — generation of the virtual assistant's replies, acting as data processor, limited to the content of conversations;
Hetzner Online GmbH — hosting of the virtual assistant's server, acting as data processor;
the website’s hosting provider, acting as a data processor;
parties to whom disclosure is required by law.

Personal data are neither publicly disclosed nor transferred to third parties for commercial purposes.

Transfers outside the European Union

The services used generally operate on European infrastructure. Where a provider processes data outside the European Economic Area, the transfer is carried out on the basis of the safeguards provided for in Articles 44 et seq. of the GDPR.

The content of conversations with the virtual assistant is processed by Anthropic PBC in the United States. The transfer is based on the standard contractual clauses approved by the European Commission (Art. 46 GDPR), included in the data processing agreement entered into with the provider.

Your rights

You may request access to your data, rectification, erasure, restriction of processing and data portability at any time, and you may object to processing based on legitimate interests. Email info@victoriatermehotel.it or call (+39) 0774 4088: we will respond within thirty days.

If you believe that the processing of your personal data breaches applicable law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (garanteprivacy.it).

Updates

This Privacy Policy may be updated. The date of the latest revision is shown below.

Last updated: October 2026.