(pursuant to Article 13 of EU Regulation 2016/679 – GDPR)

1. Data Controller

The Data Controller is:

PENSHOUSE S.R.L.
Via Roma 15 – 23900 Lecco (LC) – Italy
Email: reservations@phgfamily.com

Website: https://penshouse.group

2. Types of Data Collected

The website may collect the following categories of personal data:

• Data voluntarily provided by the user
• First and last name
• Email address
• Phone number
• Data entered in contact forms
• Data required for booking or stay requests

Data collected automatically

• IP address
• Browser type and device
• Browsing and website usage data

3. Purpose of Processing

Personal data are processed for the following purposes:

a) Management of requests and bookings

• Responding to information requests
• Managing bookings and stays
• Providing customer support

b) Legal obligations

• Tax, administrative and legal obligations
• Communications to competent authorities

c) Analysis and service improvement

• Statistical analysis of website traffic
• Optimization of the user experience

d) Marketing (only with prior consent)

• Sending offers and promotional communications
• Loyalty and remarketing activities

4. Legal Basis of Processing

Processing is based on:

• Performance of pre-contractual and contractual measures
• Legal obligations
• Legitimate interest (for internal analysis)
• User consent (for marketing and non-technical cookies)

5. Methods of Processing

Data are processed using IT and telematic tools, in compliance with the security measures required by applicable laws, to ensure confidentiality and integrity.

6. Data Retention

Personal data are retained:

• For the time necessary to fulfill the purposes for which they were collected
• For the period required by legal obligations
• Until consent is withdrawn for marketing purposes

7. Data Sharing and Access

Data may be shared with:

• Technical service providers (hosting, website management)
• Booking engine and PMS providers
• Tax and legal advisors
• Public authorities, where required

These parties process data as data processors.

8. Booking Engine and PMS

The website may integrate an external booking system (booking engine) connected to a PMS.

In such cases:

• data entered during the booking process are also processed by the service provider
• processing is carried out in accordance with the respective privacy policies of the providers

Users are invited to consult the specific privacy notices during the booking process.

9. Analytics Tools – Google Analytics

The website uses :contentReference[oaicite:0]{index=0}, a web analytics service provided by :contentReference[oaicite:1]{index=1}.

Google Analytics uses cookies to collect information in aggregated and anonymous form, including:

• number of visitors
• pages visited
• time spent on the website

These data are used to improve the website and the services offered.

If IP anonymization is enabled, the user’s IP address is partially masked.

Data may be transferred to the United States in compliance with GDPR safeguards.

10. Cookies

The website uses:

• Technical cookies (necessary for operation)
• Analytics cookies (e.g. Google Analytics)
• Third-party cookies, where applicable

The use of non-technical cookies is subject to user consent via banner.

For more information, please refer to the Cookie Policy.

11. Data Transfer Outside the EU

Some data may be transferred to countries outside the EU (e.g. services provided by Google). Such transfers are carried out in compliance with the standard contractual clauses provided by European regulations.

12. Data Subject Rights

Users have the right to:

• Access their personal data
• Request rectification or deletion
• Restrict or object to processing
• Withdraw consent at any time
• Lodge a complaint with the data protection authority

To exercise these rights, please contact:
reservations@phgfamily.com

13. Changes to this Policy

This Privacy Policy may be subject to updates. Users are encouraged to review it periodically.

Last updated: April 30, 2026