Civis Hotels · Privacy Policy and Data Processing

Data controller

The controller of personal data collected through the civishotels.com website is Civis Hotels, with the following details:

Legal name: Pietro d'Ippolito
Registered office: Via Sapri 2, 88046 Lamezia Terme (CZ), Italy
VAT / Tax ID: VAT 03748390790
Contact: info@civishotels.com

For any question regarding the processing of personal data, please contact us at the email address shown above.

Types of data collected

The civishotels.com website is primarily a showcase and routing site. The personal data that may be collected is as follows.

Data provided voluntarily by the user

When a visitor uses the contact form or sends an email to info@civishotels.com, we collect the data entered directly, typically: full name, email address, and the content of the message sent. Such data is provided freely by the user.

Browsing data

The computer systems and software procedures used to operate this website collect, in the course of their normal operation, certain technical data whose transmission is implicit in the use of internet protocols. This information is not collected in order to be associated with identified data subjects, but by its nature it could, through processing and association with data held by third parties, permit users to be identified. This category of data includes, for example, IP addresses, the domain names of computers used by users, the addresses in URI (Uniform Resource Identifier) notation of the resources requested, the time of the request, the method used in submitting the request to the server, the size of the file received in response, the numerical code indicating the status of the server's response, and other parameters relating to the user's operating system and computing environment.

This technical data is used solely to derive anonymous statistical information about use of the website and to verify its correct functioning. The data could be used to establish liability in the event of hypothetical computer crimes committed against the site.

Display preferences

The website uses localStorage to remember the theme preference (light or dark mode) selected by the user. This preference is stored locally in the user's browser and is not transmitted to external servers. It is not a cookie and is not associated with personal data.

Purposes and legal basis for processing

The personal data collected is processed for the following purposes:

Responding to contact requests

Data provided through the contact form, the Civis Passport form, or by email is processed to respond to the user's request. The legal basis for processing is the controller's legitimate interest (art. 6(1)(f) GDPR) or, where applicable, the performance of pre-contractual measures (art. 6(1)(b) GDPR). The message is delivered to the info@civishotels.com mailbox via Resend (data processor); the website does not store form contents in any database.

Newsletter and marketing communications

If the user subscribes to the newsletter, the email address (and, where provided, the name and regions of interest) is processed to send editorial and promotional communications from Civis Hotels. The legal basis is the data subject's consent (art. 6(1)(a) GDPR), given explicitly and separately via the dedicated checkbox, with the date and source of consent recorded. Sending and managing the list is entrusted to Resend (Resend Inc.), acting as data processor appointed under art. 28 GDPR, under a Data Processing Agreement and Standard Contractual Clauses for transfers outside the EEA. Consent is revocable at any time via the unsubscribe link included in every email or by writing to info@civishotels.com.

Routing to bookings

The civishotels.com website functions mainly as a showcase and routing point toward the official websites of the individual properties (Lilium Boutique Hotel, Imperial Suite Rome) and toward external booking systems. For this activity, no personal data is collected on this website: bookings take place entirely on the systems of the individual properties, which are independent controllers of that processing.

Statistical measurement of website readership

To understand which pages are read, which countries visitors come from and which content deserves to be developed, the website collects traffic statistics. The aggregate, cookie-free measurement provided by Vercel Web Analytics rests on the controller's legitimate interest in keeping the website working and readable (Art. 6(1)(f) GDPR). The more detailed analysis entrusted to Google Analytics 4 involves the installation of cookies and rests exclusively on the consent of the data subject (Art. 6(1)(a) GDPR), collected through a banner on the first visit and withdrawable at any time from the Cookies and local storage section.

Legal obligations

Where necessary, data may be processed to fulfil obligations provided for by applicable law, regulations, or EU legislation (art. 6(1)(c) GDPR).

Important note on bookings and third-party sites

The civishotels.com website is primarily a showcase and routing site. Bookings are made directly on the official websites of the individual properties or on third-party booking platforms, which have their own privacy policies.

When a user clicks a booking link on this website and is redirected to one of the following sites or services, the processing of personal data will be governed exclusively by the respective privacy policies:

Lilium Boutique Hotel: official website liliumhotel.it
Imperial Suite Rome: official page on this website: Imperial Suite Rome; bookings are made through the TeamSystem Hospitality booking engine, whose privacy policy we recommend reading
Hotel in Cloud booking system: bookings for the Lilium are made through the Hotel in Cloud portal; we recommend reading that provider's privacy policy.

Civis Hotels is not responsible for data processing carried out by the third-party sites and systems indicated above.

Below is an honest and transparent description of what the civishotels.com website uses to function.

Local storage, no consent required

The website uses localStorage (local browser storage) for two technical items only: the theme preference (light or dark) and the choice expressed on measurement cookies. Neither contains personal data, neither is transmitted to external servers, neither is used to profile or track the user.

The website also collects aggregate traffic statistics through Vercel Web Analytics, which sets no cookies and generates no persistent identifier: the data is anonymous and cannot be traced back to an individual, which is why it requires no consent.

Measurement cookies, subject to consent

With the user's consent the website activates Google Analytics 4 (Google Ireland Limited), which shows which pages are read, from which countries and through which channels visitors arrive. Consent is requested through a banner on the first visit: until the choice is made, and if it is declined, no request is sent to Google and no cookie is installed. The legal basis is consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code).

The cookies installed only after acceptance are the following:

_ga — distinguishes visitors from one another; duration 2 years
_ga_9892YYD978 — maintains session state; duration 2 years

The configuration in use enables statistical measurement alone: the advertising features of Google Analytics (ad_storage, ad_user_data, ad_personalization) are disabled by default and the IP address is anonymised. The data is not used for personalised advertising nor shared with advertising networks.

Advertising cookies, subject to separate consent

With consent to the Advertising category the site activates Google Ads campaign measurement cookies. They are described in full in the Advertising and campaign measurement section.

_gcl_au — attributes an enquiry to the ad it came from; duration 90 days
_gcl_aw — records the ad click for conversion purposes; duration 90 days
doubleclick.net cookies — campaign measurement by Google; duration up to 24 months

Changing or withdrawing the choice

The choice can be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal. The button below reopens the banner and allows a new preference to be expressed; alternatively, clearing the website data from the browser settings is enough.

What we do not use

In no configuration does the website use:

Social media tracking pixels
Any sale or transfer of browsing data to third parties
Behavioural advertising based on your interests
Individual profiling of guests

Technical session cookies

Technical cookies strictly necessary for the website to function or for secure browsing may be present; these are not subject to the consent requirement under the guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali).

Advertising and campaign measurement

What we do

Civis Hotels promotes its properties with ads on the Google Ads search network. The ads lead to pages on this website. To understand which ads produce a real enquiry, and not merely a click, a conversion measurement system provided by Google Ireland Limited is used.

Legal basis

The consent of the data subject, under Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code. Consent is collected through the banner on the first visit, separately from consent for statistical measurement: one may be accepted and the other refused. Without advertising consent no advertising cookie is installed and no request reaches Google’s advertising systems.

What we do not do

We do not build individual guest profiles, we do not buy lists, we do not cross browsing data with booking data, and we do not remarket to people who have visited the site. Measurement tells us what an enquiry costs, not who made it.

How to withdraw

The choice can be withdrawn at any time from the button in the Cookies and local storage section, with the same number of clicks it took to give it. Withdrawal does not affect the lawfulness of processing carried out beforehand. Google ad settings can also be changed at myadcenter.google.com.

Retention and transfers

Conversion data is retained by Google for the period set in the Ads account, in any case no longer than 25 months. The controller for the advertising side is Google Ireland Limited, based in Dublin: any transfers to Google LLC in the United States take place under the adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) and the Standard Contractual Clauses referenced by the Google Ads Data Processing Terms.

The choice expires

The consent record stored by the site carries the date and the version of the notice it refers to. It expires after twelve months, and is requested again if the cookie part of this notice changes. No choice is treated as given indefinitely.

Data subject rights

Under articles 15-22 of EU Regulation 2016/679 (GDPR), data subjects have the right to exercise, at any time, the following rights against the data controller:

Right of access (art. 15 GDPR): to obtain confirmation as to whether or not personal data concerning them is being processed and, if so, to obtain access to that personal data and to information about the processing.
Right to rectification (art. 16 GDPR): to obtain, without undue delay, the rectification of inaccurate personal data and/or the completion of incomplete personal data.
Right to erasure (art. 17 GDPR): to obtain the erasure of personal data, in the cases provided for by law (right to be forgotten).
Right to restriction of processing (art. 18 GDPR): to obtain restriction of the processing of their personal data, in the cases provided for by law.
Right to object (art. 21 GDPR): to object at any time to the processing of personal data concerning them, where provided for by law.
Right to data portability (art. 20 GDPR): to receive, in a structured, commonly used, and machine-readable format, the personal data provided to the controller, and to transmit it to another controller.
Right to lodge a complaint with the supervisory authority (art. 77 GDPR): to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

To exercise these rights, a written request may be sent to the email address info@civishotels.com. The request will be handled in accordance with the terms set out by applicable law.

Data retention

Personal data provided by users through the contact form or by email is retained for the time strictly necessary to provide the requested service and, in any case, for a period not exceeding 24 months from collection, unless a longer retention period is required by law.

Technical browsing data (access logs) is retained for the time strictly necessary for security purposes and to verify the website's correct functioning.

International transfers

Personal data is, as a rule, processed within the European Economic Area (EEA). Should data need to be transferred to third countries or international organisations outside the EEA, the transfer will take place in accordance with the safeguards provided for by articles 44-49 of the GDPR (for example, on the basis of European Commission adequacy decisions or standard contractual clauses approved by the European Commission).

In practice, the providers currently used are: Vercel Inc. (website and serverless function hosting, served from the European region fra1 — Frankfurt) and Resend Inc. (transactional email delivery and newsletter list management). Both are companies headquartered in the United States: transfers take place on the basis of the Standard Contractual Clauses approved by the European Commission and their respective Data Processing Agreements, supplemented by additional security measures (encryption in transit and at rest).

Only where consent to measurement cookies is given does Google Ireland Limited (Google Analytics 4) join them, based in Dublin and therefore within the EEA. Any transfers to Google LLC in the United States take place under the adequacy decision adopted by the European Commission on 10 July 2023 (EU-US Data Privacy Framework, to which Google LLC adheres) and the Standard Contractual Clauses referenced by the Google Ads Data Processing Terms. Without consent, no data reaches Google.

Changes to this policy

The controller reserves the right to modify this policy at any time, for example to bring it into line with new legal obligations, new features of the website, or new services offered. Changes will be published on this page, with the date shown at the top updated accordingly. We recommend checking this page periodically to verify any updates.

The current version of this policy is identified by the date shown at the beginning of the document: 28 July 2026.

Photo credits

Photographs of the properties are the property of Civis Hotels. Photo credits for the articles in the Rome Guide appear beneath the respective images.