GDPR NOTICE FOR THE UNITED KINGDOM AND IRELAND

EN-1. Specific Provisions for the United Kingdom and Ireland

This edition of the notice addresses two distinct legal regimes: the EU GDPR for users habitually resident in the Republic of Ireland and the UK GDPR for users habitually resident in the United Kingdom. While the substantive obligations are largely aligned, the regimes differ in their supervisory authority, complaint mechanism and rules on international data transfers, particularly to the United States.

EN-1.1 The UK GDPR and the Data Protection Act 2018 (United Kingdom)

Following the United Kingdom's withdrawal from the European Union, the EU GDPR was retained as part of UK domestic law as the UK GDPR, by virtue of section 3 of the European Union (Withdrawal) Act 2018 and the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. The UK GDPR operates alongside the Data Protection Act 2018 (DPA 2018), which supplements the GDPR (Part 2), implements the Law Enforcement Directive (Part 3) and addresses processing by the intelligence services (Part 4).

For users in the United Kingdom, additional national rules to be considered include:

• Privacy and Electronic Communications Regulations 2003 (PECR), which govern cookies, electronic marketing and traffic data and are enforced by the ICO independently of the UK GDPR.
• The Information Commissioner's Office (ICO) Guide to the UK GDPR and the ICO's accountability framework.
• UK adequacy decisions: the UK Government has issued its own adequacy regulations recognising EEA states; conversely, the European Commission has adopted an adequacy decision in respect of the United Kingdom (Decision (EU) 2021/1772, in force until 27 June 2025 and currently subject to review).
• UK Extension to the EU-U.S. Data Privacy Framework ("Data Bridge"), in force since 12 October 2023, allowing transfers from the UK to U.S. organisations that have certified to the UK Extension under the DPF.

UK Supervisory Authority - Information Commissioner's Office (ICO):
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
Helpline: 0303 123 1113 (UK) or +44 1625 545 700
Live chat and online complaint form: ico.org.uk/make-a-complaint/ (opens in a new tab)
Web: ico.org.uk (opens in a new tab)

EN-1.2 The EU GDPR and the Data Protection Act 2018 (Ireland)

For users habitually resident in the Republic of Ireland, the EU GDPR continues to apply directly, as supplemented by the Irish Data Protection Act 2018 (No. 7 of 2018), which gives further effect to the GDPR and transposes the Law Enforcement Directive into Irish law. Additional Irish national rules include:

• S.I. No. 336/2011 - European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, which govern cookies and electronic marketing in Ireland.
• Guidance from the Data Protection Commission (DPC), including its detailed guidance for SMEs and the cookies guidance note (April 2020).
• The DPC's role as Lead Supervisory Authority for many global technology companies headquartered in Ireland (including Apple Distribution International Ltd, listed by Vezpa as a sub-processor for in-app purchases on the Apple ecosystem).

Irish Supervisory Authority - Data Protection Commission (DPC):
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Phone: +353 (0)761 104 800 / +353 (0)57 868 4757
Online complaint form: forms.dataprotection.ie/raise-a-concern (opens in a new tab)
Web: www.dataprotection.ie (opens in a new tab)

EN-1.3 International transfers of personal data - UK and Irish perspective

Vezpa is established in Italy, an EU Member State, and processes personal data primarily within the European Economic Area. For the limited transfers to third countries described in section 7 of this notice, the following safeguards apply specifically to UK and Irish users:

• Transfers from the EU/EEA (including Ireland) to the United States: EU-U.S. Data Privacy Framework (Commission Decision (EU) 2023/1795) for active certified recipients (Stripe Inc., Google LLC for Firebase and Cloud Translation API, Microsoft Corp., DigitalOcean LLC); EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) for non-certified recipients (e.g. Apple Inc.).
• Transfers from the United Kingdom to the United States: the UK Extension to the EU-U.S. DPF for certified recipients; alternatively, the UK International Data Transfer Agreement (IDTA) issued by the ICO on 21 March 2022, or the UK Addendum to the EU SCCs.
• Transfers from the United Kingdom or Ireland to New Zealand: covered by the European Commission adequacy decision of 19 December 2012 (recognised in the United Kingdom by the relevant retained EU law).
• For transfers in the absence of an adequacy decision or applicable framework, Vezpa carries out a Transfer Risk Assessment (TRA) in accordance with the ICO TRA Tool (June 2022) and a Transfer Impact Assessment (TIA) in accordance with EDPB Recommendations 01/2020 (10 June 2021).

EN-1.4 Cookies and electronic communications - UK PECR and Irish ePrivacy Regulations

The Vezpa marketing website at vezpa.it serves users in the United Kingdom and Ireland in accordance with both PECR and S.I. No. 336/2011. Strictly necessary cookies (session, security, load balancing) are placed without consent under regulation 6(4) PECR (UK) and regulation 5(5) S.I. 336/2011 (Ireland). Non-essential cookies, including those set by Google Ads conversion tracking on landing pages, are loaded only after the user has given specific, freely given, informed and unambiguous consent through our cookie banner. Consent is recorded with timestamp and can be withdrawn at any time via the cookie preferences link in the footer.

EN-1.5 Direct marketing - UK PECR regulation 22 and Irish soft opt-in

Vezpa relies on the "soft opt-in" mechanism for marketing to existing customers under regulation 22(3) PECR (UK), regulation 13(11) S.I. 336/2011 (Ireland) and Article 130(4) of Italian Legislative Decree 196/2003. This means that, where Vezpa has obtained your contact details in the course of a previous service or sale of similar products, we may send you electronic marketing about similar Vezpa services, provided that you are given a clear and free opportunity to object both at the time the details are collected and in every subsequent communication. To opt out, click the unsubscribe link in any marketing email or write to info@vezpa.it with the subject line "Stop marketing".

EN-1.6 Penalties and enforcement

Under both the UK GDPR and the EU GDPR, supervisory authorities may impose administrative fines of up to 20 million euros (or 17.5 million pounds sterling under the UK GDPR) or up to 4% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(5) GDPR / UK GDPR). The ICO and the DPC additionally publish enforcement notices and decisions on their respective websites; users may consult these to verify Vezpa's compliance posture and to assess the broader risk landscape for accommodation businesses.

1. Introduction and Scope of Application

This notice describes how Vezpa di Paolo Vezzola (hereinafter "Vezpa" or "We") processes personal data in compliance with:

• EU Regulation 2016/679 (GDPR)
• Legislative Decree 196/2003 (Italian Privacy Code) as amended by Legislative Decree 101/2018
• Measures and Guidelines of the Italian Data Protection Authority (Garante)

1.1 To Whom it Applies

This notice applies to:

• 👤 Accommodation property managers who use Vezpa (direct customers)
• 🏨 Guests staying at properties using Vezpa
• 👔 Commercial partners and suppliers
• 🌐 Visitors to the vezpa.it website

1.2 The Dual Role of Vezpa

2. Controller's Identity and Contact Details

Data Controller:

Vezpa di Paolo Vezzola
Registered office: Desenzano del Garda (BS), 25015, via San Zeno 67
VAT No.: 04449070988
Tax Code: VZZPLA84C10D284C
PEC: lavezpa@pec.it
Email: info@vezpa.it

3. Categories of Personal Data Processed

3.1 Data of Managers (Customers)

3.2 Guest Data (as Data Processor)

4. Purposes and Legal Basis of Processing

4.1 For Managers (Customers)

4.2 For Guests (on the Manager's instructions)

5. Methods of Processing

5.1 Principles of Processing (Art. 5 GDPR)

Vezpa processes personal data in compliance with the following principles:

• ✅ Lawfulness, fairness and transparency: we process data lawfully and inform you clearly
• ✅ Purpose limitation: we use data only for the stated purposes
• ✅ Data minimisation: we collect only strictly necessary data
• ✅ Accuracy: we keep data up to date and accurate
• ✅ Storage limitation: we keep data only for as long as necessary
• ✅ Integrity and confidentiality: we protect data with adequate security measures
• ✅ Accountability: we can demonstrate compliance with the GDPR

5.2 Means of Processing

Data is processed using:

• 💻 IT tools: servers, databases, web/mobile applications
• 📄 Paper: only for necessary documents (contracts, invoices)

5.3 Access Methods

Data is accessible to:

• 👥 Authorised Vezpa personnel (with personal credentials)
• 🔐 Access based on the "need to know" principle (least privilege)
• 📝 Access logs tracked and monitored

6. Security Measures (Art. 32 GDPR)

6.1 Technical Measures

6.2 Organisational Measures

6.3 Reference Standards

• 🏆 EU servers: primary infrastructure DigitalOcean Frankfurt region (FRA1)
• 🏆 PCI-DSS: payments handled via Stripe, PCI-DSS Level 1 certified (Vezpa does not store card data)
• 🏆 Certified sub-suppliers: where applicable (ISO 27001, SOC 2, DPF) — see sub-processors page

7. Recipients of the Data (Art. 13.1.e GDPR)

7.1 Categories of Recipients

Data may be communicated to the following categories of recipients. The itemised, always up-to-date list is published at vezpa.it/subprocessors.

7.2 List of Sub-processors (Art. 28.4 GDPR)

The up-to-date list is published and always available at vezpa.it/subprocessors. Any changes (new sub-processors, replacements) are communicated to Controllers (properties) with at least 30 days' notice to allow objection (Art. 28.2 GDPR).

7.3 Transfers outside the EU

8. Rights of the Data Subject (Arts. 15-22 GDPR)

8.1 Exercisable Rights

8.2 How to Exercise Your Rights

You can exercise your rights through:

• 📧 Email: info@vezpa.it
• 📧 PEC: lavezpa@pec.it
• 📮 Registered post with acknowledgement of receipt: Vezpa di Paolo Vezzola, Desenzano del Garda, via San Zeno 67
• 💻 Private area: "Privacy and Data" section in the dashboard (for some rights)

8.3 Response Times

Vezpa responds to requests within 30 days of receipt (extendable by a further 60 days in complex cases, with reasoned communication).

8.4 Limitations of Rights

Some rights (erasure, restriction) may not be exercisable where:

• ⚖️ Legal obligations require us to retain the data
• ⚖️ The data is necessary to defend rights in court
• ⚖️ A public interest prevails

9. Data Breach and Notifications (Arts. 33-34 GDPR)

9.1 Procedure in the Event of a Data Breach

In the event of a data breach (personal data breach), Vezpa:

1. 📊 Assesses the incident within 24 hours of discovery
2. 📢 Notifies the Italian Data Protection Authority (Garante) within 72 hours (where there is a risk to the rights of data subjects)
3. 📧 Informs data subjects without undue delay (where there is a high risk)
4. 📝 Documents the incident in the breach register
5. 🔧 Adopts corrective measures to prevent future breaches

9.2 Transparency

In the event of a data breach involving you, you will receive a communication containing:

• Nature of the breach
• Data involved
• Possible consequences
• Measures adopted and recommended
• Privacy Office contact details

10. Data Protection Impact Assessment (DPIA)

Vezpa has initiated the Data Protection Impact Assessment (DPIA) pursuant to Art. 35 GDPR, in view of the systematic processing of identity documents of data subjects from several EU States and transfers to non-EU sub-processors.

Scope of the DPIA:

• Processing of guest personal details and identity documents via multiple governmental connectors
• Flows to OTA channel managers and transfers outside the EU
• Automatic OCR on document images
• Integration with device-side biometric authentication services

The DPIA and any additional mitigation measures are updated periodically. In the event of a high residual risk, Vezpa will proceed to prior consultation with the Italian Data Protection Authority (Garante) pursuant to Art. 36 GDPR. The Controller (property) may request a summary of the DPIA by writing to info@vezpa.it.

11. Data Processor (Art. 28 GDPR)

11.1 Agreements with Customers (for guest data)

When the property manager uses Vezpa to process guest data:

• The manager is the Controller
• Vezpa is the Processor
• A Data Processing Agreement (DPA) is entered into pursuant to Art. 28 GDPR

11.2 Content of the DPA

The Data Processing Agreement contains, pursuant to Art. 28.3 GDPR:

• 📋 Subject matter and duration of processing
• 📋 Nature and purposes of processing
• 📋 Type of personal data and categories of data subjects
• 📋 Obligations and rights of the Controller
• 📋 Documented instructions on processing
• 📋 Security measures implemented
• 📋 Authorised sub-processors with notice of replacement
• 📋 Assistance to the Controller with data subject rights, DPIA and data breaches
• 📋 Obligations of deletion or return upon termination

The DPA forms an integral part of the Terms of Service and is accepted upon registration of the property.

12. Privacy by Design and by Default (Art. 25 GDPR)

12.1 Privacy by Design

Vezpa integrates data protection from the design stage:

• 🔒 Native encryption in all communications
• 🔒 Pseudonymisation where possible
• 🔒 Minimisation of data collected
• 🔒 Granular access controls
• 🔒 Complete audit trail of all operations

12.2 Privacy by Default

Default settings maximise privacy:

• ✅ Only strictly necessary data is mandatory
• ✅ Automatic retention for the minimum legal period
• ✅ Marketing opt-in (not opt-out)
• ✅ Data visibility limited to the minimum necessary

13. Records of Processing Activities (Art. 30 GDPR)

Vezpa maintains complete records of all processing activities, containing:

• Name and contact details of the Controller and DPO
• Purposes of processing
• Description of categories of data subjects and data
• Categories of recipients
• Transfers to third countries
• Expected retention periods
• Description of security measures

The records are available at the request of the Italian Data Protection Authority (Garante).

14. Changes to the Notice

This notice may be amended for:

• Regulatory developments
• New service features
• Organisational changes

Material changes will be communicated by email with at least 30 days' notice.

The date of the last update is always indicated at the top of the document.