Last Updated: June 25, 2026

This Privacy Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR"), Italian Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101/2018, and all applicable Italian and European legislation concerning the protection of personal data.

This Privacy Policy explains how Sybaris Hotel collects, uses, stores and protects the personal data of users who visit the Website, request information, make reservations, purchase services, attend events or otherwise interact with the Property through any communication channel.

By using this Website, you acknowledge that you have read and understood this Privacy Policy.

1. DATA CONTROLLER

The Data Controller is:

Costa Jonica Group S.r.l.s.

Registered Office
Strada Statale 106
87011 Cassano all'Ionio (CS)
Italy

VAT Number: 03305850780

E-mail: info@sybarishotel.it

Certified E-mail (PEC): costajonicagroupsrls@legalmail.it

Telephone: (+39) 0983 196 1611

Website: www.sybarishotel.it

(hereinafter also referred to as "Sybaris Hotel", the "Hotel", the "Property", the "Company" or the "Data Controller").

Costa Jonica Group S.r.l.s., as the owner and operator of Sybaris Hotel, determines the purposes and means of processing personal data in accordance with Regulation (EU) 2016/679 (GDPR), the Italian Privacy Code and all other applicable legislation.

As of the date of this Privacy Policy, no Data Protection Officer (DPO) has been appointed, as the conditions set out in Article 37 of the GDPR do not apply.

For any request concerning the processing of personal data or the exercise of your rights under Articles 15–22 of the GDPR, you may contact the Data Controller using the contact details provided above.

2. SCOPE OF APPLICATION

This Privacy Policy applies to all personal data processing activities carried out by Sybaris Hotel through:

• the official website;
• the online booking system;
• contact forms;
• information requests;
• quotation requests;
• hotel room and accommodation reservations;
• wedding, reception, meeting and event reservations;
• stay packages;
• experiences, additional services, vouchers and gift cards;
• the online shop, where available;
• telephone communications;
• e-mail communications;
• official social media channels;
• instant messaging services, where available;
• any other services offered by the Property.

This Privacy Policy applies exclusively to processing activities carried out by Costa Jonica Group S.r.l.s. in connection with Sybaris Hotel and does not apply to third-party websites, platforms or services that may be accessed through links available on this Website.

3. PRINCIPLES OF PROCESSING

Sybaris Hotel processes personal data in accordance with the following principles:

• lawfulness;
• fairness;
• transparency;
• purpose limitation;
• data minimisation;
• accuracy;
• storage limitation;
• integrity;
• confidentiality;
• accountability.

Appropriate technical and organisational measures are implemented to ensure a level of security appropriate to the risk and to prevent unauthorised access, disclosure, alteration, loss or destruction of personal data.

4. CATEGORIES OF PERSONAL DATA COLLECTED

In accordance with the principle of data minimisation, Sybaris Hotel collects only the personal data necessary to provide its services.

The categories of data processed may include:

• identification data (name, surname, date of birth);
• contact details (telephone number, e-mail address, postal address);
• booking information;
• event and reception details;
• billing information;
• payment information (processed through certified payment providers);
• browsing data;
• cookies and online identifiers;
• communications voluntarily submitted by users.

Sybaris Hotel does not intentionally collect special categories of personal data unless strictly necessary and permitted by applicable law.

5. PURPOSES OF PROCESSING

Personal data may be processed for the following purposes:

• managing reservations;
• managing hotel stays;
• organising weddings, events and receptions;
• responding to enquiries and quotation requests;
• issuing invoices;
• fulfilling accounting, tax and administrative obligations;
• complying with public security regulations;
• processing payments;
• customer support;
• protecting the legitimate interests of the Data Controller;
• fraud prevention;
• IT security;
• improving the quality of services.

Subject to the data subject's consent where required, personal data may also be processed for:

• newsletters;
• commercial communications;
• promotional offers;
• event marketing;
• direct marketing activities;
• personalised communications;
• profiling activities, where permitted by law.

6. LEGAL BASIS FOR PROCESSING

Personal data is processed on one or more of the following legal bases:

• performance of a contract;
• implementation of pre-contractual measures requested by the data subject;
• compliance with legal obligations;
• legitimate interests pursued by the Data Controller;
• consent of the data subject, where required.

Providing the personal data necessary for reservations or requested services is mandatory. Failure to provide such data may prevent the Hotel from supplying the requested services.

7. DATA SECURITY

Sybaris Hotel adopts appropriate technical and organisational measures designed to safeguard personal data against unauthorised access, accidental loss, alteration, disclosure or unlawful processing.

Access to personal data is restricted to authorised personnel and appointed data processors solely for the purposes necessary to perform their duties.

8. DATA RETENTION

Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected and in compliance with applicable legal obligations.

At the end of the applicable retention period, personal data will be securely deleted, anonymised or processed in aggregate form unless further retention is required by law or necessary to protect the legitimate interests of the Data Controller.

9. DATA SUBJECT RIGHTS

Data subjects may exercise the rights provided by Articles 15 to 22 of the GDPR at any time, including:

• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability;
• the right to object;
• the right to withdraw consent;
• the right to lodge a complaint with the competent Data Protection Authority.

Requests may be submitted to info@sybarishotel.it or via certified e-mail (PEC) at costajonicagroupsrls@legalmail.it.

10. CHANGES TO THIS PRIVACY POLICY

Sybaris Hotel reserves the right to amend or update this Privacy Policy at any time in order to comply with changes in legislation, organisational requirements or technological developments.

Any amendments shall be published on www.sybarishotel.it and shall become effective from the date of publication.