[X]. Processing of personal data through the KOSMO virtual assistant
An interactive virtual assistant AI KOSMO (hereinafter, the “Chatbot”) is active on our website to assist you during navigation, provide information about our services, and answer your questions. This service is developed by AI KOSMO S.r.l., which acts as Data Processor pursuant to Article 28 of the GDPR, on the basis of a specific agreement governing its tasks and responsibilities. The Data Controler of the data you provide through the Chatbot remains Hotel La Perla.
The Chatbot uses Large Language Model (LLM) artificial inteligence systems to understand your requests and provide relevant responses.
a. Categories of data processed
The processing concerns the folowing personal data:
- Data actively provided by the user: any information that you voluntarily type into the chat window, such as questions, requests for information, first name, last name, contact details, or stay preferences;
- Session-related technical data: IP address, browser type, operating system, and other technical data necessary to ensure the proper technical functioning of the chat;
- Conversation content: the ful text of your interactions with the Chatbot.
b. Purposes and legal basis of the processing
Your personal data are processed for the folowing purposes:
- Provision of chat-based assistance and support services: to respond to your requests, assist you during navigation, and provide you with the necessary information about our services. The legal basis for this processing is the legitimate interest of the Data Controler in providing efficient and immediate customer support. In the case of pre-contractual requests (e.g. quotations, booking availability), the legal basis is the performance of pre-contractual measures.
- Service improvement and training of artificial intelligence algorithms: to analyse conversations (in aggregated and anonymised form where possible) in order to improve the accuracy of the Chatbot’s responses and the effectiveness of the service. The legal basis for this processing is the legitimate interest of the Data Controler and the Data Processor in improving the technology and the quality of the service offered, provided that your interests or fundamental rights and freedoms do not prevail.
The provision of data for purpose no. 1 is optional but necessary in order to use the Chatbot service. For purpose no. 2, you may object at any time, without prejudice to your ability to continue using the chat service.
c. Processing methods and security measures
The processing is carried out using IT and telematic tools. In accordance with the principles of data protection by design and by default (Article 25 GDPR), appropriate technical and organisational measures are adopted to ensure a level of security appropriate to the risk, including pseudonymisation or anonymisation of data where possible, especialy for the purposes of training the algorithms.
d. Data retention period
Your personal data wi l be retained in accordance with the principle of storage limitation:
- For assistance purposes, conversation logs wi l be retained for the time strictly necessary to manage your request and, in any case, for a period not exceeding 6 months from the closure of the chat session, unless the emergence of a dispute justifies further retention.
- For algorithm training purposes, personal data wi l be retained in a form that alows your identification only for the time strictly necessary for analysis and extraction of information useful for improving the model, after which they wi l be irreversibly anonymised or deleted. In any case, this period wi l not exceed 90 days.
e. Data disclosure and transfers
The data colected through the Chatbot are processed by our provider AI KOSMO, appointed as Data Processor. AI KOSMO may use sub-processors (e.g. cloud service providers) for the provision of the service, in compliance with the obligations set out in Article 28 of the GDPR. The use of such services may involve the transfer of your personal data outside the European Economic Area (EEA). Such transfers wi l take place only where appropriate safeguards are in place, such as adequacy decisions of the European Commission or the execution of Standard Contractual Clauses.
f. Use of artificial intelligence systems
The Chatbot service makes use of artificial inteligence technologies, in particular LLMs. In line with the transparency principles set out in the European AI Act, the GDPR, and national Law No. 132/2025, we wish to provide you with the folowing information:
- Transparency obligation: we inform you that you are interacting with a system that uses AI components. This system has been designed to assist Hotel staff in interpreting and routing your requests.
- Operation and system logic: the AI system analyses the text of your requests in order to understand their content and purpose and to route them to the competent department.
- Human oversight and absence of automated decision-making: we guarantee that the AI system operates as a support tool for our staff. No decision producing legal effects or similarly significantly affecting you (pursuant to Article 22 GDPR) is taken in a solely automated manner. Any complex request, charge, or relevant decision is subject to review and validation by a human operator.
- Fairness and non-discrimination: AI systems have been developed and are periodicaly monitored to minimise the risk of errors and discriminatory effects, in line with best practices and regulatory requirements.
g. Data Subject rights in relation to the use of AI
In addition to the general rights provided for by the GDPR (access, erasure, restriction, portability, objection), we remind you that, in relation to the use of artificial inteligence systems, you are guaranteed specific rights, in line with the guidance of supervisory authorities:
- Right to rectification: if you find that the information generated by the Chatbot concerning you is inaccurate, you have the right to request its correction;
- Right to erasure: if the correction of inaccurate data is not technicaly possible, you have the right to obtain their erasure;
- Right to object: you may object at any time to the processing of your data for the purpose of algorithm training based on legitimate interest.
To exercise your rights, you may contact Hotel La Perla using the contact details provided in this privacy notice.
