PRIVACY NOTICE PURSUANT TO ARTS. 12 AND 13 OF EU REGULATION no. 679/2016 AND CONSENT TO THE PROCESSING OF PERSONAL DATA
Preamble
In accordance with the entry into force of EU Regulation no. 679/2016 (also referred to hereinafter as the GDPR), which established rules relating to the protection of natural persons with regard to the processing of their personal data and the free movement of such data, Marco Travel By Emme Servicie di Candusso Marco altered its Privacy Policy and Cookie Policy to offer users the opportunity to be clearly and transparently informed pursuant to arts. 12, 13 and 14. The policy also lists the rights of data subjects provided for under articles 15 to 22 of the GDPR.
Information pursuant to art. 13, paragraph 1
A) Controller and contacts
The data controller is Samuele De Marie encharged by Marco Travel By Emme Servicie di Candusso Marco Tour Operator, frazione Spineto 245/1 Castellamonte (TO) Italy. tel.: +39 3456933865 – email: info@ilturistico.it
You are informed by the data controller that your personal data will be processed:
– pursuant to articles 12 and 13 of EU Regulation no. 679/2016 (General Data Protection Regulation, referred to hereinafter as the “GDPR”), by specifically authorized parties only for the purposes and using the methods which will be specified hereinbelow in relation to the operation of the ilturistico.it web portal.
You are informed furthermore that data processors are also used by the Controller to perform its activity in compliance with the provisions of GDPR 679/2016.
B) Scope and purposes of processing When you use our services you accept that your personal data will be processed. Personal data means any data that can be related to you, such as your:
a. first and last names
b. email address
c. telephone number
These data will be processed in the ways and forms provided for under the GDPR for the performance of the website´s functions. In particular, the data you have provided or will provide to us are collected in order to offer you the services requested, to inform you on our business activities, or to propose a tailored service more in keeping with your specific needs.
In particular, the personal data you supply to the Controller will be processed for the following
purposes:
– to comply with specific requests you make to the Controller through the Website and its communication tools (contacts area and similar);
– to provide information relating to the services of the Controller further to requests you may make by email, the contacts form and any other means of communication including phone or fax;
– to subscribe to the newsletter and receive marketing messages and information relating to the sector in which the Controller operates, subject to your having given your consent by checking the relevant box;
– other purposes which are additional to or connected to those listed above and fall within the sphere of the website’s activities.
See the Cookie policy for further information on the processing of general data collected automatically during browsing.
This privacy notice only refers to the above-mentioned website, ilturistico.it
Legal basis for processing
Apart from what is set out in the Cookie Policy in relation to browsing data, the legal basis for the processing of the personal data you communicate to the Controller is as follows:
• Art. 6 paragraph 1 (b) of the GDPR, relating to the performance of a contract to which the data subject is party or the taking of steps prior to entering into a contract at the request of the data subject.
This legal basis is of a merely optional and not mandatory nature, with the only consequence being that the Controller may be unable to deliver the above-mentioned services of direct communication or contractual/pre-contractual performance. In any case, data subjects may withdraw consent at any time with immediate effect, interrupting the services and activities referred to.
C) The processing is not based on art. 6 paragraph 1 (f)
D) Recipients and categories of recipients of the data collected
In relation to the above-mentioned purposes, the data may be disclosed to the following parties and/or categories of parties, or may be disclosed to organizations and/or persons performing services, either internally or externally, on behalf of the Data Controller. For greater clarity, these include without being limited to: parties – inside or outside the company
– which provide computing and telematic services for the management of the IT system used by the Controller and telecommunications networks; parties which the Controller reserves the right to appoint as processors; tax authorities and other companies or public entities in compliance with regulatory obligations; authorities with jurisdiction and/or supervisory bodies for compliance with legal obligations.
In no event are personal data transferred or sold to third parties.
Information pursuant to art. 13 paragraph 2
A) Period of storage of the data
Pursuant to art. 5 of the GDPR, in accordance with the principles of lawfulness, limitation of purposes and storage and minimization of data, your data will be stored in compliance with the law and for the length of time necessary for the performance of the activities referred to in the purposes given above for tax, accounting and administrative requirements, to document our activity, to respond to your data recovery requirements, and for the time required to ensure defence before courts.
B) Rights of data subjects
–
Right of Access and Rectification
Pursuant to art. 15 of the GDPR, as data subject you have the right to obtain from the Controller confirmation of whether or not personal data relating to you is processed, and to obtain access to said data and to all the information referred to in art. 15, paragraph 1 (a) to
(h) through the issuing of a copy of the processed data in a structured, commonly used, machine-readable and interoperable format.
Pursuant to art. 16 of the GDPR, as data subject you have the right to obtain from the Controller the rectification and/or completion of the processed data if they are not updated and/or are inaccurate and/or incomplete.
–
Right to Erasure and Right of Restriction
Pursuant to art. 17 of the GDPR, as data subject you have the right to obtain without undue delay from the Controller the erasure of personal data concerning you only in the cases provided for under art. 17 paragraph 1 (a) to (f), with the exception of the cases specifically provided for by art. 17 paragraph 3.
Pursuant to art. 18 paragraph 1 (a) to (d) of the GDPR, as data subject you have the right to request and obtain from the Controller the restriction of the processing of your personal data, or that said data not be subject to further processing or alteration. The Controller guarantees that the restriction of processing is implemented using appropriate technical means ensuring its inaccessibility and inalterability.
–
Right to Data Portability
Pursuant to art. 20 of the GDPR, as data subject you have the right to receive from the Controller the personal data concerning you which has been processed using automated means in a structured, commonly used and machine-readable format, and also have the right to transmit those data to another controller, or to obtain direct transmission of said data by the Controller, where technically feasible, to another specifically identified data controller.
–
Right to Object
Pursuant to art. 21 of the GDPR, as data subject you have the right to object at any time to the processing of personal data concerning you on grounds relating to your particular situation in the event of the processing of your data being necessary (1) for the performance of a task carried out for reasons of public interest and/or in relation to the exercising of official authority vested in the Controller; (2) for the pursuance of a legitimate interest of the Controller or a third party; (3) for profiling activities if carried out by the Controller on the basis of the preceding points. You also have the right to object to the processing of your personal data on grounds relating to your particular situation if they are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89 paragraph 1 of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Method of exercising the above rights
You may exercise your above rights by emailing a request to info@ilturistico.it, or
by registered mail with return receipt requested addressed to Marco Travel By Emme Servicie di Candusso Marco Tour Operator, frazione Spineto 245/1 Castellamonte (TO) – Italy.
Receipt of your request will be confirmed, and you will be provided with information relating to the request within 1 (one) month of its receipt. If necessary, and taking into consideration the complexity and number of requests, this deadline may be extended by 2 (two) months, subject to justification being sent within 1 (one) month of the receipt of the request.
All the recipients to whom the data have been transmitted, as identified under art. 4, paragraph 1 (9) of the GDPR, will be informed of any rectifications, erasures, limitations and objections, unless it proves to be impossible and/or involves disproportionate effort.
Should the Controller have reasonable doubts concerning your identity following the sending of a request for rectification, erasure, limitation or objection, further information will be requested by email in order to confirm said identity.
In the event of the Controller failing to comply with your request within 1 (one) month of its receipt, you will be informed by the Controller of the reasons for this failure to comply and of your right to lodge a complaint with the supervisory authority (Data Protection Authority), as specified pursuant to art. 13 paragraph 2 (d) and regulated by article 77 and subsequent articles of the GDPR.
C) Right to complain
Pursuant to art. 77 of the GDPR, as data subject you have the right to lodge a complaint with a supervisory authority in accordance with the methods indicated in said article.
The reference Authority is the Italian Data Protection Authority:
http://www.garanteprivacy.it/web/guest/home/docweb-displey/docweb/4535524
D) Automated decision-making and profiling
The Controller informs you that no automated decision-making processes – in other words processes aimed at taking decisions based only on technological means on the basis of predetermined criteria (without human involvement) – are used for the purposes of processing your personal data, and no profiling is performed in order to use your personal data to analyze or predict aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements etc.
Processing methods – how do we ensure the protection of your data?
The processing of the personal data you disclose is performed by means of the operations indicated in art. 4 (2) of the GDPR, and to be precise: “collection, recording, organisation, storage, consultation, processing, alteration, selection, retrieval, alignment, use, combination, disclosure, erasure or destruction of the data”.
The personal data you disclose are subjected to automated processing for the time which is strictly necessary in order to achieve the purposes for which they have been collected and using technical and organizational methods employed to prevent the loss, illegal or improper use and unauthorized access to the data, and therefore such as to guarantee a level of security appropriate to the risk pursuant to art. 32 of the GDPR by suitably authorized parties in compliance with the provisions of art. 29 of the GDPR, or employees and/or associates of the Controller in their capacity as authorized parties and/or system administrators who may perform consultation, use, processing, alignment and any other appropriate operations in compliance with the provisions of law necessary to guarantee, among other things, the confidentiality and security of the data, as well as their accuracy, updating and relevance in accordance with the declared purposes and methods.
In particular, unless specified otherwise herein the personal data you disclose will be subject to processing only at the registered offices of the data controller and will not therefore be disseminated, and pursuant to art. 13 paragraph 1 (e) they may only be processed by authorized parties and/or external data processors (professional individuals and/or associations), including explicitly the hosting provider and/or technical personnel assigned to the management and/or maintenance of the website, but only and exclusively for the purposes expressly and specifically indicated a