Dear User,
pursuant to art. 13 of EU Regulation 2016/679 (hereinafter "Regulation"), Azienda Per il Turismo Valsugana soc. coop. Informs you of the following:
1. Data controller
With regard to the data processing indicated in paragraph 2.2 letters a), the Data Controller is:
Azienda Per il Turismo Valsugana soc. coop.
Viale Vittorio Emanuele, 3
38056 Levico Terme (TN) – Italia
Mail: info@visitvalsugana.it
Phone: +39 0461 727700
As regards the data processing indicated in paragraph 2.1 letter a), Azienda Per il Turismo Valsugana soc. coop. acts as Data Processor and the Data Controller is the accommodation facility you have selected.
For complete information abount data processing executed by individual accommodation facilities and / or that provide the services, please refer to the their website, which can also be reached from the link on the website where the booking is made.
2. Purpose of processing and legal bases
- Your personal data are collected and processed by Azienda Per il Turismo Valsugana soc. coop., as Data Processor, for the following purposes:
- purposes strictly related to the booking and / or budgeting service resulting from the request for availability of accommodation at the accommodation facilities within the relevant tourism sector. The legal basis for the data processing described is represented by the provision of art. 6 par. 1 letter b) of the 2016/679 EU Regulation (“processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”).
Data belonging to special categories of personal data may also be processed (Article 9 of EU Regulation 2016/679), only with your consent, in order to satisfy your requests.
The provision of your data, including special ones, is necessary as their failure to provide them could make it impossible to proceed with some data processing, such as those strictly connected to the fulfillment of the contract or to the provision of the requested services.
- Your personal data are collected and processed by the Azienda Per il Turismo Valsugana soc. coop., as Data Controller, for the following purposes:
- purposes strictly related to the provision of services on the Site (with the exception of what is indicated in the previous point), including participation in events, activities and experiences organized and promoted by Azienda Per il Turismo Valsugana soc. coop ..
The legal basis for the data processing described is represented by the provision of art. 6 par. 1 letter b) of the 2016/679 EU Regulation (“processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”).
The provision of your data is necessary as failure to provide them may make it impossible to proceed with some treatments, such as those strictly related to the fulfillment of a contract or the provision of the requested services.
In all cases where the data processing is based on the consent of the data subject, it will always be possible to revoke the same by requesting the Data Controller, without prejudice to the data processing put in place up to the moment of receipt of the revocation.
3. Data type
The data necessary for the pursuit of the aforementioned purposes will be collected and processed:
- identification data
- contact details
- data relating to the contractual relationship
4. Refusal to provide data
Apart from what is specified for navigation data, users/visitors are free to provide their personal data. The provision of data is in some cases necessary because, any refusal to provide it, could result in the failure to conclude or incorrect fulfillment of the contract of which the data subject is a part and/or failure to comply with the legal obligations to which the Data Controller is subject.
The provision of data for treatments that require consent is optional, failure to provide it will not make it impossible to use the products / services offered by the owner. Even in the case of consent, the data subject will still have the right to subsequently object, in whole or in part, to the processing of their personal data for the purposes set out above, making a simple request to the Data Controller at the addresses indicated above.
5. Data source
The data will be provided by the data subject or collected from third parties.
6. Processing methods
In accordance with the provisions of art. 5 of the Regulation, the personal data being processed will be:
- processed in a lawful, correct and transparent way towards the interested party;
- collected and recorded for specific, explicit and legitimate purposes, and subsequently processed in terms compatible with these purposes;
- adequate, relevant and limited to what is necessary with respect to the purposes for which they are processed;
- exact and, if necessary, updated;
- treated in such a way as to guarantee an adequate level of security;
- stored in a form that allows the identification of the interested party for a period of time not exceeding the achievement of the purposes for which they are processed.
The treatment will be carried out both with manual and/or IT and telematic tools with organization and processing logics strictly related to the purposes themselves and in any case in order to guarantee the security, integrity and confidentiality of the data in compliance with the organizational, physical measures and logics required by current provisions.
7. Data communication
Personal data may be communicated to the persons authorized to process, as well as to the external data processors appointed by the Data Controller (the complete list of external managers is available from the Data Controller), responsible for managing the purposes set out above. As part of the pursuit of the aforementioned purposes, the data may be disclosed to other subjects who act as independent Data Controllers.
8. Data dissemination
Personal data will not be disseminated.
9. Data transfer abroad
For the purposes indicated above, personal data will be processed within the European Economic Area (EEA). If they are transferred to third countries, in the absence of an adequacy decision by the European Commission, the provisions of the applicable legislation on the transfer of personal data to third countries will be respected, such as the Standard Contractual Clauses provided by the European Commission. For partners and sponsors whose establishment is located in non-EU countries, consent for the transfer is required and for each person with these characteristics the country will be specified.
10. Data retention
In general, personal data will be kept for the time strictly necessary to pursue the purposes for which they were collected and subjected to processing, including the retention period required by applicable legislation and, in any case, for a maximum period of 10 years from the termination of the relationship between the Data Controller anda data subject, for a maximum period of 2 years or until revocation for the purposes in which your consent is required, except for the possible need of the Data Controller to defend his right in court.
11. Rights of the data subjects
Pursuant to EU Regulation 2016/679 art. from 15 to 22 and of the current national legislation, the data subject may, according to the methods and within the limits established by the current legislation, exercise the following rights:
- request confirmation of the existence of personal data concerning him (right of access);
- know its origin;
- receive intelligible communication;
- have information about the logic, methods and purposes of the treatment;
- request the updating, correction, integration, cancellation, transformation into anonymous form, blocking of data processed in violation of the law, including those no longer necessary for the pursuit of the purposes for which they were collected;
- as well as, more generally, exercise all the rights that are recognized by the current provisions of the law.
The exercise of rights may take place by sending a request that must be addressed without any formality to the Data Controller at the addresses indicated above.
Before providing an answer, the Data Controller may need to identify the data subject, by requesting to provide a copy of his identity document.
Written feedback will be provided without undue delay and, in any case, no later than one month after receipt of the request.
12. Complaint
In the event that the data subject believes that the processing of their personal data violates the provisions of EU Regulation 2016/679, he has the right to lodge a complaint with the supervisory authority, pursuant to art. 77 of the Regulation itself, as well as resorting to the judicial authority.