Information on the processing of personal data
pursuant to the European Regulation no. 2016/679 (GDPR)
Dear Customer,
The Consortium for the promotion of tourism in Valchiavenna would like to inform you that the processing of the data that you provide will be carried out using methods and procedures aimed at ensuring that the processing will be in full compliance with the safeguards and rights recognised by the legislation on the protection of personal data.
Below you will find all the information related to the subject, methods and objectives of the processing of your personal data as well as how to exercise your rights.
Data Controller and contact details
Consorzio per la promozione turistica della Valchiavenna
based in Chiavenna (SO),
Piazza Caduti per la Libertà 3
P. IVA e C.F 00738460146,
tel. 0343 37485
e-mail consorzioturistico@valchiavenna.com;
pec cptv@pec.retesi.it.
Responsibility for the protection of personal data
The Data Controller has appointed a Personal Data Protection Officer (RPD/DPO) who can be contacted for information at the e-mail address: francescopalazzo@yahoo.it.
Objectives of the processing
The data processed by the Data Controller concerns:
personal and identification data (such as name, surname, address, landline and/or mobile, fax, tax code, VAT number, business name, e-mail, IBAN code)
The personal data held by the Data Controller are collected directly from the interested party and/or from third-party companies that have provided appropriate guarantees regarding the legitimacy of the acquisition and consent to such processing. By processing of personal data we refer to any operation, or series of operations carried out with or without the aid of automated processes and applied to personal data or a set of personal data, even if not registered in a data bank, such as collection, registration, organisation, structuring, storage, elaboration, selection, blocking, adaptation or modification, extraction, consultation, use, communication through transmission, dissemination or any other form of creating availability, comparison or interconnection, limitation, cancellation or elimination.
Objectives of the processing and legal basis
Your personal data will be collected and processed by the Data Controller for the following purposes:
a. Objectives related to the management of the pre-contractual and contractual relationship:
· management of requests for information on the Controller's products and services;
· management of order and performance of service provision including subscription to information newsletters;
· invoicing and fulfillment of the accounting or legal tax obligations deriving from the contractual relationship;
· fulfillment of obligations established by law, by regulation, community legislation or by an order from the Authority;
· exercise of the rights of the Data Controller, for example the rights of defence in court
The legal basis of such processes is the pre-contractual activity pursuant to art. 6.1, lett. b) del GDPR) and the fulfillment of obligations under the law (pursuant to art. 6.1, lett. c) of the GDPR).
b. For the promotional activities of Services similar to those acquired by the customer
· sending information and advertising material relating to its products and/or services in the case of products and/or services similar to those being sold.
The legal basis of the processing is the legitimate interest of the Data Controller. You may at any time specifically oppose this processing by communicating with the Data Controller (including by e-mail).
c. Promotional and marketing purposes:
· sending information and advertising material relating to the Products and Services provided by the Data Controller through automated (mail, telephone, sms, whatsapp) and non-automated (paper mail, calls through operator) methods;
· communication of events organised by the Data Controller.
The legal basis of the processing is your free and explicit consent which you can revoke at any time by opposing the processing for these purposes by writing to the Data Controller at the addresses indicated above. Should the Data Controller intend to further process the personal data for a purpose other than that for which they were collected, before any further processing, we will provide you with information regarding this different purpose and any other relevant information.
Nature of the provision
The provision of data for the purposes referred to in point a) is mandatory. In their absence, it will not be possible to provide the services themselves, necessary for the fulfillment of obligations related to the management of the requested services and/or the contract, nor to the obligations deriving from these. The provision of data for the purposes referred to in points b), c) is optional and you may at any time oppose the processing for such purposes without this having consequences or prejudicial effects for you or for any services requested.
Processing methods
The data will be processed in compliance with legislation currently in force and in such a way as to guarantee its security, confidentiality, as well as prevent its disclosure or unauthorised use, alteration or destruction. The data will be processed in both paper and electronic format using appropriate tools and support in order to ensure the security and confidentiality of the data.
Data retention period
Your personal data, if you do not object to the processing, will be retained for the time required by the relevant legislation (10 years in the case of contractual purposes) and in any case for a period of time not exceeding that necessary to achieve the purposes indicated.
Recipients of personal data and Communication of data
Data will not be disclosed or communicated to third parties. Notwithstanding communications made in compliance with legal obligations, your personal data may become known as well as by the Data Controller, by employees and collaborators of the same Controller, as authorised personnel for data processing and by external Managers with whom the Data Controller has made specific agreements and very precise instructions in order to guarantee the security and confidentiality of your data, such as administrative/accounting consultants, suppliers of the Company who process data on behalf of the Data Controller.
The complete list of individuals to whom your personal data has or might have been disclosed is at your disposal upon request by e-mail to consorzioturistico@valchiavenna.com
Data transfer to a third country
Your personal data will not be transferred outside the European Union. In the event of any processing of personal data outside the European Union, the activity will only take place after the adoption of adequate guarantees as required by current legislation.
Rights of the interested party
In relation to the processing of data, the rights referred to in the following art. are recognised: 15-22 of the European regulation 2016/679 including;
- the right to access your personal data, obtaining evidence of the purposes pursued by the Data Controller, the categories of data involved, the recipients to whom they may be communicated, the relevant period of retention, the existence of automated decision-making processes;
- the right to attain the correction of inaccurate personal data concerning you without delay;
- the right to attain, in prescribed cases, the cancellation of your data;
- the right to attain the limitation of processing, when possible
the right to request the portability of data provided, that is to say to receive them in a structured format, in common use and readable by an automatic device, also to transmit such data to another data controller, without impediment of any kind in cases where this becomes necessary in accordance with the law;
- the right to object to the processing of data including profiling ;
without prejudice to any other administrative or judicial action, the right to lodge a claim with the Authority warrant officer for the Protection of Personal Data in the manner indicated on the institutional website of the Authority www.garanteprivacy.it.
How to exercise the rights of the interested party
You may, at any time, exercise the rights referred to in art. 15-22 of the European Regulation 2016/679 by sending an e-mail message or by registered letter to the Data Controller of the processing of personal data at the addresses indicated above.
Profiling
The Data Controller does not use automated processes directed at profiling.
