PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

This privacy information, provided pursuant to art. 13 of the EU General Data Protection Regulation 2016/679 (“GDPR“), contains information on the processing of personal data provided by users during navigation, when completing forms, or when interacting with any other features on the website (hereinafter the “Website”), as further specified below.

The Data Controller

The Data Controller’s details and contact information are specified on the Website.

Personal data processed

a) Browsing data

The computer systems and software procedures used to operate the Website may acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of devices used by users connecting to the Website, the URI (Uniform Resource Identifier) ​​addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.), and other parameters relating to the user’s operating system and IT environment.

This data is used solely to obtain statistical information on the use of the Website and to verify its correct functioning, to allow the correct provision of the various requested features, and to ascertain any liability in the event of hypothetical computer crimes against the Website or third parties.

With reference to personal data collected through cookies, please read the Cookie Policy.

b) Other data voluntarily provided by the user

The Data Controller The Data Controller may also process additional personal data, such as name, surname, email address, telephone number, payment information, and any other data voluntarily provided by the user, for example, when filling out forms, interacting with the chatbot or AI Voice, and when purchasing products and services available on the Website.

Furthermore, the Data Controller may process so-called tracking pixels, which are very small, transparent, and invisible images inserted in the body of emails sent for service or commercial communications, if the user has given their consent. Every time the recipient opens the message and has enabled image downloads, the pixel is downloaded from the sender’s remote server, automatically transmitting information such as: (i) the recipient’s device’s IP address, (ii) the type of client/browser and operating system used, (iii) the date, time, and number of times the message has been opened, and (iv) the recipient’s unique identifier.

Purposes and legal bases for processing

Personal data will be processed for the following purposes, where applicable:

 

  1. allow browsing the Website and providing the requested web services and features;
  2. create a reserved area within the Website;
  3. allow you to finalize the purchase process for products and services offered by the Data Controller;
  4. manage and respond including by telephone to requests for information/assistance sent via the contact channels available on the Data Controller’s website and the channels available on the Data Controller’s social media platforms (e.g., Instagram Direct and Facebook Messenger), possibly managed via artificial intelligence systems such as chatbots to respond to requests, AI Voice, which requires recording and transcription of telephone calls to provide the service;
  5. provide a service (possibly provided via artificial intelligence systems) requested directly by the user, including a request for a quote, the possibility of making a reservation, or requesting a coupon to take advantage of offers offered by the Data Controller.

 

The legal basis for the aforementioned purposes is the performance of a contract to which the user is a party or the implementation of pre-contractual measures adopted at their request. Providing personal data in such cases is necessary. Failure to provide the data may make it impossible to conclude the contractual relationship.

Personal data will be processed for additional purposes, such as, where applicable:

 

  1. verifying the correct functioning of the Website and web services and ensuring adequate website security;
  2. sending newsletters/informative communications regarding news and initiatives regarding the service offered by the Website requested by the user;
  3. establishing, exercising, and defending a right in or out of court.

 

The legal basis for the aforementioned processing is the legitimate interest of the Data Controller. If the user wishes to exercise the right to object, limited to purpose no. 7, they can use the opt-out link in the footer of each of the aforementioned communications.

Finally, personal data will be processed for the following purposes:

 

  1. Comply with legal and regulatory obligations and requests from competent authorities.

 

The legal basis for the processing is the legal obligation to which the Data Controller is subject. Providing personal data for this purpose is necessary to comply with legal and regulatory obligations and requests from the competent authorities.

Personal data will also be processed to:

 

  1. send commercial communications and promotional material regarding the Data Controller’s services and products, including through the use of tracking pixels. These communications may be sent via automated and non-automated contact methods (text messages and email). These communications may also be managed through the use of artificial intelligence systems for the Data Controller’s campaign creation;
  2. send personalized promotional communications, via automated and non-automated contact methods (email, text message) based on the interests and preferences expressed by the user and which may involve the use of artificial intelligence systems for the Data Controller’s campaign creation.

 

This processing is based on the consent, which the user may revoke at any time. Providing personal data and the related consent is optional. Failure to provide data for this purpose, however, will make it impossible for the Data Controller to pursue the aforementioned purposes.

Categories of data recipients

The Data Controller may communicate personal data to external parties who act as data controllers or who process personal data as data processors. In the latter case, the Data Controller regulates such processing through a data processor appointment contract pursuant to art. 28 GDPR, which provides the data controller with specific instructions on the processing of personal data.

Personal data may be disclosed to the following categories of recipients, including:

 

  • • individuals, professional firms, or companies that provide support, assistance, and consultancy services, such as accounting, administrative, legal, and marketing, and in relation to the provision of requested services;
  • • banks and credit institutions;
  • • third-party companies that provide artificial intelligence systems used in the provision of various services contained within the Website;
  • • individuals, entities, or authorities to whom the disclosure of data is mandatory by law or by order of the authorities.

 

If the user wishes to receive further information regarding the list of recipients, he or she can send a request to the Data Controller’s email address. of the treatment.

Transfer of data abroad

For the purposes indicated above, the Data Controller may need to transfer personal data outside the European Union to countries for which the European Commission has not issued an Adequacy Decision. In this case, it undertakes to ensure adequate levels of protection and safeguards, including contractual ones, in accordance with applicable regulations, including the stipulation of standard contractual clauses pursuant to Article 46, paragraph 2, letter a) of the GDPR. c) of the GDPR, supplemented where necessary by additional technical, legal, and organizational measures to ensure that the level of personal data protection is equivalent to that of the European Union.

If the user wishes to receive further information regarding the safeguards in place and request a copy thereof, they can send a request to the Data Controller’s email address.

Retention period for personal data

The Data Controller retains personal data for the time necessary to achieve the purposes for which they were collected or for any other legitimate related purpose, in accordance with the storage limitation principle set forth in Art. 5, paragraph 1, letter e) of the GDPR. When personal data is processed for two different purposes, the Data Controller retains such data until the purpose with the longest term ceases to exist, and subsequently the Data Controller anonymizes, aggregates, or deletes it.

In general, the user’s personal data processed for purposes 1-3, 6-7 are retained for the entire duration of the relationship (except for purpose 7, for which the retention period may be shorter if the user decides to exercise the right to object), and limited to the personal data strictly necessary in line with the GDPR’s retention limitation principle for no longer than 10 years following the termination of the relationship, except in cases where data retention for a longer period is required for any disputes, requests from the competent authorities, or pursuant to applicable law.

Data processed for the purposes of fulfilling a legal obligation are retained for a period equal to the duration prescribed for each type of data by law.

In the event that it is necessary to process data for legal protection purposes, they are retained for the time during which any claims and/or actions can be pursued by law, i.e., for the entire duration of the pre-litigation and litigation phases, until the time limit for appeals has expired.

Data processed for the purpose of sending commercial communications and promotional materials are retained for 24 months from the date consent is obtained, or for a shorter period if the user withdraws consent. Data processed for the purpose of sending personalized promotional communications are retained for 12 months from the date consent is obtained, or for a shorter period if the user withdraws consent.

Rights of the data subject

Pursuant to Articles Pursuant to Articles 15 – 21 of the GDPR, the data subject may exercise his or her rights at any time by writing to the Data Controller’s email address. Specifically, the user may request access to his or her personal data, rectification, and erasure of data (for which there is no longer any legal basis for processing by the Data Controller), restriction of processing, and object to processing, unless the contractual relationship cannot be continued in the case of processing and data for this purpose, and with the exception of data whose processing may be necessary to assert or defend a legal claim or to comply with legal obligations. To modify or erase only the data stored on the systems that provide this Website, you can fill out the form at the following link.

The user also has the right to lodge a complaint with the competent Supervisory Authority.