EXTENDED DISCLOSURE PURSUANT TO ART. 12, 13 AND, IF NECESSARY, 14 OF THE GDPR – REGULATION (EU) 2016/679 ON THE PROTECTION OF PHYSICAL PERSONS, WITH REGARD TO THE PROCESSING OF PERSONAL DATA (BELOW THE GDPR)
The data controller reports, below, the information pursuant to articles 12, 13 and, if necessary, 14 of the GDPR relating to the processing of personal data provided by the Customer / interested party by completing and signing the Contract to purchase the products / services offered for sale by the data controller, spontaneously uploading data on this website personal (in particular by filling out forms) or simply by browsing through it.
1. Data controller and contact details
The data controller is ROME TRAVEL START LIMO & SERVICE SOC COOP, with registered office in VIA DEL VELODROMO 44 – 00179 – Rome (RM), P.I. 13246881000, tel. +39 3403976624, e-mail firstname.lastname@example.org, web www.rometravelstart.com.
2. Principles applicable to treatment
In accordance with the provisions of the GDPR, the data controller constantly works to ensure that personal data are:
- processed in a lawful, correct and transparent way;
- collected for specific, explicit and legitimate purposes, and subsequently processed in a way that is not incompatible with these purposes;
- adequate, relevant and limited to what is necessary with respect to the purposes for which they are processed;
- accurate and, if necessary, updated;
- kept for a period of time not exceeding the achievement of the purposes for which they are processed;
- processed, through appropriate technical and organizational measures, in order to guarantee their safety;
- processed, if by consensus, by decision freely taken by the Customer / interested party, on the basis of a request presented in a clearly distinguishable from the rest, in an understandable and easily accessible form, using simple and clear language.
The data controller adopts adequate technical and organizational measures in order to ensure the protection of personal data from the planning stage and to ensure that, by default, only the data necessary for each specific processing purpose is processed.
The data controller collects and takes the utmost account of the indications, observations and opinions of the Customer / interested party sent to the addresses indicated above, in order to implement a dynamic privacy management system that ensures effective protection of people, with regard to the processing of their data.
This information may undergo changes, in line with the evolution of the reference legislation and of the technical and organizational measures gradually adopted by the data controller; the Customer / interested party is therefore requested to periodically visit this section of the Site, to view the updates and the information in the text from time to time in force.
3. Methods of processing personal data
The processing of personal data is carried out manually and with electronic tools, with logic strictly related to the purposes indicated below and, in any case, in order to guarantee the security and confidentiality of the data.
4. Purpose of the processing of personal data
(4a) Purposes for which data processing is necessary
The personal data provided by the Customer / interested party are mainly processed for the execution of the Contract and the management of the credit and, more generally, of the relationship arising from the Contract itself.
The provision of data in the Contract or later, during the contractual relationship, for the purposes of processing in question is mandatory; therefore, the failure, partial or incorrect provision of such data makes it impossible to stipulate and / or execute the Contract and, for the Customer / interested party, to take advantage of the products / services offered by the data controller, potentially exposing the Customer / data subject himself to liability for contractual breach.
The personal data provided by the customer / interested party may also be processed if this is necessary to fulfill a legal obligation to which the data controller is subject, to safeguard the vital interests of the customer / interested party or another person. physical, for the execution of a task of public interest or connected to the exercise of public powers with which the data controller is invested, or for the pursuit of the legitimate interest of the data controller or of third parties, provided that they do not prevail the interests or fundamental rights and freedoms of the Customer / interested party; even in these cases, the provision of data is mandatory and, therefore, the failure, partial or incorrect communication of the data may expose the Customer / interested party to any liability and sanctions provided for by the Legal Order.
(4b) Further purposes of the processing following specific and express consent of the Customer / interested party
In addition to the aforementioned processing purposes, the personal data provided / acquired can be processed, with the consent of the customer / interested party, to be expressed by checking the box <<Give consent>> on the Contract or on the Site (or using other social or web applications of the data controller), also for carrying out market surveys and for carrying out commercial and promotional communications, by telephone (also using the mobile phone number provided) and automated contact (e-mail, sms, mms, fax, etc.), on products / services of the data controller or of Group companies to which the data controller possibly belongs.
Consent for the processing purposes referred to in this point (4b) is optional; therefore, following any refusal, the data will be processed only for the purposes indicated in the previous point (4a), except as specified below with reference to the legitimate interests of the data controller or third parties
5. Categories of personal data processed
The data controller mainly processes identification / contact data (name, surname, addresses, type and number of identification documents, telephone numbers, e-mail addresses, of a fiscal / billing nature, except for others) and, if required commercial transactions, financial data (of a banking nature, in particular identification of current accounts, credit card numbers, except for others connected to the aforementioned commercial transactions).
The treatment that the data controller carries out, both for the execution of the Contract and by virtue of the express consent of the Customer / interested party, does not generally concern particular categories of personal data, known as sensitive (which reveal racial or ethnic origin , political opinions, religious beliefs, state of health or sexual orientation, etc.), nor genetic and biometric data or so-called judicial data (relating to criminal convictions and crimes).
However, it cannot be excluded that the data controller, in order to perform the obligations deriving from the Contract, must retain and / or need to process sensitive, genetic and biometric or judicial data, of the Customer / interested party or of third parties, of which the Customer / data subject arranges as data controller; in the hypothesis in question, the treatment by the data controller takes place in force, under the conditions and within the limits of the appointment of the same data controller as data processor, by the Customer / interested party.
The data controller treats, as the data controller with reference to the Site, and, potentially, as the data processor assigned to it (in the terms above) by the Customer / interested party, also the so-called navigation data. During their normal operation, the IT systems and software procedures used to operate the websites acquire some personal data, the transmission of which is implicit in the use of internet communication protocols. This is information that is not collected to be associated with identified subjects, but which, by their very nature, could allow identification of the interested party. This category of information includes geolocation data, IP addresses, browser type, operating system, domain name and addresses of websites from which access or exit has been made, information on the pages visited by users within of the site, access time, stay on the single page, internal route analysis and other parameters relating to the operating system and the user’s IT environment. It is, therefore, information that, by its very nature, allows users to be identified through processing and association with data held by third parties.
Cookies can then be used on the Site, both session (which are not stored on the data subject’s computer and disappear when the browser is closed) and persistent, for the transmission of personal information, or in any case of systems for tracking of interested parties.
6. Source of personal data
The personal data that the data controller processes are collected directly by the data controller at the Customer / interested party at the time of, and during, navigation of this on the Site (or using other social or web applications of the data controller), or , also by means of its salespeople, on the occasion of, or subsequent to, the signing of the Contract, during the execution of the same, or from public sources. As specified above, the data controller, as data controller in charge of this, in order to perform the obligations deriving from the Contract, can store and / or process data, in particular navigation, potentially also sensitive, genetic and biometric or judicial data, of third parties, which the Customer / interested party has as a data controller, acquired, with the consent of said third parties, at the time of, and during, the navigation of the same third parties on the Site (or using other social or web applications referable to the owner of treatment).
7. Legitimate interests
The legitimate interests of the data controller or third parties can constitute a valid legal basis for the processing, provided that the interests or fundamental rights and freedoms of the data subject do not prevail. In general, such legitimate interests can exist when there is a relevant and appropriate relationship between the data controller and the interested party, for example when the data subject is a customer of the owner. In particular, it is the legitimate interest of the data controller to process personal data of the customer / interested party: for the purposes of fraud prevention, for direct marketing purposes, to ensure the free movement of the same data within the business group to which the owner of the processing possibly belongs, or relating to traffic, in order to guarantee the security of networks and information, i.e. the ability of a network or system to resist unexpected events or illegal acts that could compromise availability, l authenticity, integrity and confidentiality of data.
(8a) Disclosure of personal data – categories of recipients
In addition to the employees and collaborators in various capacities of the data controller (who are authorized by the data controller to process them by virtue of adequate written operating instructions, in order to guarantee the confidentiality and security of data), some processing operations they can also be carried out by third parties, to whom the data controller entrusts certain activities, or part of them, functional to the purposes referred to in point (4a), therefore both in execution of contractual and legal obligations, among which they deserve mention, to however, inevitably, this is not an exhaustive title: commercial and / or technical partners; companies that provide banking and financial services; companies that perform document archiving services; debt collection companies; auditing and auditing companies; rating company; subjects who carry out, in favor of the data controller, professional assistance and consultancy; companies that carry out customer care activities; factoring, credit securitization or other assignees companies; Group companies to which the data controller possibly belongs; subjects that provide commercial information; IT services companies. The subjects belonging to the aforementioned categories process the personal data themselves as independent data controllers, or as data controllers, with reference to specific processing operations that fall within the contractual services that the subjects themselves perform in favor / in the interest of the data controller; to the data processors the data controller gives adequate written operating instructions, with particular reference to the adoption of minimum security measures, in order to guarantee the confidentiality and security of the data. Some processing operations can be carried out by third parties, to whom the data controller entrusts certain activities, or part of them, also functionally to the purposes referred to in point (4b), among which they deserve mention, however, inevitably, not comprehensive: commercial and / or technical partners; companies that provide marketing services institutionally; advertising agencies; subjects who provide assistance and consultancy with reference to competitions and prize operations. The subjects belonging to the aforementioned categories process personal data as independent data controllers, or as data controllers, with reference to specific processing operations that fall within the contractual services that the subjects themselves perform in favor / in the interest of the data controller; the data controller gives adequate written operating instructions to the data processors, with particular reference to the adoption of minimum security measures, in order to guarantee the confidentiality and security of the data. The list, subject to periodic updating, of the data processors with whom the data controller maintains relationships is available upon written request to be sent to the headquarters of the data controller. Personal data may also be communicated, in the event of a request, to the competent authorities, in fulfillment of obligations deriving from mandatory laws.
(8b) Transfer of personal data to third countries
The personal data of the Customer / interested party can also be transferred abroad, both in European Union countries and in countries outside the European Union and, in the latter case, or on the basis of an adequacy decision, or in the context and with the adequate guarantees provided by the GDPR (therefore, in particular, in the presence of contractual clauses of data protection approved by the European Commission), or, outside the cases mentioned above, using one or more of the derogations provided by the GDPR (in particular, by virtue of the explicit consent of the Customer / interested party, or for the execution of the Contract concluded by the Customer / interested party, or for the execution of a contract entered into between the data controller and another natural person or in favor of the Customer / interested party, in particular for the execution of activities entrusted to it by the data controller for the execution of the Contract concluded with the Customer / interested party). For the hypothesis of data transfers to countries outside the European Union, the customer / interested party is allowed, upon written request to be sent to the headquarters of the data controller, to know the adequate guarantees, or derogations, which legitimize cross-border processing. It is understood, in the event of transfer of data to countries outside the European Union, that for any request concerning the data, also for the exercise of the rights recognized by the GDPR to the customer / interested party, this can always validly contact the owner of the treatment.
9. Criteria for determining the retention period of personal data For the purposes referred to in point (4a) above, the retention period of personal data issued by the Customer / interested party, and the consequent potential treatment thereof, coincides with the period of prescription of the rights / duties (legal, fiscal, etc.) deriving from the Contract: basically 10 years, therefore, except for the occurrence of events interrupting the prescription which could actually prolong said period. For the purposes referred to in point (4b) above, the retention period of the data released by the Customer / interested party, and the consequent potential treatment thereof, ends with the revocation of the consent previously issued by the Customer / interested party or, in the absence of this, however, one year after the termination of any relationship between the data controller and the customer / interested party.
10. Customer / interested party rights
The data controller recognizes – and facilitates the exercise by the customer / interested party – of all the rights provided by the GDPR, in particular the right to request access to their personal data and to extract a copy (art.15 GDPR), rectification (art.16 GDPR) and cancellation of the same (art.17 GDPR), limitation of the processing that concerns him (art.18 GDPR), data portability (art. 20 GDPR, where the conditions exist) and to oppose the processing that concerns him (articles 21 and 22 GDPR, for the hypotheses mentioned therein and, in particular, the treatment for marketing purposes or that translates into an automated decision-making process , including profiling, which produces legal effects concerning him, if the conditions exist). The data controller also recognizes the customer / interested party, if the treatment is based on consent, the right to withdraw said consent at any time, without prejudice to the lawfulness of the treatment based on the consent given before the revocation. To do this, the Customer / interested party can unsubscribe at any time on the Site (or on other social or web applications of the data controller) or by using the appropriate link at the bottom of each commercial communication received, or by contacting the data controller at contact details above. The data controller also informs the Customer / interested party of the right to lodge a complaint with the Guarantor Authority for the Protection of Personal Data, as a supervisory authority operating in Italy, and to propose a judicial appeal, both against a decision of the Guarantor Authority , as regards the data controller and / or a data processor.
11. Security of systems and personal data
Taking into account the state of the art and implementation costs, as well as the nature, object, context and purpose of the treatment, as well as the risk, in terms of probability and seriousness, for the rights and freedoms of natural persons , the data controller adopts technical and organizational measures deemed appropriate to guarantee a level of security appropriate to the risk, in particular by ensuring, on a permanent basis, the confidentiality, integrity, availability and resilience of the treatment systems and services ( also through the encryption of personal data, where necessary) and the ability to promptly restore the availability of data in the event of a physical or technical accident, and by adopting internal procedures aimed at testing,regularly check and evaluate the effectiveness of the technical and organizational measures used. In assessing the adequate level of security, account is taken of the risks presented by the processing which derive, in particular, from the destruction, loss, modification, unauthorized disclosure or access, accidentally or illegally, to personal data transmitted, stored or otherwise processed. The data controller endeavors to ensure that anyone who acts under his own authority and has access to personal data does not process such data unless instructed to do so by the same data controller. That said, the customer / interested party acknowledges and accepts that no security system guarantees absolute protection in terms of certainty; therefore, the data controller is not liable for acts or facts of third parties who illegally, despite the adequate precautions adopted, were to access the systems without the necessary authorizations.
12. Automated decision-making processes, including profiling
The data controller can carry out automated treatments, including profiling, in relation to the purposes referred to in point (4b) above, to optimize the navigability of the Site (or the usability of other social applications or web of the data controller) and to improve the purchase experience, except as specified above with regard to the rights of opposition and revocation of consent by the Customer / interested party. Profiling means any form of automated processing of personal data aimed at evaluating certain aspects relating to a natural person, in particular to analyze or predict aspects concerning, for example, personal preferences, interests or location of that person, also in order to create profiles, or homogeneous groups of subjects by characteristics, interests or behaviors. The data controller does not carry out any automated processing that produces legal effects that affect the Customer / interested party or that significantly affect his person in a similar way, unless this is necessary for the conclusion or execution of the Contract, is authorized by law or is based on the explicit consent of the Customer / interested party, in any case always recognizing the latter the right to obtain human intervention, to express his opinion and to contest the decision.