Information on the processing of personal data
Pursuant to art. 13 of EU Regulation 2016/679 of 27 April 2016 – hereinafter referred to as the Regulation – and art. 13 of Legislative Decree 196/2003 and subsequent amendments – together referred to as the Applicable Regulation – we, as Data Controller, provide appropriate information on the fundamental elements of the processing performed.
1) Data controller and data processors
The Data Controller is ARAS S.R.L. Azienda Residence Alberghi Salerno Via Guglielmo Marconi 150 – 84017 Positano (SA) P.IVA 06070510653.
The complete and updated list of the designated data controllers is available, upon request of the interested party, at the Data Controller’s headquarters.
2) Types of data processed
The data collected for the purposes of the possible provision of the service include:
– personal and contact details: name, surname, address, telephone number, identity document number, nationality, e-mail and other contact details;
– tax data;
– any additional data that it deems appropriate to communicate.
Personal data may include particular categories of personal data (for example and not limited to:
religious orientation, state of health) if the interested parties communicate them spontaneously for the purposes of managing
a specific request and will be processed after obtaining explicit consent to the processing.
3) Purpose of the processing
The personal data collected will be processed lawfully pursuant to art. 6 of the Regulation for the following purposes:
a) for the performance of activities connected and consequent to the establishment of a contractual relationship or for the
satisfaction of a request and/or pre-contractual obligations as well as for the quality control of the services provided and
verification of the degree of customer satisfaction;
b) to fulfill tax and accounting obligations and/or obligations established by law, by an authority, by a regulation or by
European legislation in relation to the existing contractual relationship;
c) for communication purposes via social channels and commercial and promotional communication of products and/or
services (e.g. promotional messages, updates on rates and offers)
d) for the protection of company assets through a video surveillance system in some areas of the structure,
appropriately indicated by means of special signs placed before the relative range of action of the cameras.
4) Consequences of failure to provide, legal basis and duration of processing
The provision of personal data for the processing purposes referred to in point 3 letter a), b) of this information notice is essential and mandatory to establish the contractual relationship, therefore failure to communicate the same could make it impossible to execute the contract. The legal basis of the processing is the need to execute a contractual obligation or legal obligation, in compliance with art. 6 of the Regulation, therefore the acquisition of prior consent is not necessary. The processing of personal data will be carried out for the time necessary to achieve the purposes for which they were collected or in any case for the time necessary to ascertain, exercise and defend in court the rights of the Data Controller and the rights of the interested parties, where applicable.
The provision of data for the purposes referred to in point 3 letter c) of this information notice is optional, therefore the Data Controller may process personal data, even after the termination of the contractual relationship, only after obtaining explicit consent from the interested party. At any time, the interested party has the right to object to direct marketing activities by contacting the Data Controller at one of the contacts indicated in this Policy.
The processing of personal data for video surveillance purposes, referred to in point 3 letter d), will not require your consent as it pursues the legitimate interest of the Data Controller to protect company assets and people against possible aggression, theft, damage, and acts of vandalism. Access to video-surveillance areas involves the collection, recording, storage and, in general, use of images of the interested parties. The recorded video images will be stored for 24 hours. After this period, the images will be deleted by overwriting new images.
5) Methods of processing
The processing of personal data will take place, in compliance with the provisions of the Regulation, using paper, computer and telematic tools, with logic strictly related to the purposes indicated and, in any case, with methods suitable to guarantee their security and confidentiality in compliance with the provisions of art. 32 of the Regulation.
6) Communication of data
In order to pursue the purposes described in this information notice, personal data will be processed by employees and similar personnel who are expressly authorised to process the data and who have received adequate operating instructions.
Furthermore, the Data Controller may need to communicate the personal data of the interested parties to third parties (also based outside the European Union, in compliance with the regulatory requirements that allow it) belonging, by way of example and not limited to, to the following categories:
a) parties providing support services for the execution of contractual obligations relating to the provision of a service and the satisfaction of a request;
b) persons, companies, associations or professional firms providing services, assistance and consultancy in accounting, administrative, legal, tax, financial, commercial and technical matters to the Data Controller;
c) other parties that the Data Controller uses in various capacities for the supply of the requested product or service;
d) parties providing services for the management of the IT system, the website and online tools;
e) subjects that provide payment services and/or banking institutions;
f) subjects whose right to access the data is recognized by provisions of law and secondary legislation or by provisions issued by authorities legitimated by law.
The subjects belonging to the categories listed above operate, in some cases, in complete autonomy as separate Data Controllers, in other cases, as Data Processors specifically appointed by the Data Controller in compliance with art. 28 of the Regulation.
The data relating to the processing purposes referred to in point 3 d), will not be communicated to third parties, except in the case in which it is necessary to comply with a specific investigative request by the judicial authority or the judicial police.
Interactions with Third-party payment processors are governed by the privacy policy of the organization that provides them.
The personal data processed within the Social Networks can be made visible and communicated based on the privacy preferences that you have set on that Social Network that acts as an independent Data Controller.
7) Rights of interested parties
The rights guaranteed by the Applicable Regulations may be exercised by contacting the Data Controller, by sending a certified email to the following address pec in.tur@pec.it or by registered mail with return receipt to the registered office of the Data Controller INTUR srl Via S. Tecla, 8 Cap 84010 Maiori (Sa). The Data Controller will take charge of such requests and provide, without unjustified delay and, in any case, no later than one month after receiving the same, the information relating to the action taken regarding the request.
Pursuant to the Applicable Regulations, we inform you that you have the right to obtain the indication (i) of the origin of the personal data;
(ii) of the purposes and methods of the processing; (iii) of the logic applied in the case of processing carried out with the aid of electronic instruments; (iv) of the identification details of the owner and the managers; (v) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them in their capacity as managers or agents. Furthermore, you have the right to obtain:
a) access, updating, rectification or, when interested, integration of the data;
b) cancellation, transformation into anonymous form or blocking of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;
c) certification that the operations referred to in letters a) and b) have been brought to the attention, also with regard to their content, of those to whom the data were communicated or disseminated, except in the case in which such fulfillment proves impossible or involves the use of means manifestly disproportionate to the right protected.
Furthermore, you have:
a) if applicable, the right to data portability (the right to receive all personal data concerning you in a structured, commonly used and machine-readable format), the right to limit the processing of personal data and the right to erasure (“right to be forgotten”);
b) the right to object, in whole or in part, for reasons connected to your personal situation, to the processing of personal data concerning you, even if pertinent to the purpose of the collection, as well as to object, at any time, to the processing of data for marketing purposes or to object only with regard to certain methods;
c) if you believe that the processing of personal data carried out by the Data Controller violates the Regulation, the right to lodge a complaint with a Supervisory Authority (in the Member State in which you habitually reside, in the one in which you work or in the one in which the alleged violation occurred). The Italian Supervisory Authority is the Garante per la Protezione dei Dati Personali, with headquarters in Piazza Venezia n. 11 – 00187 Rome – email: protocollo@gpdp.it – pecprotocollo@pec.gpdp.it – http://www.garanteprivacy.it