INFORMATION ABOUT PROCESSING OUR CUSTOMERS PERSONAL DATA
according to law Art. # 13 and 14 - EU REGULATION 2016/679
The data controller (hereinafter referred as "Owner" or “Company”) is LA BOTTEGA DELL'ALBERGO S.P.A., registered office in VIA MARCO POLO 2, TRECASTELLI (AN) - 60012, Telephone: 0039.071.791191, p.e.c. [email protected]
Legal basis of the processing
Following its economic and business purposes, the Company collects personal identification data, such as name and surname, tax code, VAT Nr., email address, telephone number, hereinafter briefly defined as "data" referring to the following interested parties:
∗ customers (including LEAD) of the Company (if these customers (including potential) are physical/natural persons)
∗ employees of the (including potential) customers of the Company
∗ suppliers and subcontractors of the Company (if these suppliers and subcontractors are physical/natural persons)
∗ employees of Company’s suppliers and subcontractors.
Below the list of the purposes, legality, and duration of each treatment by the Company.
The Company handles personal data to fulfill pre-contractual, contractual and tax obligations deriving from existing relationships; the basis of legality of this processing is the execution of a contract. The duration of the treatment will have a duration equal to the execution of the requested services, with the addition of extra period officially provided in compliance with the civil, fiscal and tax obligations in force.
The Company processes personal data to fulfill the obligations established by law, by a regulation, by community legislation or by an order of the Authority, the basis of lawfulness of this treatment is the fulfillment of a legal obligation and the data retention time is that legally provided in compliance with the civil, fiscal and tax obligations in force.
For the exercise of the rights of the Data Controller, for example the right of defense in court, whose lawfulness basis is the legitimate interest of the Company, also in this case the data retention time is that provided for by law in compliance with the obligations of nature, fiscal and tax laws in force.
Please note that in case of failure to provide personal data, it may not be possible to perform the contract between the owner and the person concerned.
The Data Controller has the right to use the e-mail provided by the interested party in the context of the sale of a product or service for direct sales of its products or services, even not requiring the permission of the interested party, always in service similar to those of the sale; the interested party, adequately informed by this information, can refuse such use of his email address easily and free, initially or in subsequent communications, through the cancellation option always shown in electronic communications.
On the legal basis of the specific and distinct consent (Article 7 GDPR) of the interested party, optional and revocable at any time, without any consequence on a contractual basis and in the supply of goods and services, the processing is carried out for the following additional purposes:
- marketing, through automated contact methods (e.g. sms, e-mail and instant messaging) and traditional (e.g. telephone calls with operator and traditional mail) to send promotional and commercial communications relating to products and services marketed by the Data Controller and not related to those that the interested party has already purchased or for which he has expressed his interest.
The data processing is carried out by means of the operations of: collecting, recording, organizing, storing, retrieving, processing, modification, selection, retrieval, comparison, use, interconnection block, communication, cancellation and destruction of data.
The data are subjected to both paper and electronic and/or automated processing.
The processing of data with reference to the purposes of marketing will have a duration up to 24 months starting from the date of transmission of data by the interested party or from the date of the last use of the services offered or of the last purchase sold by the Owner, unless disagreement can be expressed at any time through the appropriate cancellation option present in electronic communications, text messages, instant messaging, paper document or by contacting the Company.
The data may be disclosed to subjects operating as data controllers, such as the supervisory and control authorities and any legitimate public entity, like the judicial and/or public security authorities.
The data may also be communicated and processed, on behalf of the Owner, by subjects designated as data processors, such as specialists of this field and companies that perform services like those of the Data Controller, IT services, tax and fiscal consultancy services or legal advice services.
These subjects will process data in their capacity as independent data controllers or external managers, without being able to disclose them.
The complete list of persons designated as external administrators is kept by the Company.
Data transfer to third countries
There is no intention of the data controller to transfer the data to a third country (i.e. extra CEE) or to an international organization; the data are processed exclusively within member states of the European Union.
The Owner reserves the right to use cloud services and in this specific case the service providers will be selected from those who provide adequate guarantees, as required by Article Nr. 46 of GDPR 2016/679
Rights of the interested party
The interested party has the rights ruled by art. Nr. 15 GDPR and precisely the rights to: request access to data concerning the interested party, their cancellation, correction of inaccurate data, integration of incomplete data, limitation of processing, portability as well as opposing to process in case of legitimate interest of the Company.
The interest party has the right to submit a complaint to the competent Supervisory Authority in the Member State in which usually lives or works or in the State in which the alleged violation occurred.