PERSONAL DATA PROCESSING POLICY
Please note that your personal data will be processed with fairness and thansparency for lawful purposes and protecting your rights. We would also like to inform you of the following:
The data controller is ARIADIMARI SNC, with headquarters in Via Anglona 4, 07039 Valledoria (SS) – ITALY
1. SUBJECT OF PROCESSING
The data controller will process your personal data and, if necessaryand only in specific situations, some sensitive data (in particular, any health conditions related to the provision of the service, such as food intolerances or the presence of motor disabilities) provided by you in connection with the provision of catering and/or hotel services.
2. PURPOSE AND LEGAL BASIS OF PROCESSING
Any personal and sensitive data provided shall be processed for the following purpose:
A) To fulfil the obligations arising from the contract, including your specific needs/requirements;
to fulfil legal obligations as well as current accounting and tax abligations;
to exercise the rights of the dta controller, such as the right of defence in legal proceedings;
B) Only your personal data, with your prior and explicit (Art. 7 GDPR), for the following marketing purpouses:
to send you by mail, post and/or telephone, communication and/or information and promotional material on the initiaives and offers promoted by data controller
C) Only your personal data and data relating to any stays, with your prior and explicit consent, will be used for purposes of analysis and processing of your habits and preferences (profiling), so that we can send you personalised promotional information, as well as any offers from the data controller.
You are free to changeyour consenta t any time (grant or withdraw), in whole or in part, by sending an email with the subject line “WITH DRAW MARKETING CONSENT” to: firstname.lastname@example.org
3. METHODS OF DATA PROCESSING AND DURATION OF DATA STORAGE
The processing of your personal data is carried out by means of the operations indicated in Art. 4 No. 2) GDPR and more precisely: collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnetion, blocking, communication, cancellation and destruction of data. Your personal data is processed both in paper and electronic formatand/or automatically.
The data controller will process personal data for the time necessary to fulfil the above purposes and, in any case, for no more than 10 years from the termination of the relationship for the service purpose and for no more than five years from the collection of data for marketing purposes. The data controller will process sensitive data for the time necessary to fulfil the above purposes and, in any case, no later than 30 days from the and of your stay, except in special situations that determine the need to keep such data for a longer period of time (by way of example, if you are entitled to tax exemtion due to disability).
4. ACCES TO DATA
Your data may be made accessible for the purposes referred to in Articles 2.A), 2.B), and 2.C):
Employees and collaborators of the data controller, in their capacity as data processors and/or persons in charge of processing and/or system administrators.
All the appointed subject will exclusively carry out processing operations, on behalf of the data controller and/or of the person in charge, within the limits, in the forms and according to the methods expressly indicated in the related deeds of appointment.
To third-party companies or other subjects (by way of example, professional studios, consultants, insurance companies, etc. that perform outsourcing activities on behalf of the data controller, in theri capacity as external data processors.
5. NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL TO REPLAY
The provision of data for the purposes referred to in Art. 2.A) in mandatory. If you do not provide your data to us. We will not be able to provide your data to us, we will not be able to provide the services indicated in Art. 2.A). The provision of data for the purposes referred to in Art. 2.A), instead, is optional. You may therefore decide not to provide any data or to subsequently oppose to the processing of the data you have already provided: in this case you will not be able to receive newsletters, commercial communications and advertising material relating to the Services offered by the Data Controller. In any case, you will continue to be entitled to the services referred in Art. 2.A).
6. COMMUNICATION OF DATA
With o need for your explicit consent (as per former Art. 6 par.b) and c) GDPR) the Data Controller can disclose your data for the purposes indicated in Art. 2.A) to supervisory and judicial Authorities, as well as to parties to whom such communication must be made by law for the fulfilment od such purposes. These parties will process the data in their capacity as autonomous data controllers. Moreover, the list of outsourced data controllers, which the undersigned uses, can be consulted at any time at the company’s registerd office.
Your data will not be disclosed and will not be transferred to countries outside the UE or to international organisations.
7. RIGHTS OF THE DATA SUBJECT AND LOW TO EXERCISE THEM
As data subject, you have the rights under Art. 15 GDPR, and precisely the rights to: request and obtain from the data controller – without “justified delay” – confirmation as to whether or not your personal data is being processed and the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipient to whom the personal data have been or will be disclosed; d) the envisaged period for which the personal data will be stored; e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; the data subject also has the right to obtain the updatinf, supplementing of data, cancellation, transformation, into anonymous form or blocking of data processed in violation of the law, the data subject may, for legitimatereasons, oppose to the processing of data.
Where applicable, you also have the rights under Artcles 16-21 GDPR (Right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object to processing), as well as the right to lodge a complaint with a supervisory authority.
You may exercise your rights at any time by sending an e-mail to email@example.com