Information on the processing of personal data ex art. 13 GDPR 679/2016

The General Data Protection Regulation n. 679/2016 (EU REGULATION 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL) provides for the protection of individuals with regard to the processing of personal data and the free movement of such data. This information is applicable exclusively to the site www.crocustrip.com and does not concern in any way, other sites.

Pursuant to Article 5 of DGPR 679/2016, this processing is based on the principles of accountability of the data controller, correctness, lawfulness, transparency, limitation of purpose and storage, minimization and accuracy of data, as well as protection of the confidentiality and integrity of the same and the rights of the data subject.

Pursuant to Article 13 of the aforementioned Regulations, the processing of data has as its legal basis that of explicit consent..

TYPE OF DATA PROCESSED:

Personal data, as per the regulations, are any information (e.g. name) concerning an identified or identifiable natural person, even indirectly, or information (e.g. tax code, fingerprint, telephone traffic, image, voice) concerning a person whose identity can however be ascertained through additional information. The personal data processed on this site are: name, surname, tax code, date and place of birth, home address, e-mail address, telephone number and possibly data for the execution of the payment (credit card number).

NAVIGATION DATA:

Computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the communication protocols of the Internet. This information is not collected to be associated with identified interested parties, but by their very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes, among others, IP addresses or domain names of computers used by users who connect to the site, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the response from the server and other parameters regarding the operating system and computer environment. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and are deleted immediately after processing.

DATA PROVIDED VOLUNTARILY BY THE USER

On the site www.crocustrip.com contact data can be found, including e-mail addresses, information request form, newsletter subscription form, booking form for the requested service, etc..

The use of these contact methods is always optional, explicit and voluntary on the part of the user and involves the subsequent acquisition of the address and personal data provided by the user, in order to respond and manage requests or to provide the requested service. The data will be stored for the period necessary to provide the requested service.

PURPOSE OF THE TREATMENT AND ITS LAWFULNESS

The personal data provided are processed for the following purposes:

• The management of the tourist service and for purposes strictly related and instrumental to the management of the service itself (such as communication to suppliers and collaborators). The conferment of data is optional, but it is necessary for the execution of the contract, the refusal to provide such data, makes it impossible to provide the service itself.
• The fulfillment of administrative and fiscal obligations required by laws, regulations and EU legislation. The provision of personal data necessary for these purposes is mandatory.
• Promotion and direct marketing, to carry out public relations activities or market studies. The relative conferment is optional. The data collected may also be used in anonymous and/or aggregate form to carry out market studies and to understand browsing preferences.
• The above-mentioned consent can be validly given only by subjects who have reached the age of 16 years. Minors under 16 years of age must provide consent from the subjects who hold parental authority.

COMMUNICATION:

The personal data provided by users may be communicated to the following categories of subjects:

• subjects in relation to whom the current legislation provides for the obligation to communicate, in compliance with the requirements of the legislation on tax and accounting.
• to external collaborators the owner of the treatment, if it is necessary for the operation of the Site

It is also specified that the personal data provided will not be communicated to other subjects, nor will they be subject to diffusion or transfer outside the European Union. They may, with prior consent, be circulated in the following ways:

• Images - will be used on resale channels, websites and social networks owned to promote our tourism services.
• E-mail addresses - will be used exclusively for the newsletter and the request for feedback related to the service offered.

METHODS OF TREATMENT AND STORAGE:

The data provided will be stored in paper files and / or computer only on Italian territory for a period not exceeding 10 years (as required by law). The treatment is carried out through manual, computer and telematic tools (including online profiling), with logic strictly related to the above purposes and, however, in order to ensure the security and confidentiality of data.

SENSITIVE DATA:

The processing will not concern personal data falling within the category of "sensitive" data, i.e. those data that can reveal religious, philosophical or other beliefs, as well as personal data that can reveal the state of health.

DATA CONTROLLER:

The data controller is: Crocus Società Cooperativa with headquarters in Via Carlo del Prete 133, Florence.

PERSON IN CHARGE OF THE PROCESSING:

The person in charge of the processing is Rigacci Benedetta, Legal Representative of the Company, whose contact details are as follows:

• cell.+39 3757085075
• email address: amministrazione@crocustrip.com

RIGHTS OF THE INTERESTED PARTY:

At any time, the interested party may exercise its rights towards the data controller, pursuant to Articles 15-23 Chapter III DGPR 679/2016. This is briefly reproduced below:

DGPR 679/2016

Pursuant to Article 15, the data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed and, if so, to obtain access to the personal data and the following information:

• The purposes of the processing;
• The categories of personal data in question;
• The recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients in third countries or international organizations;
• When possible, the expected period of retention of the personal data or, if this is not possible, the criteria used to determine this period;
• The existence of the data subject's right to request from the data controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning him or her or to object to their processing;
• The right to lodge a complaint with the supervisory authority;
• If the data are not collected from the data subject, all available information on their origin;
• The existence of automated decision-making, including profiling as referred to in Article 22(1) and (4), and, at least in such cases, meaningful information about the logic used, as well as the importance and expected consequences of such processing for the data subject.
• Where personal data are transferred to a third country or an international organization, the data subject shall have the right to be informed of the existence of appropriate safeguards pursuant to Article 46 relating to the transfer.
• The data controller shall provide a copy of the personal data being processed.
• In case of further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. If the data subject makes the request by electronic means, and unless otherwise specified by the data subject, the information shall be provided in a commonly used electronic format.
• The right to obtain a copy of the personal data being processed shall not infringe the rights and freedoms of others.

The interested party also has the right to obtain:

• The updating, rectification or, when interested, the integration of data; see Art. 16 Right of rectification and Art. 19 Obligation to notify in case of rectification or erasure of personal data or limitation of processing.
• The cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed; see. Article 17 Right to erasure ("right to be forgotten") in a structured, commonly used and machine-readable format personal data concerning him or her that has been provided to a data controller and has the right to transmit such data to another data controller without hindrance by the data controller to whom he or she has provided it where the processing is based on consent, or on a contract and the processing is carried out by automated means. V. Article 20 Right to data portability.
• The data subject has the right to object, in whole or in part on legitimate grounds, to the processing of personal data concerning him or her, even if pertinent to the purpose of collection; see Article 18 Right to restriction of processing and Article 21 Right to object.
• The data subject has the right to lodge a complaint with the supervisory authority if he/she considers that the processing violates the Regulation (see Article 77 Right to lodge a complaint with the supervisory authority); he/she also has the possibility of a judicial remedy following the outcome of the complaint of the supervisory authority (see Article 78 Right to an effective judicial remedy against the supervisory authority).

SOCIAL NETWORKS PLUG-INS:

Specific information on the collection and use of data by social networks, as well as the rights and methods available to protect the privacy of the person concerned, are present directly on the pages of the social networks themselves. With this information is intended to make the user aware of the presence on the site of direct links to the main social networks (Facebook, Twitter, Instagram, etc.). By clicking on the icons of these social networks from the site, if the user is connected with their account to social networks, the user may be associated with the visit to this site. If the user wants to avoid the association, he/she must log out of his/her social network account, before visiting the social by clicking on the icons on our site.

CHANGES TO THE PRIVACY POLICY:

The owner has the right to modify and / or update this policy in total discretion and at any time, provided that it respects the requirements of the law.