Privacy policy
PRIVACY POLICY
The company Travel Open Day S.R.L., (Italian Fiscal Code no: 13119651001) whose registered head office is located in Via Aosta, 30 – 00182 Rome (RM), Italy, and on whose behalf its pro tempore legal representative (hereinafter referred as “Data Controller”), acting as Data Controller for the processing of personal data pursuant to the Articles no. 1 of the Italian Legislative Decree of the 30th of June 2003, no. 196 – Privacy Code (hereinafter referred as “The Code”) and pursuant to the articles no. 4. no. 7) and no. 24 of the REGULATION (EU) 2016/679 of the 27th of April 2016 related to the privacy of the natural persons with regard to the processing of personal data (hereinafter referred as “the Regulation”) informs that, in pursuance of the Article no. 13 of the Regulation, it shall manage the processing of personal data related to the users of its website.
1. Subject of the service
Although the GDPR is not applied to the users other than the natural persons and, therefore, do not fall within the definition of “interested party” it is possible however that during the filling of one or more fields, the persons shall insert their own personal data. In this case, all the protections provided by the GDPR and by the Italian legislative Decree no. 196/03 shall be applied.
The processed data are: personal data, billing data included VAT number, head office and address and contact information (e-mail and telephone number).
2. Purposes of processing and legal basis
The data shall be lawfully and correctly processed and with the utmost confidentiality, in compliance with the appropriate security measures as set out in the Code and the Regulation.
NEWSLETTER AND COMMERCIAL INFORMATION: the legal basis is normally detected in the consent of the interested party. Only in the case of purchase, pursuant to the Article no. 130 paragraph no. 4 of the Italian Legislative Decree no. 196/03, the e-mail address shall be inserted in a CRM for the sending of commercial information on similar products/services and/or newsletter without the previous consent of the interested party, provided that he/she has not initially refused such registration and such sending. The opt-out option shall be exercised at any time.
INDIRECT MARKETING: By Your explicit consent, we shall send You newsletters where we propose the offers of our commercial partners.
REGISTRATION- RESERVED AREA (for buyers and sellers): The purpose of the registration to the website is the execution of the pre-contractual measures carried out upon request of the interested party and subsequently for the execution of the contract. In fact, the access to the website is the condition for the management of orders and pages.
PURCHASE: The purchasing of the provided products shall never be referred or offered to the end consumer. The purchase of products shall only be made by the workers in the industry.
1. METHODS (direct purchase by the offeror): at the time of the purchase, you will be re- directed on the seller’s page that shall autonomously acquire the data and invoicing the amount. In this case, there is a transfer of personal data pursuant to the GDPR; the Data Controllers shall inform the buyer pursuant to the Article no. 14 of the GDPR.
2. METHODS (purchase through the website – only where it’s possibile): the purchase shall be totally managed by this company that shall fulfill any obligation related to payments and invoicing. After the payment is made, there is a transfer of data pursuant to the GDPR; the Data Controllers shall inform the buyer pursuant to the Article no. 14 of the GDPR.
The supply of the requested data is voluntary but, in the event of failure to supply such data, the services requested to the Data Controller shall not be provided. The consent for direct or indirect marketing purposes is optional and the only consequence is the impossibility to send newsletter or DEM.
The processing of data shall be made by digital and analogical means. The data shall not be subject to public disclosure.
3. Processing methods
The Data Controller shall process the personal data for the time which is necessary and in order to fulfil the purposes mentioned above and in any case for the duration of:
For the selling of commercial information (direct or indirect marketing), the Data Controller shall process the data for 5 years from the last communication sent. It shall be always possible to exercise the opt-out option. In case the email shall not be opened, the Data Controller shall ask to the interested party if he/she intends to go on receiving commercial information or shall proceed to a cancellation.
For the registration to the website, till the request of cancellation by the interested party.
For the purchase, till the achievement of the legal deadline.
In any case, to be accessed singularly and depending on the level of critical issues, the Data Controller has no prejudice to process the data for a longer period of time when he has justified reason to retain possible that a legal dispute may ensue and based on the Data Controller’ legitimate interest to be defended in a legal proceeding.
4. Data communication
The buyers’ data shall be communicated to third party companies (after the purchase of the products) that shall process them as independent Data Controllers for the execution of the contract.
The data shall be communicated to the payment gateways, which shall process them as independent data controllers.
The data shall be communicated to all those persons to whom the communication is imposed by law for the fulfilment of the purposes provided by law.
For the management of its activities, the company uses partners and tools provided by third party companies, all duly appointed as Data Supervisors. The list shall be reachable in the head office.
Pursuant to the recital Article no.48, the Data Controller shall also communicate the data to other companies which are connected to the same Data Controller and, in particular, to the publishing licensee Network & Comunication Srl (owner of the Italian magazine TravelQuotidiano) for internal administrative purposes.
5. Storage and Data Transfer
The management and storage of personal data shall be performed on the Data Controller’s servers located within the European Union and/or third party companies’, entitled and duly appointed as Data Supervisors. Currently, the servers are located in Europe. For the sending of newsletters, the Data Controller informs he has decided to use a company which transfers the data to non-EU countries; the data are in USA and the standard contract clauses have been stipulated.
6. Rights of the interested party
In his/her capacity as an interested party, the User has the rights pursuant to the article no 15 of the Regulation and precisely:
1. the interested party has the right to obtain the confirmation of the existence or not of personal data related to him/her, even if they are not yet registered and their communication shall be made in a human readable form.
2. the interested party has the right to obtain the indication of:
a) the origin of the personal data;
b) the purposes and the methods of processing;
c) the logic applied in case a processing is carried out by electronic instruments;
d) the specification related to the Data Controller’s, the Data supplier and the person in charge of the processing
e) the persons or the categories of persons to whom the personal data shall be communicated or who may become aware of it as Authorised Representative in the territory of the State, as responsible person or person in charge.
3. The interested party has the right to obtain:
a) the updating, the rectification, or, where interested, the data integration;
b) the cancellation, the transformation into anonymous form or the blocking of data in breach of law, as well as those data whose retention is unnecessary, in relation with the purposes for which the data was collected or subsequently processed;
c) the attestation that the operations set out in the letters a) and b) have been informed, even as regards to their contents, to those whom the data have been communicated or disclosed, unless the case where such fulfilment shall be impossible or may result in a clearly disproportionate use of means towards the protected right.
4. The interested party shall have the right to oppose, in whole or in part:
a) for legimate reasons to the processing of personal data related to him, even if pertinent to the scope of the collection;
b) to the processing of personal data related to him for the fulfillment of the purposes that are not provided by the Article no. 2
Even pursuant to the articles no. 15 et seq. of the GDPR, the user shall have the right to ask at any time, the access to his personal data, the rectifications or the cancellation of the same, the limitation of the processing in the cases provided by the article no. 18 of the GDPR, obtain the data related to him in a structured format that is commonly used and readable by an automatic device, as set in the cases provided by the article no. 20 of the GDPR. The user shall withdraw at any time his consent, pursuant to the former article no.7 of the GDPR, lodge a complaint to the competent Supervisory Authority as set in the former article no. 77 of the GDPR, in case he retains the processing of his data shall be in contrast to the relative laws and regulations in force.
The user shall send a request for opposition to the proceeding of his/her personal data, as set in the former article no. 21 of the GDPR where he puts in evidence the reasons that justify such opposition. The Data Controller reserves the right to evaluate the request that shall not be accepted in the event of legimate binding reasons in order to proceed with the processing that prevails over the interests, rights and freedoms of the user. The interested party shall exercise at any time the rights set out in the previous article by sending:
- a registered letter with return receipt to: TRAVEL OPEN DAY S.R.L., Via Aosta 30 – 00182 Rome (RM), Italy;
- an e-mail to: This email address is being protected from spambots. You need JavaScript enabled to view it..
