GENERAL REGULATIONS - CHAPTER 7
Protection of personal data
INFORMATION ON THE PROCESSING OF PERSONAL DATA.
REGULATION (EU) n. 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF 27 APRIL 2016
Pursuant to and for the purposes of article 13 and article 14 of Regulation (EU) no. 2016/679 of the European Parliament and of the Council of 27 April 2016 relating to the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data (General Data Protection Regulation, hereinafter also, Regulation” or “GDPR”) and which repeals Directive 95/46/EC, we inform you that the personal data you voluntarily make available to Millepini Immobiliare s.r.l. and Y-40® SSD to r.l. (hereinafter also Y-40®) will be processed in compliance with current legislation on the protection of personal data and, in any case, with the principles of confidentiality which inspire the Company’s activity.
7.1. PERSONAL DATA AND SPECIAL CATEGORIES OF PERSONAL DATA
According to the provisions of art. 4 of EU Regulation no. 2016/679, “personal data” is defined as any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more elements characteristic of his physical identity, physiological, genetic, psychological, economic, cultural or social; In order to allow you to participate in sporting/recreational activities you may be asked to provide some medical data or data relating to your personal habits or lifestyle. In this regard, we inform you that pursuant to article 9 of EU Regulation no. 2016/679, you will be asked to provide Y-40® with data that can be classified as “particular categories of personal data” and that is, data that reveals “racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data relating to the person’s health or sexual life or sexual orientation”. These categories of data may be processed only with your free and explicit consent, expressed in written form at the bottom of this information.
7.2. PURPOSE OF THE TREATMENT.
The personal data you make available to Y-40® may be used for the following purposes:
- allow and manage your membership/registration/booking for our services;
- allow you to use the products and/or services, as well as carry out the activities reserved for you by virtue of accepting the offers;
- for administrative and accounting purposes and for the fulfillment of obligations established by current legislation;
- following your possible and specific consent, for the sending of informative and commercial communications, including of a promotional nature (including our newsletter), advertising material and/or offers of goods and services, by any means, including, by way of example and not limited to, post, Internet, telephone, e-mail, MMS, SMS from Italy or from abroad (even from countries not belonging to the European Community) by Y-40®, companies /Partner companies of Y-40®, controlled and/or participated by it, as well as by physical or legal entities contractually linked to Y-40®;
- following your possible and specific consent, for profiling activities, or to allow the processing and carrying out of statistical and market studies and research, as well as for the analysis of tastes, preferences, habits, needs and of consumption choices and to receive personalized offers based on purchasing preferences, from Y-40®, from companies controlling, controlled and/or participated by it, as well as, on behalf of Y-40®, from part of physical or legal entities contractually linked to Y-40® and/or which, in any case, collaborate in Y-40®’s commercial activities;
- following your possible and specific consent, for the transfer of data to Y-40® commercial partners for the purpose of receiving their communications.
We remind you that, with reference to the purposes highlighted in points a), b) and c), the provision of your personal data is mandatory. Your possible refusal and/or the provision of inaccurate and/or incomplete information would prevent:
- in reference to the purpose referred to in point a): your membership/registration/booking of our services;
- in reference to the purpose referred to in point b): to take advantage of the products and/or services booked as well as to carry out the activities reserved for you by virtue of adhering to the offers;
- in reference to the purpose referred to in point c): for Y-40®, the execution of administrative-accounting activities and the correct fulfillment of regulatory obligations.
With reference to the additional purposes highlighted in points d), e) and f), the provision of your personal data, and consent to the processing of the same for the aforementioned purposes, is optional. However, your refusal to provide your data and/or consent for processing relating to the aforementioned purposes and/or the provision of inaccurate and/or incomplete information could prevent the Company from:
- in reference to the purpose referred to in point d): the sending of promotional communications by Y-40®;
- in reference to the purpose referred to in point e): the carrying out of profiling activities and the sending of personalized offers based on your purchasing preferences by Y-40®;
- in reference to the purpose referred to in point f): the transfer of your data to Y-40® commercial partners for the purpose of receiving their communications.
7.3. PROCESSING METHODS
The processing of your personal data will be carried out using suitable paper, electronic and/or telematic tools, with logic strictly related to the above purposes and, in any case, in such a way as to guarantee the security and confidentiality of the data themselves. In the event that the user (i) logs in or registers for the Y-40® services using the login credentials of a social network (for example Facebook or Twitter hereinafter “Social Network”) or (ii) associate your account with an account of the same user on a Social Network, Y-40® may receive data relating to the user from that Social Network, in accordance with the conditions of use and the provisions of the privacy policy of the Social Network itself. Y-40® may add this information to the User Data already collected through its services. If the user opts to share information with these Social Networks, Y-40® receives data from the latter in accordance with the consent options provided by the user. Any Data communicated to the Social Network will be subject to the terms and conditions of use of the Social Network.
7.4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA
The members, the Data Protection Officer, the members of the board of directors or other administrative body and, in any case, the managers designated by Y-40® and the persons in charge of processing personal data appointed may become aware of your personal data. by the Company in the exercise of their functions. Your personal data may be communicated to any qualified subjects who provide Y-40® with services or services instrumental to the purposes indicated in the previous paragraph. 1 such as, by way of example but not limited to, parent, subsidiary, investee and/or associated companies; suppliers, contractors, subcontractors, banking and/or insurance institutions or other subjects and/or bodies that provide (on behalf of Y-40):
- the management and/or maintenance of the websites and electronic and/or telematic tools used by Y-40®;
- to the management of membership/registration/booking of Y-40® services;
to send informative and promotional communications, including commercial ones, advertising material and/or offers of goods and services; - to carry out profiling activities, including the detection of habits, tastes, preferences and consumer choices, as well as the development and completion of market studies and research.
Your personal data may possibly be transferred abroad, in accordance with the provisions of current legislation, even to countries not belonging to the European Union where the Company may pursue its own interests. The transfer to non-EU countries, in addition to the cases in which this is guaranteed by adequacy decisions of the European Commission, is carried out in such a way as to provide appropriate and appropriate guarantees pursuant to articles. 46 or 47 or 49 of the Regulation.
7.5. CRITERIA USED FOR DATA STORAGE
The data concerning you will be stored according to the following criteria:
- for one year the data collected for membership/registration/booking (purpose “a)” -“b)”) to the services.
- for ten years as required by tax legislation for the data indicated in the purposes of use in letter “c)”;
- for one year for all other purposes, with particular reference to data collected for marketing and profiling purposes.
7.6. RIGHTS OF THE INTERESTED PARTY
We inform you that at any time in relation to your data, you may exercise the rights provided within the limits and under the conditions set out in articles 7 and 15-22 of the Regulation. To exercise these rights, described below, please contact the Data Controller via the management at the email address amministrazione@Y-40.com; this request will be provided with appropriate feedback according to the deadlines set by the GDPR.
In detail, the interested party has the right to:
- ask for confirmation of the existence or otherwise of your personal data;
- obtain information regarding the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated and, when possible, the retention period;
- obtain the rectification and deletion of data;
- obtain the limitation of processing;
- obtain data portability, i.e. receive them from a data controller, in a structured format, commonly used and readable by an automatic device, and transmit them to another data controller without impediments;
- object to processing at any time and also in the case of processing for direct marketing purposes;
- oppose an automated decision-making process relating to natural persons, including profiling.
- ask the data controller to access personal data and to rectify or delete them or limit the processing that concerns them or to oppose their processing, in addition to the right to data portability;
- revoke consent at any time without prejudice to the lawfulness of the processing based on the consent given before the revocation;
- lodge a complaint with a supervisory authority.
You can exercise your rights with a written request sent to amministrazione@y-40.com, at the postal address of the registered office.
7.7. DATA CONTROLLER AND RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA
The Data Controller of your data is Millepini Immobiliare s.r.l. and Y-40 SSD a r.l., both with registered office in Montegrotto (PD), Via Catajo n. 42, in the person of their respective Legal Representatives pro tempore Emanuele Boaretto and Giancarlo Boaretto. Any request relating to personal data processed by Y-40 SSD a r.l. it may be sent to the registered office of the Companies, or by writing to the email address amministrazione@Y-40.com. The updated list of Managers is available at the Company and can be obtained through a specific request formulated in the manner indicated above. The contact details of the Data Protection Officer are direc- tion@Y-40.com. This information will be subject to updates. Y-40 therefore invites Users who wish to know how the personal data collected by Y-40 is processed to periodically visit this page. Data controllers are: Millepini Immobiliare s.r.l. and Y-40 SSD a.r.l.
7.8 HOW ARE PERSONAL DATA COLLECTED?
A. Upon first contact with our website. When you visit our website for the first time, a “cookie” is set and your computer is assigned an identification number. A cookie is a tool commonly used to keep track of a user’s preferences, with the aim of improving their visit to the site. Cookies allow us to provide you with a personalized experience without having to remind us of your preferences each time you visit our site. Our cookies do not contain personally identifiable information. Furthermore, we also use cookies to collect and store aggregate data relating to the website, for example, the number of visitors to the site, which helps us understand which pages are visited more or less frequently by users. If you do not wish to accept cookies, you can block them by changing your Internet browser settings. However, please note that this decision will prevent you from enjoying the benefits of using cookies and you will not be able to take advantage of certain personalized features associated with creating a user profile. After visiting our website and accepting cookies, your computer will automatically be linked with your identification number each time you visit our website. Although you remain anonymous until you enter your Personal Data on the website, the identification number allows us to record your session so that we can better serve you if you require assistance or personalized service. After you enter your Personal Data on the website, we will associate your identification number with your contact information so that we can recognize you when you return to our site. We also use it to remember what information may interest you.
B. While browsing our website. While browsing our website, you also provide us with data that does not reveal your personal identity, such as the type of destination you are interested in. We use this anonymous data in aggregate form primarily for editorial purposes, without linking it to any Personal Data.
If you wish, you can also send your e-mail address to be included in our mailing list or to receive further information. You will only be included in these lists if you have expressly indicated your intention to join them. When making this decision, please remember that these lists are used for internal purposes only and are not sold or rented to third parties. If you decide to join one of our lists, you can request at any time that your address be deleted from them. You have the opportunity to accept or decline any form of communication from us at any time.
C. When you purchase from our website. When you make a purchase, for example a pool ticket or a stay, you are asked to complete a form with your contact information and payment information. The form is protected. Upon completion of the form, your credit card number is verified through a checkout sequence and, once confirmed, payment of the amount appearing on the order form will be authorized. Also in this case, considering the personal nature of the data provided for the purchase on our website, the form is protected. As a result, your credit card number is protected. We keep a log file about transactions made on our website linked to your identification number, which does not include your credit card information. We will use this information to answer any questions you may have regarding your transactions.
7.9. WHEN YOU BOOK
A. On our website. When you decide to make a reservation at the Hotel Terme Millepini and the Y-40® swimming pool, you will be transferred to our reservation site, you will be asked to fill out a booking profile, upon your first reservation. When creating your booking profile, you will be asked to provide specific Personal Data, including your name, address and contact information, as well as certain guarantee and deposit information necessary to secure your booking, such as your credit card number . By submitting your Personal Data to us, you acknowledge and agree to the terms and conditions contained in this Privacy Policy. Given the personal nature of the data provided for purchasing on our website, the booking system is protected. As a result, your credit card number is protected. We will use this information to create a record in our website and management database.
B. Telephone reservation. You can also book by calling one of our receptions by contacting the Hotel Terme Millepini or Y-40® directly. When you make a reservation, we may ask you for Personal Data such as your name, address, telephone number and payment method.
