This privacy notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 – the General Data Protection Regulation (GDPR) – to individuals who subscribe to Turismo Torino’s newsletters (“Travel News,” “Welcome News,” “Trade News,” “Mice News,” and “Turismo News”).
Type and Source of Data
The data is provided directly by the data subject (e.g., by filling out online or paper forms made available by the Data Controller, completing surveys or questionnaires, or participating in interviews, etc.).
Purpose and Legal Basis for Processing
The data is processed for the following purposes:
- Managing newsletter subscriptions and sending periodic promotional/informative communications about events and activities promoted by the Data Controller.
- Legal basis: consent (Art. 6(1)(a) GDPR).
- Conducting analysis to send personalized promotional and/or informative content aligned with the subscriber's profile.
- Legal basis: consent (Art. 6(1)(a) GDPR).
- Performing statistical analysis to improve the newsletter service.
- Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Using contact details of subscribers to the “Trade” newsletter to propose participation in educational tours.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Nature of Data Provision
The provision of personal data marked with an asterisk (*) is required in order to subscribe and receive the newsletter. Failure to provide such data will make it impossible to send the newsletter.
Providing additional information for personalized newsletters is optional; failure to do so will result in receiving a general (non-personalized) version of the newsletter.
Withdrawal of Consent
Pursuant to Article 7 of the GDPR, consent may be withdrawn at any time. Withdrawal of consent will result in the cessation of any general and/or personalized communications.
Data Retention Period
Data will be retained until the data subject unsubscribes from the requested newsletter service.
Data Recipients
Data will not be disseminated. It may be disclosed to:
- Personnel authorized by the Data Controller (employees and collaborators);
- External parties appointed as Data Processors (e.g., mailing system and newsletter service providers, IT and telecommunications service providers);
Additionally, data may be disclosed to entities legally entitled to access it pursuant to applicable laws, regulations, or EU legislation.
The complete and updated list of Data Processors is available upon request.
Data Transfers
The Data Controller does not transfer personal data to third countries or international organizations. However, the use of cloud services is reserved. In such cases, any transfer of data will take place only to providers located in countries deemed adequate under Article 45 GDPR, or to those who adhere to the EU-U.S. Data Privacy Framework, or who have provided appropriate safeguards as outlined in Article 46 GDPR.
Further information and/or a copy of the applicable safeguards may be obtained by contacting the Data Controller.
Data Subject Rights
Data subjects may exercise the rights provided by Articles 15–22 of the GDPR, as applicable to the nature of the processing. In particular, they may request:
- Confirmation of whether their personal data is being processed and, if so, access to such data (right of access);
- Rectification of inaccurate data and completion of incomplete data (right to rectification);
- Erasure of personal data, unless retention is required by law or justified by the Data Controller’s legitimate interest (right to erasure);
- Restriction of data processing (right to restriction);
- Portability of data provided to the Data Controller to another controller (right to data portability), applicable only if the processing is based on consent or a contract;
- Objection to the processing of personal data based on reasons related to their particular situation (right to object).
To exercise any of these rights, the data subject may contact the Data Controller using the email address provided above, clearly stating the subject of the request, the right being exercised, and any information necessary to identify the requester and verify the legitimacy of the request.
Consent withdrawal regarding communications can also be exercised by clicking the unsubscribe link at the bottom of each communication.
In addition, data subjects have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).
Automated Decision-Making and Profiling
Personal data may be subject, with the explicit consent of the data subject, to profiling and analytical activities aimed at sending promotional communications aligned with the data subject’s profile, interests, and/or preferences.