This notice is provided pursuant to Article 13 of the GDPR (Regulation (EU) 2016/679, the “General Data Protection Regulation”) to those who subscribe to the Turismo Torino newsletters (“Travel News”, “Welcome News”, “Trade News”, “Mice News”, “Turismo News”).
Type and Source of Data
The data are provided by the data subject (e.g. by completing the online or paper forms provided by the Controller, completing other forms, taking part in surveys and interviews, etc.). In addition to the data necessary for sending the newsletter and carrying out statistical surveys, information collected through tracking pixels may also be processed, such as the date and time an email is opened, the number of times it is opened and, in some cases, the IP address and information about the device used.
Purpose and Legal Basis for Processing
The data are processed in order to:
1) manage subscription to the mailing list and send periodic promotional/informational communications about events and activities promoted by the Controller, and to analyse, by means of tracking pixels, the opening of such communications, including at the level of the individual recipient, in order to assess the effectiveness of the communication campaigns and improve the quality and relevance of the content sent; legal basis: consent (Art. 6(1)(a) GDPR) and Article 122 of Legislative Decree 196/2003 (Privacy Code).
2) carry out analyses in order to send personalised promotional and/or informational communications in line with the data subject’s profile; legal basis: consent (Art. 6(1)(a) GDPR 2016/679).
3) carry out statistical analyses aimed at improving the newsletter service; legal basis: legitimate interest (Art. 6(1)(f) GDPR 2016/679).
4) The contact details of data subjects subscribed to the “Trade” newsletter may be used to propose educational tours; legal basis: contract (Art. 6(1)(b) GDPR).
Nature of Data Provision
The provision of the data marked with (*) is indispensable in order to proceed with the subscription and to send the newsletter to the data subject, and any refusal to provide them makes it impossible to receive the communications. The provision of further data for sending the personalised newsletter is optional, and failure to provide them will in any case still allow the data subject to receive a generic newsletter. Any withdrawal of consent limited to tracking by means of tracking pixels does not prevent the data subject from continuing to receive promotional communications.
Procedures for giving and withdrawing consent (Art. 7 GDPR)
Communications sent via newsletter may contain tracking pixels: small, invisible elements embedded in emails that make it possible to collect information about how they are opened, such as the date and time, the number of times they are opened and, in some cases, the IP address and information about the device used.
These data are also analysed at the level of the individual recipient, in order to assess the effectiveness and improve the quality of the information campaigns.
Consent to receive promotional communications is single and also covers the use of tracking pixels. It is optional and may be given at the time of subscribing to the newsletter.
The data subject may withdraw consent at any time, including in part, using the dedicated link in every email. In particular, the data subject may choose to:
• stop receiving the communications, withdrawing consent both to the sending of newsletters and to the related tracking;
• deactivate only the tracking by means of tracking pixels, while continuing to receive the communications.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Data Retention Period
The data are retained until the data subject unsubscribes from the requested newsletter service.
Recipients of the data
The data will not be disseminated. They may be disclosed to:
• personnel authorised by the Controller (employees and collaborators);
• external parties appointed as Data Processors (e.g. the manager of the mailing and newsletter-sending system, providers of information and telecommunications systems);
Finally, they may be disclosed to parties entitled to access them by virtue of legal provisions, regulations or European legislation.
The complete and up-to-date list of Data Processors is available on request.
Transfer of data
The Data Controller does not transfer personal data to third countries or international organisations. However, it reserves the right to use cloud services. In that case, data will be transferred exclusively to providers that operate in countries deemed adequate under Art. 45 GDPR, that have joined the EU–US Data Privacy Framework, or that have provided the safeguards required by Art. 46 GDPR.
Further information on the transfer and/or a copy of the safeguards applied may be obtained by contacting the Controller.
Rights of the data subject
The data subject may exercise the rights provided for by the GDPR (Arts. 15–22), where compatible with the nature of the processing activity.
In particular, the data subject may request:
• confirmation as to whether personal data concerning them are being processed and, if so, a copy of those data (“right of access”);
• rectification of inaccurate data and completion of incomplete data (“right to rectification”);
• erasure of the data or the “right to be forgotten”, unless there are retention obligations or legitimate interests of the Controller (“right to erasure”);
• restriction of the processing of their data (“right to restriction”);
• transmission of the data provided to the Controller to another controller (“right to data portability”), only where the processing is based on consent or on a contract;
• objection to the processing of personal data on grounds relating to their particular situation, to be specified in the request.
The data subject may exercise these rights by writing to the Data Controller at the email address indicated above, specifying the subject of the request, the right they wish to exercise and any information suitable for identification that attests to the legitimacy of the request.
In addition, the data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).
Automated decision-making
Data relating to the opening of newsletters are analysed, including at the individual level, in order to assess the effectiveness of the communication campaigns and improve the content of the communications sent.
These activities do not involve decisions based solely on automated processing that produce legal effects or similarly significantly affect data subjects.