This privacy notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of personal data (GDPR) to individuals acting on behalf of private economic operators who request registration in official registers managed by Turismo Torino (e.g., Incoming Operators Register, Congress Operators Register, etc.).
Type and Source of Data
The data processed includes personal identification details and, where applicable, copies of identity documents of the legal representatives of private operators.
Purpose and Legal Basis of Processing
The data is processed for the purpose of evaluating private operators requesting registration in the relevant registers/lists.
In the event of a successful registration, any contact details provided by the operator may be published in the relevant registers available on the Data Controller’s website and at its information points.
- Legal basis: performance of pre-contractual and contractual measures (Art. 6(1)(b) GDPR).
Nature of Data Provision
Providing the personal data of legal representatives is mandatory for the assessment of the registration request.
Failure to provide such data will result in the inability to evaluate the request.
Providing contact details for publication in the registers is optional.
Data Retention
Data is retained for the time necessary to verify registration requirements.
In the case of a positive evaluation, data will be retained until one of the conditions for exclusion from the registers occurs or upon request for removal.
Data Recipients
Collected data may be communicated to and processed by:
- Authorized personnel (employees and collaborators);
- External parties appointed as Data Processors.
Data may also be disclosed to entities legally entitled to access it by virtue of applicable laws, regulations, or EU legislation.
Any contact details provided by the operator may be publicly disclosed through the aforementioned channels.
Data Transfers
The Data Controller does not transfer personal data to third countries or international organizations. However, the use of cloud services is reserved.
In such cases, data may be transferred only to providers located in countries deemed adequate under Article 45 GDPR, or that have adhered to the EU–U.S. Data Privacy Framework, or that provide appropriate safeguards pursuant to Article 46 GDPR.
Further information and/or a copy of the applicable safeguards can be obtained by contacting the Data Controller.
Data Subject Rights
Data subjects may exercise the rights provided under Articles 15–22 of the GDPR. Specifically, they may request:
- Confirmation of whether their personal data is being processed and, if so, access to such data (right of access);
- Rectification of inaccurate data and completion of incomplete data (right to rectification);
- Erasure of personal data (right to erasure), unless subject to legal obligations or legitimate interests requiring its retention;
- Restriction of processing (right to restriction);
- Portability of the data to another controller (right to data portability), only when processing is based on consent or contract.
The Data Controller reminds data subjects of their right to object to processing, as provided under Article 21 GDPR. However, the Data Controller may deny such a request where compelling legitimate grounds to continue processing exist.
Data subjects may exercise these rights by contacting the Data Controller at the email address provided above, clearly stating the subject of the request, the right being exercised, and any information necessary to verify their identity and the legitimacy of the request.
In addition, data subjects have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).