This notice is provided pursuant to Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679, the “General Data Protection Regulation”) to those who purchase products or book services/activities offered by Turismo Torino, acting as independent Data Controller, through the Controller’s website or at its information points.
Source and Type of Data
The data processed are those requested in the purchase/booking forms.
Where consent has been given to receive promotional communications, information collected through tracking pixels is also processed, such as the date and time an email is opened, the number of times it is opened and, in some cases, the IP address and information about the device used.
Purposes and legal basis of processing
Personal data are processed for the following purposes:
1. to follow up on the request to purchase/book the product or service/activity (including the issue of the Card/pass for access to them) and to manage the subsequent stages of assistance and communication with the user;
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)
2. in the case of online purchases, to record and allow the display of bookings and purchases in the dedicated section of the user’s personal account;
Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
3. to handle the accounting and tax obligations connected with the purchase of products or services;
Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR)
4. to manage possible disputes, both judicial and out of court;
Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR); establishment, exercise or defence of legal claims, both in and out of court
5. to send, by email, information, promotional communications and informational and commercial material concerning activities and initiatives promoted by Turismo Torino e Provincia s.c.r.l., and to analyse, by means of tracking pixels, the opening of such communications, including at the level of the individual recipient, in order to assess the effectiveness of the communication campaigns;
Legal basis: Consent (Article 6(1)(a) GDPR) and Article 122 of Legislative Decree No. 196/2003 (Italian Data Protection Code).
6. to carry out analyses in order to send personalised promotional and/or informational communications in line with the data subject’s profile;
Legal basis: specific consent (Art. 6(1)(a) GDPR).
7. to conduct statistical surveys and analyses – including by sending survey questionnaires/polls – aimed at assessing the impact of initiatives and/or defining strategies for developing and improving the local tourism offer.
Legal basis: performance of a task carried out in the public interest (Art. 6(1)(e) GDPR)
Use of tracking pixels and procedures for withdrawing consent (Art. 7 GDPR)
The newsletters and promotional communications sent by Turismo Torino e Provincia may contain tracking pixels: small, invisible elements embedded in emails that make it possible to collect information about how they are opened, such as the date and time, the number of times they are opened and, in some cases, the IP address and information about the device used.
These data may be analysed at the level of the individual recipient in order to assess the effectiveness of the communications and improve their quality. Consent to receive promotional communications is single and also covers the use of tracking pixels. It is optional and may be withdrawn at any time, including in part, using the dedicated link in the emails. The data subject may choose either to stop receiving the communications or to deactivate only the tracking, while continuing to receive them.
Emails containing survey questionnaires and polls, sent for the purposes indicated in point 7, may also contain tracking pixels to detect when they are opened. This processing is carried out in the context of activities performed in the public interest and is not based on the data subject’s consent. Accordingly, withdrawal of consent to promotional communications and the related tracking does not extend to these communications, without prejudice to the data subject’s right to exercise the rights provided for by the GDPR, including the right to object under Art. 21.
Nature of Data Provision
The provision of data is indispensable for the purchase/booking of the product or service. Refusal to provide the data will therefore prevent the request from being processed. The provision of data is mandatory for compliance with the legal obligations connected with the purchase. Failure to provide data for the purposes indicated in points 5 and 6 will not affect the purchase or booking and will have the sole consequence that the Controller will be unable to send promotional communications.
Data Retention
The data collected will be retained for the fulfilment of tax and accounting obligations until the administrative limitation period expires. For the purpose of sending promotional/informational communications, the data will be retained until consent is withdrawn.
Recipients of Data
The data collected may be disclosed to, and processed by:
- authorised personnel (employees and collaborators);
- any external parties appointed as Data Processors (e.g. companies specialising in digital services, possibly entrusted with managing the website, running information or promotional campaigns, or administering online questionnaires);
- public bodies (e.g. the Italian Revenue Agency).
Finally, they may be disclosed to parties entitled to access them by virtue of legal provisions, regulations or European legislation.
Transfer of data
The Data Controller does not transfer personal data to third countries or international organisations. However, it reserves the right to use cloud services. In that case, data will be transferred exclusively to providers that operate in countries deemed adequate under Art. 45 GDPR, that have joined the EU–US Data Privacy Framework, or that have provided the safeguards required by Art. 46 GDPR.
Further information on the transfer and/or a copy of the safeguards applied may be obtained by contacting the Controller.
Rights of the data subject
The data subject may exercise the rights provided for by Articles 15–22 of the GDPR (Regulation (EU) 2016/679). In particular, the data subject may request:
- confirmation as to whether personal data concerning them are being processed and, if so, a copy of those data (“right of access”);
- rectification of inaccurate data and completion of incomplete data (“right to rectification”);
- erasure of the data or the “right to be forgotten”, unless there are retention obligations or legitimate interests of the Controller (“right to erasure”);
- restriction of the processing of their data (“right to restriction”);
- transmission of the data provided to the Controller to another controller (“right to data portability”), only for processing based on consent or on a contract.
The Controller reminds data subjects that they may exercise the right to object in the forms and manner provided for by Art. 21 GDPR, with particular reference to the purpose indicated in point 7. However, the Controller may reject the request where there are compelling legitimate grounds for proceeding with the processing.
The data subject may exercise the above rights by informing the Data Controller of the subject of the request, the right they wish to exercise and any information suitable for identification that attests to the legitimacy of the request.
In addition, the data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).