This privacy notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR) – to individuals participating in surveys, interviews and/or completing questionnaires.
Source and Type of Data
The personal data processed may include:
- Identifying data;
- Additional personal information collected during participation (e.g. gender, age, interests, places of interest, habits, etc.);
- Contact information (e.g. email address, if provided).
The data is provided directly by the data subject at the time of participation in the survey or interview.
Purpose and Legal Basis of Processing
The data collected during the survey/interview is processed for the following purposes:
- To conduct statistical analyses on tourist and visitor needs, with the aim of improving services and initiatives, promotional strategies, and the management of tourism flows.
- Legal basis: Consent, expressed by participation in the survey/interview (Art. 6(1)(a) GDPR).
- To send periodic commercial and/or promotional communications regarding events and activities promoted by the Controller (newsletter).
- Legal basis: Specific consent (Art. 6(1)(a) GDPR).
- To carry out analysis activities for the purpose of sending personalized promotional and/or informational communications in line with the participant’s profile.
- Legal basis: Specific consent (Art. 6(1)(a) GDPR).
Withdrawal of Consent
Pursuant to Article 7 GDPR, the data subject may withdraw consent at any time for each of the purposes listed above. Withdrawal of consent will result in the cessation of any generic and/or personalized promotional communications.
Nature of Data Provision
Providing personal data is voluntary. However:
- Refusal to provide data for the purpose outlined in point 1 may prevent participation in the survey/interview.
- Failure to provide data for the purposes under points 2 and 3 will not affect participation, but will prevent the Controller from sending generic and/or personalized promotional communications.
Data Retention
Data collected will be retained only for as long as necessary to achieve the purposes indicated above. Thereafter, the data will be deleted or anonymized and aggregated for statistical purposes.
Contact data provided for the purposes under points 2 and 3 will be processed until consent is withdrawn.
Data Recipients
Data collected during surveys and interviews is processed in anonymized form and will not be disclosed or made available to unspecified third parties.
However, the data may be processed by:
- Authorized personnel (employees and collaborators) under the authority of the Controller and in accordance with their roles and responsibilities;
- External parties appointed as Data Processors (e.g. companies managing surveys and interviews, newsletter and mailing service providers).
Data may also be disclosed to entities legally entitled to access it under applicable law, regulations, or EU legislation.
A complete and updated list of Data Processors is available upon request.
Data Transfers
The Controller does not transfer personal data to third countries or international organizations. However, cloud-based services may be used. In such cases, data will only be transferred to providers located in countries deemed adequate under Article 45 GDPR, or that have adhered to the EU–U.S. Data Privacy Framework, or provided appropriate safeguards pursuant to Article 46 GDPR.
More information regarding data transfers and applicable safeguards may be requested from the Controller.
Data Subject Rights
The data subject may exercise the rights provided under Articles 15–22 of the GDPR. Specifically, they may request:
- Confirmation whether their personal data is being processed and, if so, obtain a copy (right of access);
- Correction of inaccurate data and completion of incomplete data (right to rectification);
- Erasure of personal data, unless retention is required by law or justified by legitimate interests (right to erasure);
- Restriction of data processing (right to restriction);
- Data portability to another controller, where applicable (right to data portability) — only for processing based on consent or contract.
The Controller also reminds data subjects of their right to object to processing, particularly regarding promotional communications, pursuant to Article 21 GDPR. However, the Controller may deny the request if there are compelling legitimate grounds for continuing the processing.
To exercise these rights, data subjects may contact the Controller, specifying the subject of the request, the right they wish to exercise, and providing any necessary identifying information (e.g. copy of a valid ID).
Additionally, the data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).
Automated Decision-Making and Profiling
The data provided may, subject to the participant’s consent, be used for profiling and analysis purposes in order to send promotional communications aligned with the participant's profile, interests and/or preferences.