This notice is provided pursuant to Article 13 of the GDPR (Regulation (EU) 2016/679, the “General Data Protection Regulation”) to those who register in the reserved area of the website turismotorino.org.
Types of data processed
The data processed are:
- first name and surname;
- date of birth;
- email address and mobile phone number;
- city and country;
- authentication credentials;
- email-opening data: information collected through tracking pixels, such as the date and time an email is opened, the number of times it is opened and, in some cases, the IP address and information about the device used.
Purpose and legal basis for processing
The data are processed for the following purposes:
- to enable the creation and management of a personal account, through which the user can view the status of the purchases and bookings made; legal basis: performance of a contract (Art. 6(1)(b) GDPR 2016/679).
- to send periodic commercial and/or promotional communications about events and activities promoted by the Controller (newsletter), and to analyse, by means of tracking pixels, the opening of such communications, including at the level of the individual recipient, in order to assess the effectiveness of the communication campaigns and improve the quality and relevance of the content sent; legal basis: consent (Art. 6(1)(a) GDPR 2016/679) and Article 122 of Legislative Decree 196/2003 (Privacy Code), expressed by ticking the relevant box at the bottom of the registration form.
- to carry out statistical analyses (e.g. on the origin of website users); legal basis: legitimate interest (Art. 6(1)(f) GDPR 2016/679).
Procedures for giving and withdrawing consent (Art. 7 GDPR)
Communications sent via newsletter may contain tracking pixels: small, invisible elements embedded in emails that make it possible to collect information about how they are opened, such as the date and time, the number of times they are opened and, in some cases, the IP address and information about the device used.
These data are also analysed at the level of the individual recipient, in order to assess the effectiveness and improve the quality of the information campaigns.
Consent to receive promotional communications is single and also covers the use of tracking pixels. It is optional and may be given at the time of subscribing to the newsletter.
The data subject may withdraw consent at any time, including in part, using the dedicated link in every email. In particular, the data subject may choose to:
- stop receiving the communications, withdrawing consent both to the sending of newsletters and to the related tracking;
- deactivate only the tracking by means of tracking pixels, while continuing to receive the communications.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Nature of the provision odf data
The provision of the personal data marked with * is indispensable for the creation of the personal account. Failure to provide them will therefore make it impossible to create the account. The provision of any further data requested is optional, and failure to provide them will not prevent the creation of the account.
The provision of data for newsletter subscription is optional, and failure to provide them will in any case still allow registration on the website. Any withdrawal of consent limited to tracking by means of tracking pixels does not prevent the data subject from continuing to receive promotional communications.
Recipients of the data
The data collected may be disclosed to:
- personnel authorised by the Controller (employees and collaborators);
- external parties appointed as Data Processors (e.g. the website manager, the mailing and newsletter-sending system provider, etc.).
Finally, they may be disclosed to parties entitled to access them by virtue of legal provisions, regulations or European legislation.
The data will not be disseminated. The complete and up-to-date list of Data Processors is available on request.
Transfer of data
The Data Controller does not transfer personal data to third countries or international organisations. However, it reserves the right to use cloud services. In that case, data will be transferred exclusively to providers that operate in countries deemed adequate under Art. 45 GDPR, that have joined the EU–US Data Privacy Framework, or that have provided the safeguards required by Art. 46 GDPR.
Further information on the transfer and/or a copy of the safeguards applied may be obtained by contacting the Controller.
Rights of the data subject
The data subject may exercise the rights provided for by the GDPR (Arts. 15–22), where compatible with the nature of the processing activity.
In particular, the data subject may request:
- confirmation as to whether personal data concerning them are being processed and, if so, a copy of those data (“right of access”);
- rectification of inaccurate data and completion of incomplete data (“right to rectification”);
- erasure of the data or the “right to be forgotten”, unless there are retention obligations or legitimate interests of the Controller (“right to erasure”);
- restriction of the processing of their data (“right to restriction”);
- transmission of the data provided to the Controller to another controller (“right to data portability”), only where the processing is based on consent or on a contract;
- objection to the processing of personal data on grounds relating to their particular situation, to be specified in the request.
The Controller reminds data subjects in particular that every data subject may exercise the right to object provided for by Art. 21 GDPR.
The data subject may exercise these rights by writing to the Data Controller at the email address indicated above, specifying the subject of the request, the right they wish to exercise and any information suitable for identification that attests to the legitimacy of the request.
In addition, the data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).
Automated decision-making
Data relating to the opening of newsletters are analysed, including at the individual level, in order to assess the effectiveness of the communication campaigns and improve the content of the communications sent.
These activities do not involve decisions based solely on automated processing that produce legal effects or similarly significantly affect data subjects.