This information is provided as the data controller by Turismo Torino e Provincia s.c.r.l., headquartered at Via Maria Vittoria 19, Torino (TO), contactable at the email address: privacy@turismotorino.org, to data subjects (individual companies and contacts) who fill out the application form to participate in a familiarization trip “fam trip” (hereinafter “initiative”) in Turin and its province.
Turismo Torino has appointed a Data Protection Officer, contactable at dpo@turismotorino.org.
Purposes of Processing and Legal Basis
The personal data provided will be processed for the following purposes:
1. Managing tour operator applications and evaluating profiles for the selection of participants in the initiative. In case of selection, the data may be processed for:
- the organization and operational management of the initiative;
- conducting satisfaction surveys – including via questionnaires – regarding the initiative.
Legal basis: performance of pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR). Any sensitive data under Art. 9 are processed based on the consent of the data subject.
2. Carrying out aggregated statistical analyses to understand national and international tourism market interest in the territory and to plan future initiatives.
Legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR).
3. Sending informational communications regarding future editions of similar initiatives.
Legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR).
4. Sending informational and promotional communications, including newsletters, regarding activities and initiatives promoted by Turismo Torino e Provincia.
Legal basis: specific consent (Art. 6(1)(a) GDPR).
Withdrawal of Consent
Pursuant to Art. 7 GDPR, the data subject may withdraw consent at any time for the purpose indicated in point 4. The lawfulness of processing carried out prior to the withdrawal remains unaffected.
Nature of Data
Provision Providing data is optional; failure to provide mandatory data makes it impossible to evaluate the application and provide feedback on the selection. Providing data for the purpose in point 4 is optional; refusal of consent does not affect the selection for participation in the initiative.
Data Retention
Personal data will be retained for the time strictly necessary for the purposes indicated, and in particular:
• non-selected candidates: for a maximum period of 12 months from the end of the selection process, to allow evaluation for possible future similar initiatives;
• selected candidates: for a maximum period of 24 months from the end of the Fam Trip, for organizational, administrative, and reporting purposes.
For the purpose indicated in point 4, data will be retained until consent is withdrawn.
Data Recipients
The data collected may be communicated and processed by:
• authorized personnel (employees and collaborators) of the data controller;
• any external entities designated as data processors (e.g., companies specialized in digital services, conducting informational or promotional campaigns, or administering online questionnaires).
Finally, data may be disclosed to parties legally entitled to access them under laws, regulations, or European norms.
Data Transfers
The Data Controller does not transfer personal data to third countries or international organizations. However, it reserves the right to use cloud services. In such cases, data will only be transferred to providers operating in countries deemed adequate under Art. 45, who have adhered to the EU–US Privacy Shield Framework, or who have provided guarantees pursuant to Art. 46 GDPR.
More information on the transfer and/or a copy of the guarantees applied can be obtained by contacting the Data Controller.
Rights of the Data Subject
The data subject may exercise the rights provided under Articles 15–22 GDPR 2016/679, in particular:
• to know whether personal data concerning them is being processed and, if confirmed, to obtain a copy of such data (“right of access”);
• to request correction of inaccurate data and completion of incomplete data (“right to rectification”);
• to request deletion of data or “right to be forgotten,” unless retention obligations or legitimate interests of the controller exist (“right to erasure”);
• to request restriction of processing of their data (“right to restriction”);
• to request that the data provided to the controller be transferred to another controller (“right to data portability”), only for processing based on consent or contract.
The Controller reminds that any data subject may exercise the right to object under the conditions of Art. 21 GDPR, particularly for the purposes indicated in points 1 and 2. However, the Controller may reject the request if there are overriding legitimate grounds for processing. The data subject may exercise these rights by contacting the Data Controller with the subject of the request, the right they wish to exercise, and any information necessary to verify the legitimacy of the request.
Furthermore, the data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).