Ca’ del Bosco Hospitality S.r.l. and Ca’ del Bosco S.r.l. Società Agricola (hereinafter, respectively, “C.d.B. Hospitality”, “C.d.B. Agricola” and “Co-Controllers”), in their capacity as Joint Data Controllers of the personal data in question, issue this notification to the Interested Parties, in compliance with European and Italian regulations regarding the protection of personal data.
With regard to the treatment described in this notification, C.d.B. Hospitality and C.d.B. Agricola operate as Co-Controllers with reference to the products and services offered by them both (hereinafter, taken together, “Products and Services”).
Purposes and legal basis for the treatment
C.d.B. Hospitality and C.d.B. Agricola process personal data for several purposes:
1) To transmit commercial information, promotions, invitations to events, opinion polls, etc. concerning the Products and Services (“Marketing“), using the contact details of the Interested Party (telephone, mobile phone, e-mail): for this purpose, the user’s explicit consent is required;
2) To analyze behaviors, habits and consumption patterns of the Interested Party, in order to meet specific needs and to improve Products and Services, also by sending personalized commercial communications (“Profiling“): for this purpose, the user’s explicit consent is required, separate from that referred to in the previous point;
3) To document the consent issued for Marketing and/or Profiling communications even after the revocation of the same: for this purpose, express consent is not required, because the treatment is necessary for the pursuit of the legitimate interest of C.d.B. Hospitality and C.d.B. Agricola, so they can easily manage any requests in this area (by the Interested Party and the competent Authorities) and protect the reputation of both.
Profiling
For the purposes indicated in point 2), C.d.B. Hospitality and C.d.B. Agricola, by means of automated decision-making processes, intend to analyze the Interested Party’s interaction with the communications received for Marketing purposes (e.g. webpages opened, clicks, etc.) and his/her behaviors in relation to the experiences with the two companies (e.g. visits, purchases, etc.), in order to activate a communication process based on such analyses.
Period of data retention
The Co-Controllers intend to treat the data according to the following time frame:
– For the purposes indicated in point 1), the data will be treated for 24 months following their registration, although the Interested Party may revoke his/her consent at any time, and the revocation may also refer to a single contact modality;
– For the purposes referred to in point 2), the data will be treated for 12 months following their registration, with the understanding that the Interested Party may revoke his/her consent at any time;
– For the purposes referred to in point 3), the data will be treated for 6 months following the revocation of the last consent given.
In any case, the data may be retained for a longer period, if necessary for the settlement (however reached) of any disputes that may have arisen.
Nature of the provision of data and consequences in case of refusal
The provision of data is optional: failing this, C.d.B. Hospitality and C.d.B. Agricola will not transmit communications for Marketing purposes and/or will not carry out Profiling activities; in case of non-consent to Profiling, the Interested Party may still receive Marketing communications, which will therefore have a less personalized character: detailed information on this point is provided in the form.
Categories of recipients
The Co-Controllers will not disclose the data, but intend to communicate them to internal staff authorized to process them in accordance with their respective duties, as well as to professionals or service companies (e.g. IT providers) and to public and private authorities, in the case of inspections and audits.
These recipients, if they treat data on behalf of the Co-Controllers, will be appointed as data processors through a specific contract or other legal act.
Data transfer to a third country and/or an international organization
The Co-Controllers make use of cloud computing services that may involve the treatment of data through servers or digital equipment located outside the European Economic Area: in all these cases, the transfers will be carried out in accordance with the specific provisions contained in the applicable personal data protection regulations. In particular, transfers will take place to countries with privacy legislation that the European Commission has considered adequate, or by binding the recipients with specific contractual clauses (those of the Group, which apply to subsidiaries, and the one approved by the Commission, which applies to others): please contact the Co-Controllers more information.
Rights of the Interested Parties
The Interested Party is entitled to ask the Co-Controllers for access to his/her personal data and to correct them when inaccurate, to erase them or to limit their treatment under certain conditions, to oppose their treatment for the Co-Controllers’ legitimate interests and to obtain the portability of the personal data submitted only if they are subjected to automatic processing based on consent or contractual conditions. The Interested Party also has the right to revoke his/her consent to the treatment for the purposes that require it, regardless of the legal compliance of the treatment performed up until the time of the revocation.
The Interested Party also has the right to know the essential content of the agreement between C.d.B. Hospitality and C.d.B. Agricola stipulating their respective responsibilities.
To exercise any or all of the above rights, the Interested Party can fill out the form available at this link and send it to C.d.B. Hospitality, selected to serve as a contact point for both companies, at the following email address: [email protected]. The Interested Party also has the right to lodge claims and complaints with the competent oversight Authority for the protection of personal data, at the following link: www.garanteprivacy.it.
Instructions for use:
1) online (landing page):
– The sentence highlighted in yellow must be cut from this file and pasted at the bottom of the form, in the check boxes that are not pre-selected: the selection of the first box is a precondition to proceed, while the user must be able to refuse profiling and therefore receive generic communications for marketing purposes;
– The text of the privacy notice (the text that precedes these instructions) must be made available in connection with the form, or as a link associated with the words “information on the treatment of personal data” of the phrase highlighted in yellow.
2) offline (e.g. wineries, trade shows, events, etc.):
– The text of the information notification (the text that precedes these instructions) must be made available in hard copy, easily legible, in the location where the operator of Santa Margherita asks the customer/visitor to give his/her consent;
– Entry of data and consents shall instead be handled by the operator at his/her terminal, through the landing page (the online form on the website).
INFORMATION ON THE TREATMENT OF PERSONAL DATA.
