PRIVACY POLICY
Barziesi Tourism Enterprises SpA – "Mountain for All"
Information notice pursuant to Arts. 13 and 14 of EU Regulation no. 679/2016
INFORMATION AND ACQUISITION OF CONSENT FOR THE PROCESSING AND COMMUNICATION OF DATA, WITHIN THE SCOPE OF THE LOCAL PUBLIC TRANSPORT SERVICE CONTRACT, IN APPLICATION OF THE EUROPEAN GENERAL DATA PROTECTION REGULATION - REG. 679/2016 (GDPR)
Dear User,
Imprese Turistiche Barziesi S.p.A. ("ITB"), in its capacity as data controller ("Data Controller"), pursuant to Articles 13 and 14 of EU Regulation no. 2016/679 (hereinafter, "GDPR"), hereby informs you, in your capacity as data subject ("Data Subject"), that your personal data, both common and special categories, will be processed in the manner and for the purposes set out below.
1. Personal Data Subject to Processing
ITB, as Data Controller, will process your common personal data collected or acquired within the scope of the contract for the sale of travel tickets, rental, and/or sale of related services and equipment (hereinafter defined as the "service contract"). This includes, by way of example but not limitation, first name, last name, address, date of birth, fiscal code (tax code), photograph, email address, mobile phone number, and, in general, your contact details (the "Common Data").
ITB will limit itself to requesting exclusively the personal data strictly necessary to provide the performances and services requested by you, undertaking not to transfer or transmit them to third parties.
2. Purposes of the Processing
The personal data provided by the data subject are necessary for compliance with legal obligations and for purposes connected to the execution of the contract.
Furthermore, the data subject's consent may be required to process their personal data for specific purposes. When the data subject consents to the processing of their personal data for a specific purpose, they may withdraw their consent at any time; in such event, the company will cease to process their data for that specific purpose.
(a) Mandatory Processing: The processing of personal data of a mandatory nature, as it is necessary for the proper execution of the service, is essentially aimed at fulfilling the requirements related to the ticket sales service (skipass, round-trip tickets for cable cars and gondolas) and the subsequent loading onto media with RFID (Radio Frequency Identification) and Barcode technology, as well as requirements related to the rental and/or sale of related and akin services and/or equipment.
(b) Optional Processing: A further processing of personal data, which is optional and carried out subject to the data subject's consent, is aimed at registration in the mailing list or newsletter for sending email messages containing information, including commercial and promotional information, relating to Imprese Turistiche Barziesi S.p.A.
3. Lawfulness of Processing
The processing of personal data by the Data Controller is legitimized by the conditions set out in Article 6 of the GDPR 679/2016.
a. The processing, which is mandatory, is necessary:
For the conclusion of the contract relating to the issuance of the travel ticket, which includes the verification of the requirements provided for the application of discounted tariff conditions;
For the verification of the regular use of the travel ticket;
For any refund or issuance of a new travel ticket;
For the prevention and contrast of fraudulent behaviors;
For compliance with legal obligations;
For the conclusion of the contract for rental services and/or the sale of services and/or equipment.
Legal Basis: The legal basis for this processing is the execution of a contract to which the data subject is a party or the implementation of pre-contractual measures, pursuant to Art. 6, par. 1, lett. b) of the GDPR.
b. The processing, which is optional and carried out subject to the data subject's consent, is necessary:
For sending email messages containing information, including commercial and promotional information.
Legal Basis: The legal basis for this processing is the consent of the data subject pursuant to Art. 6, par. 1, lett. a) of the GDPR.
If the legal basis for the processing is your consent, your refusal will have no consequences on your ability to use the transport service. You are also guaranteed the right to withdraw your express consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
4. Methods of Processing and Data Retention
The processing of Personal Data will take place in accordance with the principles of correctness, lawfulness, and transparency, using electronic, manual, and/or telematic and/or automated tools, with logics strictly related to the purposes of the processing and, in any case, guaranteeing the confidentiality and security of the data themselves and compliance with the specific obligations established by law.
The processing of your personal data is carried out by means of the operations indicated in Art. 4 no. 2) GDPR for the correct management of the service contract, namely: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of data.
The availability, management, access, retention, and usability of the data are guaranteed by the adoption of technical and organizational measures to ensure appropriate levels of security pursuant to Articles 25 and 32 of the GDPR, as well as in relation to the specific processing purposes identified by the applicable legislation.
Your personal data will be kept only for the time necessary to fulfill the purposes set out in this information notice and for the proper management of the service contract, respecting the minimization principle referred to in Article 5, paragraph 1, letter c) of the GDPR, as well as in execution of the legal obligations to which the Data Controller is subject, and in any case for no longer than 10 years from the termination of the relationship for Service Purposes, subject to longer terms in compliance with legal obligations.
5. Scope of Communication and Dissemination of Personal Data
The personal data collected by the organization may be communicated and/or transferred to external parties to whom the company entrusts certain activities or with whom it collaborates for the management and provision of ticket sales services (skipass, round-trip tickets for cable cars and gondolas, ...) and rental services and/or the sale of services and/or equipment, subject to appointment as a data processor pursuant to Art. 28 GDPR.
In addition, your personal data may be processed, within the scope of the purposes of this information notice, by:
Professionals subject to professional secrecy or by employees and collaborators of ITB, in their capacity as designated and/or authorized persons and/or system administrators, duly authorized and instructed by the Data Controller and in compliance with the provisions of Art. 29 GDPR;
Third-party companies or other entities (by way of indication, consultants, insurance companies for the provision of insurance services, etc.) that perform outsourcing activities on behalf of ITB, in their capacity as data processors ex Art. 28 of the GDPR;
Third-party companies providing IT and telematic services and platforms, in their capacity as data processors ex Art. 28 GDPR, limited to the data strictly necessary for the operation of such services;
Public administration bodies, public security authorities, judicial authorities, insurance entities, and other subjects, entities, or authorities acting in their capacity as autonomous data controllers, to whom it is mandatory to communicate Personal Data by virtue of legal provisions or orders from authorities.
The complete and updated list of data recipients may be requested from the Data Controller or the DPO at the contact details indicated in this Information Notice.
Your Personal Data will not be subject to dissemination, except in the event that communication or dissemination is required, in accordance with the law, by public entities for purposes of defense or security or the prevention, investigation, or prosecution of criminal offenses.
6. Transfer of Personal Data
Personal data are stored within the European Union and will not be transferred to Third Countries outside the European Union.
Should such a transfer become necessary to pursue the purposes set out in this information notice, any transfer will take place exclusively to Countries subject to an adequacy decision by the European Commission or, in any case, according to the methods permitted by Articles 46 et seq. of the GDPR, such as the adoption of Standard Contractual Clauses ("SCC") approved by the European Commission.
The Data Controller reserves the right to use cloud services. In this case, the providers of such services will be selected from among those who provide adequate guarantees, as provided for by Article 46 of the GDPR.
7. Rights of the Data Subject
In your capacity as a data subject, you may assert the rights recognized to the data subject by Art. 7 (right to withdraw consent), and by Articles 15 to 22 of the GDPR, where applicable and within the limits established by Art. 2-undecies of the Privacy Code:
a) Right of access to personal data concerning you;
b) Right to rectification or erasure of personal data concerning you;
c) Right to restriction of processing of personal data concerning you;
d) Right to object to the processing of personal data concerning you;
e) Right to data portability;
f) Right not to be subject to an automated decision-making process.
If you believe that the processing of personal data relating to you takes place in violation of the provisions of the GDPR, you have the right to lodge a complaint, as provided for by Art. 77 GDPR, with the Italian Data Protection Authority (Garante per la protezione dei dati personali), based in Piazza Venezia 11, IT-00187, Rome (Email: protocollo@gpdp.it, PEC: protocollo@pec.gpdp.it).
8. Methods for Exercising the Data Subject's Rights
You may at any time exercise the rights referred to in the preceding paragraph by addressing the data controller through a written request sent to the following address:
Email: privacy@pianidibobbio.com
PEC: itbspa@pec.it
9. Data Controller and Data Protection Officer
Data Controller: Imprese Turistiche Barziesi S.p.A.
Registered Office: Località Ceresola n. 1 - 24010 Valtorta (BG)
Administrative Office: Località La Piazza n. 1 - 23816 Barzio (LC)
Tel: +39 0341.996101
Email: info@pianidibobbio.com
PEC: itbspa@pec.it
Data Protection O`icer (DPO): Ing. Angelo Marino – Email: angelo@ingmarino.it
10. Changes to this Privacy Policy
The Data Controller reserves the right to make changes to this privacy policy, giving adequate publicity to the data subjects. Unless otherwise specified, the previous privacy policy will continue to apply to personal data collected up to that moment.
This information notice is made available in the "Privacy" section of the organization's institutional website: https://pianidibobbio.com/it/.
PRIVACY POLICY
Barziesi Tourism Enterprises SpA – "Mountain for All"
Information notice pursuant to Arts. 13 and 14 of EU Regulation no. 679/2016
INFORMATION AND ACQUISITION OF CONSENT FOR THE PROCESSING AND COMMUNICATION OF DATA, WITHIN THE SCOPE OF THE LOCAL PUBLIC TRANSPORT SERVICE CONTRACT, IN APPLICATION OF THE EUROPEAN GENERAL DATA PROTECTION REGULATION - REG. 679/2016 (GDPR)
Dear User,
Imprese Turistiche Barziesi S.p.A. ("ITB"), in its capacity as data controller ("Data Controller"), pursuant to Articles 13 and 14 of EU Regulation no. 2016/679 (hereinafter, "GDPR"), hereby informs you, in your capacity as data subject ("Data Subject"), that your personal data, both common and special categories, will be processed in the manner and for the purposes set out below.
1. Personal Data Subject to Processing
ITB, as Data Controller, will process your common personal data collected or acquired within the scope of the contract for the sale of travel tickets, rental, and/or sale of related services and equipment (hereinafter defined as the "service contract"). This includes, by way of example but not limitation, first name, last name, address, date of birth, fiscal code (tax code), photograph, email address, mobile phone number, and, in general, your contact details (the "Common Data").
ITB will limit itself to requesting exclusively the personal data strictly necessary to provide the performances and services requested by you, undertaking not to transfer or transmit them to third parties.
2. Purposes of the Processing
The personal data provided by the data subject are necessary for compliance with legal obligations and for purposes connected to the execution of the contract.
Furthermore, the data subject's consent may be required to process their personal data for specific purposes. When the data subject consents to the processing of their personal data for a specific purpose, they may withdraw their consent at any time; in such event, the company will cease to process their data for that specific purpose.
(a) Mandatory Processing: The processing of personal data of a mandatory nature, as it is necessary for the proper execution of the service, is essentially aimed at fulfilling the requirements related to the ticket sales service (skipass, round-trip tickets for cable cars and gondolas) and the subsequent loading onto media with RFID (Radio Frequency Identification) and Barcode technology, as well as requirements related to the rental and/or sale of related and akin services and/or equipment.
(b) Optional Processing: A further processing of personal data, which is optional and carried out subject to the data subject's consent, is aimed at registration in the mailing list or newsletter for sending email messages containing information, including commercial and promotional information, relating to Imprese Turistiche Barziesi S.p.A.
3. Lawfulness of Processing
The processing of personal data by the Data Controller is legitimized by the conditions set out in Article 6 of the GDPR 679/2016.
a. The processing, which is mandatory, is necessary:
For the conclusion of the contract relating to the issuance of the travel ticket, which includes the verification of the requirements provided for the application of discounted tariff conditions;
For the verification of the regular use of the travel ticket;
For any refund or issuance of a new travel ticket;
For the prevention and contrast of fraudulent behaviors;
For compliance with legal obligations;
For the conclusion of the contract for rental services and/or the sale of services and/or equipment.
Legal Basis: The legal basis for this processing is the execution of a contract to which the data subject is a party or the implementation of pre-contractual measures, pursuant to Art. 6, par. 1, lett. b) of the GDPR.
b. The processing, which is optional and carried out subject to the data subject's consent, is necessary:
For sending email messages containing information, including commercial and promotional information.
Legal Basis: The legal basis for this processing is the consent of the data subject pursuant to Art. 6, par. 1, lett. a) of the GDPR.
If the legal basis for the processing is your consent, your refusal will have no consequences on your ability to use the transport service. You are also guaranteed the right to withdraw your express consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
4. Methods of Processing and Data Retention
The processing of Personal Data will take place in accordance with the principles of correctness, lawfulness, and transparency, using electronic, manual, and/or telematic and/or automated tools, with logics strictly related to the purposes of the processing and, in any case, guaranteeing the confidentiality and security of the data themselves and compliance with the specific obligations established by law.
The processing of your personal data is carried out by means of the operations indicated in Art. 4 no. 2) GDPR for the correct management of the service contract, namely: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of data.
The availability, management, access, retention, and usability of the data are guaranteed by the adoption of technical and organizational measures to ensure appropriate levels of security pursuant to Articles 25 and 32 of the GDPR, as well as in relation to the specific processing purposes identified by the applicable legislation.
Your personal data will be kept only for the time necessary to fulfill the purposes set out in this information notice and for the proper management of the service contract, respecting the minimization principle referred to in Article 5, paragraph 1, letter c) of the GDPR, as well as in execution of the legal obligations to which the Data Controller is subject, and in any case for no longer than 10 years from the termination of the relationship for Service Purposes, subject to longer terms in compliance with legal obligations.
5. Scope of Communication and Dissemination of Personal Data
The personal data collected by the organization may be communicated and/or transferred to external parties to whom the company entrusts certain activities or with whom it collaborates for the management and provision of ticket sales services (skipass, round-trip tickets for cable cars and gondolas, ...) and rental services and/or the sale of services and/or equipment, subject to appointment as a data processor pursuant to Art. 28 GDPR.
In addition, your personal data may be processed, within the scope of the purposes of this information notice, by:
Professionals subject to professional secrecy or by employees and collaborators of ITB, in their capacity as designated and/or authorized persons and/or system administrators, duly authorized and instructed by the Data Controller and in compliance with the provisions of Art. 29 GDPR;
Third-party companies or other entities (by way of indication, consultants, insurance companies for the provision of insurance services, etc.) that perform outsourcing activities on behalf of ITB, in their capacity as data processors ex Art. 28 of the GDPR;
Third-party companies providing IT and telematic services and platforms, in their capacity as data processors ex Art. 28 GDPR, limited to the data strictly necessary for the operation of such services;
Public administration bodies, public security authorities, judicial authorities, insurance entities, and other subjects, entities, or authorities acting in their capacity as autonomous data controllers, to whom it is mandatory to communicate Personal Data by virtue of legal provisions or orders from authorities.
The complete and updated list of data recipients may be requested from the Data Controller or the DPO at the contact details indicated in this Information Notice.
Your Personal Data will not be subject to dissemination, except in the event that communication or dissemination is required, in accordance with the law, by public entities for purposes of defense or security or the prevention, investigation, or prosecution of criminal offenses.
6. Transfer of Personal Data
Personal data are stored within the European Union and will not be transferred to Third Countries outside the European Union.
Should such a transfer become necessary to pursue the purposes set out in this information notice, any transfer will take place exclusively to Countries subject to an adequacy decision by the European Commission or, in any case, according to the methods permitted by Articles 46 et seq. of the GDPR, such as the adoption of Standard Contractual Clauses ("SCC") approved by the European Commission.
The Data Controller reserves the right to use cloud services. In this case, the providers of such services will be selected from among those who provide adequate guarantees, as provided for by Article 46 of the GDPR.
7. Rights of the Data Subject
In your capacity as a data subject, you may assert the rights recognized to the data subject by Art. 7 (right to withdraw consent), and by Articles 15 to 22 of the GDPR, where applicable and within the limits established by Art. 2-undecies of the Privacy Code:
a) Right of access to personal data concerning you;
b) Right to rectification or erasure of personal data concerning you;
c) Right to restriction of processing of personal data concerning you;
d) Right to object to the processing of personal data concerning you;
e) Right to data portability;
f) Right not to be subject to an automated decision-making process.
If you believe that the processing of personal data relating to you takes place in violation of the provisions of the GDPR, you have the right to lodge a complaint, as provided for by Art. 77 GDPR, with the Italian Data Protection Authority (Garante per la protezione dei dati personali), based in Piazza Venezia 11, IT-00187, Rome (Email: protocollo@gpdp.it, PEC: protocollo@pec.gpdp.it).
8. Methods for Exercising the Data Subject's Rights
You may at any time exercise the rights referred to in the preceding paragraph by addressing the data controller through a written request sent to the following address:
Email: privacy@pianidibobbio.com
PEC: itbspa@pec.it
9. Data Controller and Data Protection Officer
Data Controller: Imprese Turistiche Barziesi S.p.A.
Registered Office: Località Ceresola n. 1 - 24010 Valtorta (BG)
Administrative Office: Località La Piazza n. 1 - 23816 Barzio (LC)
Tel: +39 0341.996101
Email: info@pianidibobbio.com
PEC: itbspa@pec.it
Data Protection O`icer (DPO): Ing. Angelo Marino – Email: angelo@ingmarino.it
10. Changes to this Privacy Policy
The Data Controller reserves the right to make changes to this privacy policy, giving adequate publicity to the data subjects. Unless otherwise specified, the previous privacy policy will continue to apply to personal data collected up to that moment.
This information notice is made available in the "Privacy" section of the organization's institutional website: https://pianidibobbio.com/it/.