Privacy policy

Dear Customer,

pursuant to current legislation on the protection of personal data (EU Regulation No. 679 of 2016), we wish to inform you that the processing of your personal data is carried out correctly and transparently, for lawful purposes and protecting your privacy and your rights .

The treatments are carried out also with the aid of computerized means for the following purposes:

1. to acquire and confirm your reservation of accommodation services and ancillary services, and to provide the services requested. Since these are treatments necessary for defining the contractual agreement and for its subsequent implementation, the provision is mandatory. In case of refusal to provide personal data, we will not be able to confirm the booking or provide the services requested. The processing will cease after your departure, but some of your personal data may or must continue to be processed for the purposes and in the manner indicated in the following points;

2. to fulfill the obligation provided by the "Consolidated Law on Public Security Laws" (article 109 of RD 18.6.1931 n. 773) which requires us to communicate to the Police Headquarters, for public security purposes, the personal details of the clients housed according to the procedures established by the Ministry of the Interior (Decree 7 January 2013). The provision of data is obligatory, and in case of refusal to supply them we will not be able to host it in our structure. The data acquired for this purpose are not stored by us;

3. to fulfill current administrative, accounting and tax obligations. For these purposes the processing is carried out without the need to acquire his consent. The data are processed by us and by our employees, and are communicated to the outside only in compliance with legal obligations. In case of refusal to provide the data necessary for the above mentioned obligations, we will not be able to provide you with the services requested. The data acquired for these purposes are stored by us for the time required by the respective regulations (10 years, and even beyond in the case of tax assessments);

4. to speed up the registration procedures in the event of your subsequent stays at our facility. For this purpose, after obtaining your consent upon arrival at the facility, which can be revoked at any time, your data will be stored and used when you are again our guest for the purposes referred to in the preceding points;

5. to send you our promotional messages and updates on rates and offers. For this purpose, after acquiring your optional consent, your data will be stored and will not be disclosed to third parties. You can withdraw your consent at any time;

We also wish to inform you that the European Regulation recognizes certain rights, including the right to access and rectify, or cancel or limit or oppose the processing, as well as the right to data portability, if and as applicable (articles from 15 to 22 of EU Regulation No. 679 of 2016). It can also lodge a complaint with the supervisory authority, according to the procedures established by current legislation.

For any further information, and to assert the rights recognized by the European Regulation, you may contact:
Data controller:
FEDAL SRL, based in via Principe Tommaso 36, 10125 Turin
Email: [email protected]

CUSTOMER/SUPPLIER POLICY


Nizza Monferrato, 25/07/2018
(Policy on the processing of personal data pursuant to Article 13 of Regulation EU 679/2016 and Article 13 of Legislative Decree 196/2003)

FEDAL srl., in its capacity of data controller (hereinafter also: “Controller” or “FEDAL ”) pursuant to Regulation EU 679/2016 (hereinafter: “GDPR”) and to Legislative Decree 196/2003 (hereinafter “Privacy Code”) – invites you, before communicating any personal data to the Controller, to carefully read this Policy since it contains important information on the protection of your personal data.

This Policy:

• is provided as a result of the contractual relationship with FEDAL
• is provided pursuant to Article 13 of the GDPR and of the Privacy Code to those who have a contractual relationship with FEDAL

•••
The processing of your personal data will be based on the principles of correctness, lawfulness, transparency, purpose limitation and retention, minimisation and accuracy, integrity and confidentiality, as well as on the principle of accountability pursuant to Article 5 of the GDPR.
Your personal data will therefore be processed in accordance with the legislative provisions of the GDPR and the confidentiality obligations set forth therein, as well as with those of the Privacy Code currently still in force

By processing of personal data we mean any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, as defined in Article 4(2) of the GDPR.

We hereby inform you that the personal data processed may consist of - also depending on your decisions on how to use the services - any information concerning your person suitable to identify you make you identifiable, including textual information, photographic or video images and of any other information provided, according to the type of services requested.

CONTENTS
Below we provide the contents of this Privacy Policy so that you can easily find the information related to the processing of your personal data of interest to you.


1. DATA CONTROLLER: WHO WE ARE AND WHAT WE DO
2. WHICH DATA WE PROCESS
a. Data provided voluntarily by you
b. Third party data provided voluntarily by you
3. FOR WHICH REASON WE PROCESS YOUR DATA - PROCESSING PURPOSE
4. LEGAL GROUNDS AND OBLIGATORY OR OPTIONAL NATURE OF PROCESSING
5. RECIPIENTS OF PERSONAL DATA
6. TRANSFER OF PERSONAL DATA
7. RETENTION OF PERSONAL DATA
8. RIGHTS OF DATA SUBJECTS
9. CHANGES
10. CONTACTS

***

1. DATA CONTROLLER: WHO WE ARE AND WHAT WE DO
The data controller is FEDAL S.p.A., with registered office in Via Principe Tommaso, 36 - 10125 Torino, VAT N. 09172920010.

2. WHICH DATA WE PROCESS
We hereby inform you that the personal data processed may consist of an identifier such as name, an identification number, location data, an online identifier or one or more characteristic elements of your physical, physiological, genetic, psychological, economic, cultural or social identity suitable to identify or make the data subject identifiable, depending on the type of services requested (hereinafter only "personal data").

The personal data processed in the Contractual Relationship is the following:

a. Data provided voluntarily by you
Without prejudice to reference to specific policies, this Policy is also provided for the processing of data voluntarily provided by you.

b. Third party data provided voluntarily by you
Within the scope of execution of the Contractual Relationship, the processing of personal data of third parties, which you have communicated to FEDAL , may occur. With respect to these cases, you are an autonomous data controller, assuming all the legal obligations and liabilities. In this sense, on this point you provide the broadest indemnity with respect to any objection, claim or request for compensation for processing damages, etc. that might be brought against the Data Controller by third parties, whose personal data has been communicated by you. In any case, if you provide or otherwise process personal data of third parties, you hereby guarantee - accepting all the related liability - that this particular case of processing is based on the prior acquisition - on your part - of the policy and of the consent of the third party to the processing of information concerning the same and to disclosure to FEDAL and that said processing will take place in compliance with the GDPR.

3. FOR WHICH REASON WE PROCESS YOUR DATA - PROCESSING PURPOSE
Your personal data will be processed, with your consent where necessary, for the following purposes, where applicable:
3.1. to allow performance and delivery of the FEDAL service;
3.2. to respond to specific requests, including telephone calls, addressed to FEDAL ;
3.3. to fulfil any obligations under applicable laws, regulations or EU legislation, or satisfy requests from the authorities;
3.4. to exercise the rights of the Controller;
3.5 to fulfil contractual and pre-contractual obligations deriving from agreements in place with you;
3.6. for statistical purposes, without it being possible to trace your identity.

Your personal data will be processed with the support of computer, paper or electronic means.
Specific security measures are observed to prevent data loss, illicit or incorrect uses and unauthorised access.

4. LEGAL GROUNDS AND OBLIGATORY OR OPTIONAL NATURE OF PROCESSING
The legal grounds for processing personal data for the purposes referred to in the sections 3.1 e 3.2 and 3.5. is Article 6(1)(b) of the GDPR ([…] processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract), since processing is necessary for provision of the services. Provision of personal data for these purposes is optional, but failure to provide it would make it impossible to activate the services requested.
The legal grounds for the purpose referred to in section 3.3 is Article 6(1)(c) of the GDPR ([…] processing is necessary for compliance with a legal obligation to which the controller is subject). In fact, once the personal data has been provided, processing is indeed necessary to comply with the legal obligations to which FEDAL is subject.
The legal grounds for the purpose referred to in section 3.4 is Article 6(1)(f) of the GDPR (…. Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject…) in order to ascertain, exercise or defend a right in court. Also this processing is necessary in the presence of the aforementioned requirements.
It should also be noted that the processing referred to in section 3.5 is not performed on personal data and therefore can be freely performed by FEDAL .

5. RECIPIENTS OF PERSONAL DATA
Your personal data may be shared, for the purposes set out in section 3 of this Privacy Policy, with:
5.1. those that typically act as data processors, i.e.: i) people, companies or professional firms that provide FEDAL with support and advice on accounting, administrative, legal, tax and financial matters or other business consultancy and ; ii) those delegated to carry out technical maintenance activities; iii) FEDAL distributors and agents; iv) Carriers, Hauliers, Forwarders, Couriers, Postal Forwarders, for possible delivery of the goods; v) paid service providers; vi) order fulfillment centers; (collectively "Recipients").
5.2. parties, bodies or authorities to whom it is mandatory to communicate your personal data in accordance with the provisions of the law or orders of the authorities;
5.3. persons authorised by FEDAL for the processing of personal data necessary to perform activities strictly related to the provision of services, whether they are committed to confidentiality or have an appropriate legal obligation of confidentiality and who guarantee Data Processing in accordance with the GDPR.
The complete and updated list of the Data Processors is kept at the registered office of the Data Controller, situated in Nizza Monferrato, and may be sent by sending a written request to the Data Controller at the addresses indicated in the "Contacts" section of this policy.

6. TRANSFER OF PERSONAL DATA
Personal data is stored on servers located in the European Union. It is nevertheless understood that the Data Controller, if necessary, will have the right to move the servers also outside the European Economic Area. In this case, the Data Controller hereby ensures that said transfer will take place in compliance with applicable legislation based on a decision of adequacy or on the Standard Contractual Clauses approved by the European Commission. Further information is available by sending a written request to the Data Controller at the addresses indicated in the "Contacts" section of this policy.

7. RETENTION OF PERSONAL DATA
Personal data processed for the purposes set out in Section 3 will be retained for10 years since the last processing. Further information regarding the data retention period and the criteria used to determine this period may be requested by sending a written request to the Data Controller at the addresses indicated in the "Contacts" section of this policy. This, in any case, without prejudice to the right of FEDAL to retain your personal data for the period of time foreseen and allowed by Italian law to protect its interests and right of defense, having regard to the limitation period prescribed by applicable legislation.

8. RIGHTS OF THE DATA SUBJECT
In your capacity as a Data Subject, pursuant to Articles 15 et seq of the GDPR and of Article 7 of the Privacy Code, you have the right to:
i. obtain confirmation of the existence of personal data concerning you, even if not yet recorded, and communication of the same in an intelligible form;
ii. obtain indication: a) of the origin of the personal data; b) of the processing purposes and methods; c) of the logic applied in case of processing carried out with the aid of electronic instruments; d) of the identification details of the controller, the processors and of the designated representative pursuant to Article 5, paragraph 2 of the Privacy Code and Article 3, paragraph 1, of the GDPR; e) the parties or categories of parties to which the personal data may be communicated or which may become aware of it in their capacity as designated representative in the territory of the State, processors or persons in charge of processing;
iii. obtain (a) updating, rectification or, where interested, integration of data; (b) cancellation, anonymisation or blocking of data processed unlawfully, including data that is not required to be kept for the purposes for which the data was collected or processed; (c) certification that the operations referred to in points (a) and (b) have been notified, also as regards their content, to those to whom the data has been disclosed or disseminated, unless this requirement proves impossible or involves the use of means clearly disproportionate to the right protected;
iv. object, in whole or in part: a) to the processing of personal data regarding you, even if pertinent to the collection purposes; (b) to the processing of personal data regarding you for the purposes of sending advertising or direct sales materials or for carrying out market research or commercial communications, through the use of automated call systems without the intervention of an operator, by e-mail and/or through traditional marketing methods by telephone and/or normal post. Please note that the data subject's right to object, as set out in point b) above, for direct marketing purposes through automated methods extends to traditional methods and that in any case this is without prejudice to the possibility of the data subject to exercise the right of objection even in part. Therefore, the disclosure may decide to receive only communications using traditional methods or only automated communications or neither of the two types of communication.

Where applicable, the data subject also has the rights referred to in Articles 16-22 of the GDPR (Right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object, right to object to automated processing, including profiling).
Requests should be addressed to the Data Controller at the addresses indicated in the "Contacts" section of this policy.

You in any case have the right to file a complaint with the competent supervisory authority (Authority for the protection of personal data) pursuant to Article 77 of the GDPR, if you believe that the processing of your data is contrary to current legislation.

9. CHANGES
FEDAL reserves the right to change or simply update the content of this Policy, in whole or in part, also due to changes in applicable legislation. FEDAL will inform you of these changes as soon as they are introduced and they will be binding as soon as they are published on the Website. FEDAL therefore invites you to periodically visit this section to be informed of the most recent and updated version of the Policy in order to be always updated on the data collected and its use by the Controller.

10. CONTACTS
To exercise the above rights or for any other request, please write to the Data Controller: FEDAL, with registered office in Via Principe Tommaso, 36 - 10125 Torino mail: [email protected]

The Controller

FEDAL Srl