Information pursuant to Articles 13 and 14 of EU Regulation 679/2016

This page describes the "Privacy Policy" of this website and is intended to provide information on how the personal data of users who interact with this website, who use the services rendered by the same to users, are processed, as well as to provide the information imposed by art. 13 and 14 of EU Regulation 2016/679..
This information is provided only for this website and not for other websites that may be visited by the user through links on the web pages of this site.

Regulation (EU) 2016/679 on the protection of personal data (hereinafter, the "Regulation") lays down rules related to the protection of natural persons with regard to the processing of personal data, as well as rules on the free movement of such data and protects the fundamental rights and freedoms of natural persons, with particular reference to the right to protection of personal data. 

Article 4 (1) of the Regulation provides that "Personal Data" shall mean any information relating to an identified or identifiable natural person (hereinafter, "Data Subject").

By "Processing", on the other hand, is to be understood as any operation or set of operations, carried out with or without the help of automated processes and applied to Personal Data or sets of Personal Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Art. 4(2) of the Regulation). 

Pursuant to Articles 12 et seq. of the Regulation, it is also provided that the Data Subject must be made aware of the necessary information related to the Processing activities that are carried out by the Data Controller and the rights of the Data Subject. 

Data Controller

Ente Turismo Langhe Monferrato Roero Scarl, with registered office located at nr 2, Piazza Risorgimento – 12051 Alba – CN - Tel.+39 0173 35833, info@visitlmr.it - enteturismo@confcommercio.legalmail.it

Data Protection Officer

The Data Protection Officer appointed by the Data Controller can be contacted by e-mail at the following address: dpo@visitlmr.it

Purposes and legal basis of processing

The user's personal data will be processed for the following purposes and on the following legal grounds:

  1. for the conclusion and proper performance of the contract to which the data subject is a party or for the performance of pre-contractual measures taken at the data subject's request, for the information and/or services/products requested, including the subscription to informative newsletters; the legal basis for the processing is art. 6 par. 1 b) of the EU Regulation 2016/679; 

  2. to respond to requests sent by the user via e-mail and/or forms on the site; the legal basis for the above processing is art. 6 par. 1 b) of the EU Regulation 2016/679; 

  3. to periodically send commercial communications on services, products and activities offered by the owner, using remote communication technologies (mail, telephone, sms, whatsapp); the legal basis is the consent provided by art. 6 par. 1 a) of the European Regulation 2016/679; 

  4. to make the navigation of the Site possible and functional, as well as to guarantee an adequate level of security, integrity and availability; the legal basis for this type of processing is the legitimate interest of the data controller, as provided for by Article 6, paragraph 1, letter f;

  5. analysis of statistical data on aggregate or anonymous data for the purpose of monitoring the proper functioning of the site, traffic usability and interest; the legal basis for this type of processing is the legitimate interest of the controller as provided by Art. 6 par. 1, letter f);

  6. to establish, exercise or defend a right before a court; the legal basis for this type of processing is the legitimate interest of the Data Controller, as provided for by Art. 6, par. 1, letter f);

  7. to comply with obligations provided for by law, by a regulation, by Community legislation or by an order of the Authority; the legal basis for this type of processing is provided by art. 6, paragraph 1, letter c);

Type of data

The data collected and processed are those necessary for the purposes described above: :

  • identification data

  • contact data

  • data related to the contractual relationship

  • data related to the preferences and interests of the data subject 

Navigation data

The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected in order to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computer environment. 

This data is used solely to obtain anonymous statistical information on the use of the site and to check that it is operating correctly and is deleted immediately after processing.

The data could be used to establish responsibility in the event of hypothetical computer crimes against the site.

Refusal to provide data 

With the exception of what is specified for navigation data, users/visitors are free to provide their personal data. In some cases, it is necessary to provide the data, since refusal to provide the data could lead to the failure or improper performance of the contract to which the Data Subject is a party and/or the failure to comply with the legal obligations to which the Data Controller is subject.

The provision of data for processing requiring consent is optional; failure to provide such data will not make it impossible to use the products/services offered by the Data Controller. Even in the event of consent, the data subject shall have the right to subsequently object, in whole or in part, to the processing of his/her personal data for the purposes indicated above, by sending a simple request to the Data Controller at the addresses indicated above.

Data source

Data will be provided by the data subject or collected from third parties.

Processing modalities  

In accordance with Article 5 of the Regulation, the Personal Data subject to Processing will be:

  1. processed lawfully, fairly and transparently with respect to the Data Subject ;

  2. collected and recorded for specified, explicit and legitimate purposes and subsequently processed in a manner compatible with those purposes;

  3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

  4. accurate and, where necessary, kept up to date; 

  5. processed in such a way as to ensure an adequate level of security;

  6. kept in a form that permits identification of the Data Subject for a period not exceeding the time necessary to achieve the purposes for which they are processed. 

Processing will be carried out using manual and/or computer and telematic tools, with organisational and processing logics strictly related to the purposes for which they are processed, and in any case in such a way as to guarantee the security, integrity and confidentiality of the data themselves, in compliance with the organisational, physical and logical measures provided for by the provisions in force.

Disclosure of data

The personal data may be disclosed to the subjects authorised to process them, as well as to the external data processors appointed by the Data Controller (the full list of external data processors is available from the Data Controller), who are in charge of managing the purposes described above. Subject to your consent, the data may also be disclosed to third party sponsors and/or business partners of the Data Controller, who may use it for the purposes set out in point 3) of the "Purposes of processing" article above. In the context of the pursuit of the aforementioned purposes, the data may be disclosed to other subjects acting as autonomous data controllers.

Data dissemination

Personal data will not be disseminated. 

Transfer of data abroad 

For the purposes set out above, personal data will be processed within the European Economic Area (EEA). In case of transfer to third countries, in the absence of an adequacy decision by the European Commission, the requirements of the applicable legislation on the transfer of personal data to third countries, such as the standard contractual clauses provided by the European Commission, will be complied with.

Data Retention 

In general, personal data will be kept for the time strictly necessary to pursue the purposes for which it was collected and processed, including the retention period required by applicable legislation, and in any case for a maximum of 10 years after the termination of the relationship with the Controller and for a maximum of 2 years for the purposes for which your consent is required, except where the Controller needs to defend its own rights in court.

Rights of the Data subject

In accordance with EU Regulation 2016/679, article 15 et seq. and the applicable national legislation, the Data Subject may, under the procedures and within the limits specified by the applicable legislation, exercise the following rights:

  • Description

    The data subject has the right to obtain from the controller confirmation as to whether or not personal data related to him/her are being processed and, if so, access to such data and the following information :

    1. the purposes of the processing;

    2. the categories of personal data concerned;

    3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; 

    4. where possible, the period for which the personal data are to be stored or, where this is not possible, the criteria used to determine that period;

    5. the existence of the right of the data subject to request from the data controller the  rectification or erasure of personal data or the restriction of the processing of personal data concerning him/her or to object to their processing

    6. The right to file a complaint with a supervisory authority;

    7. all available information on the origin of the data, where the data are not obtained from the data subject;

    8. the existence of any automated decision making process, including profiling as referred to in Article 22(1) and (4), and, at least in such cases, meaningful information about the logic applied, as well as the significance of such processing for the data subject and the envisaged consequences. 

    Where personal data are transferred to a third country or an international organisation, the data subject shall have the right to be informed of the existence of adequate safeguards, as referred to in Article 46, in relation to the transfer. 

    The controller shall provide a copy of the personal data being processed. If the data subject requests further copies, the controller may charge a reasonable fee based on administrative costs. If the data subject makes the request by electronic means, and unless otherwise specified by the data subject, the information shall be provided in a commonly used electronic format.

    Assumptions
    The right to obtain a copy of one's personal data must not infringe the rights and freedoms of others. 

    How to exercise it

    The data subject may exercise the right by sending a request to the following e-mail address: dpo@visitlmr.it

    In order to be able to give a positive response to the request, it is necessary to provide the information necessary to identify the data subject. 

    Before giving a reply, the data controller may need to identify the data subject, as the right can only be exercised by the data subject or his/her representative.

  • Description
    The data subject has the right to obtain from the data controller the rectification of inaccurate personal data concerning him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration.

    Assumptions
    Processing inaccurate and/or incomplete data 

    How to exercise it

    The data subject may exercise the right by sending a request to the following e-mail address: dpo@visitlmr.it

    In order to be able to give a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

    Before giving a reply, the data controller may need to identify the data subject, as the right can only be exercised by the data subject or his/her representative.

  • Description

    The data subject has the right to obtain from the data controller the erasure of personal data concerning him/her without undue delay, and the data controller has the obligation to erase the personal data without undue delay.

    Where the controller has made personal data public and is obliged to erase them pursuant to the preceding paragraph, the controller shall take reasonable measures, including technical measures, taking into account available technology and the cost of implementation, to inform the controllers who process the personal data of the data subject's request to erase any link, copy or reproduction of his or her personal data.

    Assumptions

    The right may be exercised if one of the following conditions is met:

    1. personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

    2. the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) and if there is no other legal basis for the processing;

    3. the data subject objects to processing under Article 21(1) and there is no overriding legitimate reason for processing, or objects to processing under Article 21(2);

    4. personal data have been unlawfully processed;

    5. personal data must be deleted in order to comply with a legal obligation under Union or Member State law to which the data controller is subject;

    6. personal data have been collected in connection with the provision of information society services as referred to in Article 8(1) (Where Article 6(1)(a) applies with respect to the direct provision of information society services to minors, the processing of personal data of the child is lawful where the child is at least 16 years old. Where the child is under 16 years of age, such processing is lawful only if and to the extent that such consent is given or authorized by the holder of parental responsibility. Member States may establish by law a lower age for these purposes provided that it is not less than 13 years of age).

    The right to erasure shall not apply to the extent that processing is necessary for

    1. for the exercise of the right to freedom of expression and information; 

    2. for the performance of a legal obligation requiring processing provided for by Union or Member State law to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;

    3. for reasons of public interest in the field of public health in accordance with Article 9 (2) (h) and (i) and Article 9 (3);

    4. for purposes of archiving in the public interest, scientific or historical research, or statistical purposes in accordance with Article 89(1), insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of such processing; or 

    5. for the establishment, exercise or defense of a right in court.

    How to exercise it

    The data subject may exercise the right by sending a request to the following e-mail address: dpo@visitlmr.it

    In order to be able to give a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

    Before giving a reply, the data controller may need to identify the data subject, as the right can only be exercised by the data subject or his/her representative.

  • Description

    The data subject has the right to obtain from the data controller the restriction of processing

    Where processing is restricted pursuant to the preceding paragraph, such personal data shall be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defense of a legal claim or to protect the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State.

    A data subject who has obtained the restriction of processing under the initial paragraph shall be informed by the data controller before such restriction is lifted.

    Assumptions

    The right may be exercised if one of the following conditions is met:

    1. the data subject disputes the accuracy of personal data for the period necessary for the data controller to verify the accuracy of such personal data; 

    2. processing is unlawful and the data subject objects to the deletion of personal data and instead requests that their use be restricted;

    3. although the data controller no longer needs it for the purposes of processing, the personal data is necessary for the data subject to establish, exercise or defend a right in court;

    4.  the data subject has objected to the processing under Article 21(1), pending verification as to whether the data controller's legitimate grounds prevail over those of the data subject.

    How to exercise it

    The data subject may exercise the right by sending a request to the following e-mail address: dpo@visitlmr.it

    In order to be able to give a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

    Before giving a reply, the data controller may need to identify the data subject, as the right can only be exercised by the data subject or his/her representative.

  • Description
    The controller shall notify any recipient to whom the personal data have been disclosed of any rectification, erasure or restriction carried out pursuant to Articles 16, 17(1) and 18, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject of those recipients if the data subject so requests.

    How to exercise it

    The data subject may exercise the right by sending a request to the following e-mail address: dpo@visitlmr.it

    In order to be able to give a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

    Before giving a reply, the data controller may need to identify the data subject, as the right can only be exercised by the data subject or his/her representative.

  • Description

    The data subject has the right to receive in a structured, commonly used and machine-readable format the personal data concerning him/her that he/she has given to a data controller and has the right to transmit those data to another data controller without hindrance from the data controller to whom he/she has given them.

    When exercising his/her rights with regard to data portability under the preceding paragraph, the data subject has the right to obtain direct transmission of personal data from one data controller to another, if technically feasible.

    The exercise of the right referred to in the opening paragraph is without prejudice to Article 17 - Right to erasure ("right to be forgotten").

    Assumptions

    The right may be exercised if one of the following conditions is met:

    1. the processing is based on consent under Article 6(1)(a) or Article 9(2)(a) or a contract under Article 6(1)(b); and 

    2. data processing is carried out by automated means

    This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

    The exercise of the right must not infringe on the rights and freedoms of others.

    How to exercise it

    The data subject may exercise the right by sending a request to the following e-mail address: dpo@visitlmr.it

    In order to be able to give a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

    Before giving a reply, the data controller may need to identify the data subject, as the right can only be exercised by the data subject or his/her representative.

  • Description

    The data subject has the right to object at any time. 

    The data controller shall refrain from further processing personal data unless the data controller demonstrates the existence of compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of a legal claim.

    Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes, including profiling insofar as it is related to such direct marketing.

    If the data subject objects to processing for direct marketing purposes, personal data are no longer processed for such purposes.

    Where personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1), the data subject shall have the right, on grounds relating to his/her particular situation, to object to the processing of personal data concerning him/her, except where the processing is necessary for the performance of a task carried out in the public interest..

    Assumptions

    The right may be exercised if one of the following conditions is met:

    • reasons related to his/her particular situation,

    • to the processing of personal data concerning him/her pursuant to Article 6(1)(e) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller) or (f): (processing is necessary for the purposes of the legitimate interests of the controller or a third party, provided that the interests or the fundamental rights and freedoms of the data subject which require the protection of personal data do not override, in particular where the data subject is a child.), including profiling on the basis of these provisions,

    How to exercise it

    The data subject may exercise the right by sending a request to the following e-mail address: dpo@visitlmr.it

    In order to be able to give a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

    In the context of the use of information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise his/her right to object by automated means using specific techniques. 

    Before giving a reply, the data controller may need to identify the data subject, as the right can only be exercised by the data subject or his/her representative.

In general, in order to exercise his/her rights, the data subject may contact the data controller by writing to the contact details indicated above.

Before providing a response, the Data Controller may need to identify the data subject by requesting a copy of his/her identity document.

A written response will be provided without undue delay and in any event no later than one month from the date of receipt of the request.

Template version: 4.1

Last update: October 10, 2023

Thank you

We’ve sent you an email. To activate the newsletter, click on the link you will find in the message. Thank you!

Something went wrong

Try again

Close

Thank you

Your request has been sent successfully and we will reply as soon as possible. A copy of the data you have provided us with has been sent to your email address.

Close

Request information

You are sending the request to: visitlmr.it


Close

Request information

You are sending the request to: visitlmr.it


Close

Subscribe to the newsletter


Cancel