pursuant to current legislation on the protection of personal data (Legislative Decree 196/2003, as amended and supplemented by EU Reg. 2016/679 and Legislative Decree 101/2018), we wish to inform you that the processing of your personal data are carried out with correctness and transparency, for legitimate purposes and protecting your privacy and your rights.
Therefore, in compliance with the aforementioned legislation, and in particular in compliance with art. 13 Reg. EU 2016/679, we provide the following information:
1. Data controller and data processor
Data controller: Tuscany & Italy Holidays s.r.l., Via Manganaro 88 57037 Portoferraio (LI); Tel.: 0565 963006
Data Processor: Graziano Rinaldi
2. Processing methods
The treatments are carried out both by electronic means (also through our website: www.goelba.eu) and with the aid of paper means for the performance of the services offered.
3. Nature of the processed data
If you register among our contacts or if you request news or request our services, we will treat your personal and fiscal data, as well as the economic data that are necessary for the development of the relationship between you and our Company. Generally, we do not treat any sensitive or judicial data, but if this becomes necessary we will do so only by first asking for his consent.
4. Purposes and methods of carrying out the main service
The company Tuscany & Italy Holidays s.r.l. treats the aforementioned data to manage apartment and villa bookings and has the following services available:
A) receive bookings or requests for information and quotes through newsletters, social media (Facebook), telephone, booking on the website, forms on the company website, airbmb, which are managed by the staff. Since this is spontaneous communication, your consent is not required (art. 6, par. 1, lett. B) EU Reg. 2016/679).
B) collection and processing of apartment bookings received from the various channels (telephone, email, company and private whastapp), drafting of estimates, contracts, customer cards, supplier cards, release of information on facilities, booking activities for managing empty apartments. Since these are treatments necessary for defining the contractual agreement and for its subsequent implementation, its consent is not required (art. 6, par. 1, lett. B) EU Reg. 2016/679), except in the case where data belonging to particular categories are given, as per art. 9 EU Reg. 2016/679. In case of refusal to provide personal data we will not be able to confirm the reservation or provide the services requested.
C) customer stay management: the client is welcomed and accompanied directly by our staff to the apartments booked, or his data can be communicated to cleaning companies that also work as carers; in some cases it is the owners themselves who work to accommodate the customer. Accessory services to the stay: the maintenance or resolution of any failures or malfunctions is managed by external collaborators. Since these are treatments necessary for the implementation of the contract, your consent is not required (art. 6, par. 1, lett. B) EU Reg. 2016/679).
D) payment management, also through banking / financial third parties (credit cards are managed by telephone - PAN management). The data are processed by us and by our employees and are communicated to the outside only in compliance with legal obligations. In case of refusal to provide the data necessary for the above-mentioned fulfilments we will not be able to provide you with the services requested (art. 6, par. 1, lett. B) EU Reg. 2016/679).
E) billing; compliance with legal obligations consisting in the obligation to keep the accounting records of the company (invoices) for ten years, as provided for by the Italian law in force. For these purposes the treatment is carried out without the need to acquire his consent (art. 6, par. 1, lett. C) EU Reg. 2016/679). The data are processed by us and by our employees and are communicated to the outside only in compliance with legal obligations. In the event of refusal to provide the data necessary for the aforementioned obligations, we will not be able to provide the services requested. The data acquired for these purposes are stored by us for the time required by current legislation (10 years and even beyond in the case of tax assessments).
F) management of any complaints and/or disputes. For these purposes the treatment is carried out without the need to acquire his consent (art. 6, par. 1, lett. F) Reg. UE 2016/679).
G) prevention/repression of fraud and any illegal activity, compliance with legal obligations. For these purposes the treatment is carried out without the need to acquire his consent (art. 6, par. 1, lett. E), EU Reg. 2016/679).
H) Subject to your express consent and until revoked, your personal data may be processed directly or through third parties - also through one or more remote communication techniques (e-mail, telephone, fax) - for sending advertising material, promotional offers and newsletters. The provision of data aimed at the realization of this service is optional and requires the express consent of the appropriately informed party (Article 7 of EU Regulation 2016/679).
5. Duration of treatment
The data is processed up to the complete execution of the service and also afterwards, in compliance with legal obligations and for administrative and commercial purposes.
6. Data voluntarily provided by the interested party
The express and voluntary sending of data by filling in the forms specifically prepared on our website implies our subsequent acquisition of the same data. All the data requested are necessary for us to respond to your requests and / or fulfill the service that you request. Specific summary information is prepared and / or displayed on the individual pages of the site used for performing particular services on request.
7. Obligation or right to provide data and consequences of any refusal
The data listed above (name, surname, telephone number, e-mail) are necessary for us to be able to reach the performance required: failure to provide them in whole or in part therefore results in the impossibility of giving rise to performance of the service itself.
During the navigation on our site or during your telephone or direct contacts in the agency, you may be asked to inform us also of other data that are not strictly necessary for the fulfillment of the main service (offer of rentals of apartments and villas for tourist use ), but they do so for the execution of any accessory services (for example offers of tourist packages, booking tickets for ferries, etc.) which will be represented from time to time. Their absence is assessed on a case by case basis, and determines the consequent decisions according to the importance we give to the data requested but not supplied by you.
Whenever we intend to offer you an accessory service, the specifically pursued objectives will be described to you in detail and you will be asked to give your express consent.
Failure to provide the data requested for a specific service or the failure to provide the relative and consequent consent to their use does not affect the possibility of requesting and consenting to the provision of other various ancillary services (nor does it prevent or exclude the main service) .
8. Communication and dissemination of collected data
The data collected is not "disseminated" by us, it is not, in other words, given to undetermined subjects in any way, even through their provision or consultation; however, they can be "communicated" by us, ie they are given knowledge to one or more specific subjects, in particular to:
- third parties, to which Tuscany & Italy Holidays s.r.l. entrusts certain activities (or part of them) functional to the provision of the aforementioned services. In this case the same subjects will operate as independent Data Controllers or will be designated as Data Processors or Trustees. The designated Managers or Appointees will receive adequate operating instructions, with particular reference to the adoption of the minimum security measures, in order to guarantee the confidentiality and security of the data.
- to subjects who can access the data in compliance with a legal obligation, within the limits established by the law itself;
- the credit and / or financial institution, if payment by electronic money is required;
- the partner companies, if they have consented to the sending of advertising and direct marketing by the same
9. The rights of the interested party (articles 13/22 and 77/79 of the EU Regulation 2016/679)
The Data Controller and / or the Data Processor declare that they are willing to satisfy the requests of the data subject, but it should be noted that it is not always possible to physically delete information relating to interactions and any past transactions and / or reservations.
Interested parties may exercise certain rights with reference to the data processed by the Owner.
In particular, the interested party has the right to:
- withdraw consent at any time. The interested party can always revoke the consent to the processing of his personal data previously expressed (article 13, paragraph 2, letter c) EU Reg. 2016/679);
oppose the processing of your data. The interested party may object to the processing of their data in the cases referred to in art. 21 EU Regulation 2016/679;
- access your data. The interested party has the right to obtain information on the data processed by the Data Controller, on certain aspects of processing and to receive a copy of the data processed (Article 15 of the EU Regulation 2016/679);
- verify and ask for rectification. The interested party can verify the correctness of his / her data and request that it be updated or corrected (Article 16 of the EU Regulation 2016/679);
- get the treatment limitation. When certain conditions are met, the data subject may request the limitation of the processing of his data. In this case we will not process the data for any other purpose than their preservation (art. 18 EU Reg. 2016/679);
- obtain the cancellation or removal of your personal data. When certain conditions are met, the data subject may request the deletion of their data by the Data Controller (Article 17 of the EU Regulation 2016/679). In these cases we will certainly cancel the data as quickly as possible or have it transferred to another owner (data portability). The interested party has the right to receive his / her data in structured format, commonly used and readable by an automatic device and, where technically feasible, to obtain its transfer without obstacles to another holder. This provision is applicable when the data is processed by automated tools and the processing is based on the consent of the interested party, on a contract of which the interested party is a party or on contractual measures connected to it (art. 20 EU Reg. 2016/679 );
- to make a complaint. The interested party can propose a complaint to the competent personal data protection control authority (art. 77 Reg. UE 2016/679) or act in court (art. 79 Reg. UE 2016/679).