Pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR), we hereby provide you with the following information:
1. Personal data supplied by you or acquired from you within the scope of our activities will be processed in accordance with the principles of lawfulness, fairness, transparency, data minimisation and security set out in Art. 5 of the Regulation, and with a view to protecting your privacy and your rights.
2. The processing is aimed at complying with legal and contractual obligations or with the mandate conferred by the data subject; the legal basis is Art. 6(1)(b) and (c) of the Regulation.
3. Personal data are also processed in order to send the newsletter, information and advertising material and commercial communications concerning new or existing products/services/offers, updates and news, including greeting cards; the legal basis is your consent pursuant to Art. 6(1)(a) of the Regulation.
4. The processing is carried out using paper and electronic means, applying technical and organisational measures appropriate to guarantee the security and confidentiality of the data pursuant to Art. 32 of the Regulation.
5. Providing the data for the purposes referred to in point 2 is necessary: refusal to provide them, in whole or in part, may result in the failure or partial performance of the contract or in the mandate not being carried out.
6. Providing the data for the purposes referred to in point 3 is optional: refusal has no consequences other than the impossibility of receiving the newsletter and the commercial communications. Consent may be withdrawn at any time, using the unsubscribe link included in every newsletter or by writing to the data controller; withdrawal does not affect the lawfulness of the processing carried out beforehand.
7. The data may be communicated, exclusively for the purposes indicated above, to parties acting as data processors pursuant to Art. 28 of the Regulation – including the provider of the newsletter platform (CleverReach GmbH & Co. KG, Germany), IT and hosting service providers, legal and tax advisors and banks – as well as to the persons authorised to carry out the processing within our organisation. The data will not be disseminated under any circumstances.
8. Data processed for the purposes referred to in point 3 are kept until consent is withdrawn; data processed for the purposes referred to in point 2 are kept for the period required by legal, accounting and tax obligations. The data are not transferred outside the European Economic Area and are not subject to automated decision-making or profiling pursuant to Art. 22 of the Regulation.
9. The data controller is Turmhotel Gschwendt Srl, Außerpichl 7/a (Colle), I-39030 Valle di Casies (BZ), e-mail info@hotel-gschwendt.it.
10. You may contact the data controller in order to exercise the rights provided for by Art. 15-22 of the Regulation (access, rectification, erasure, restriction of processing, portability and objection) and to withdraw your consent, as well as to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) pursuant to Art. 77 of the Regulation.
