PRIVACY STATEMENT

Associazione Promozione Turistica Bormio Marketing

Via Roma 131/B, 23032 Bormio (SO)
email: info@bormio.eu 
Tax code and VAT number: 00965120140

and Bormio Booking Srl - Società Benefit
Via Roma 131/B, 23032 Bormio (SO)
email: bormiobooking@bormio.eu  
Tax code and VAT number: 01008990143

as Joint Controller for the processing of personal data in accordance with articles 4, 7 and 24 of EU Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter the “Regulation”) hereby notify that, in accordance with articles 13 and 14 of the Regulation, that they will process personal data relating to site users.

Both Bormio Marketing and Bormio Booking may process your personal data for the various purposes indicated below (or in other statements which will be provided to you by one of the parties, including in simplified form), for which one or other of the parties will be the joint controller.

You may contact either of the two joint controllers to protect your rights.

1. Data processed (which data we process)

PURCHASING EXPERIENCES: If experiences are purchased, we will process personal details (e.g. name, address), contact information and payment details.

HOTEL BOOKING: If an accommodation booking is made, we will process personal details, contact information and credit card data which will be disclosed to the hotel.

INFORMATION REQUEST: We will collect your first name, surname, email address and telephone number and, optionally, your city and country.

NEWSLETTER: if you complete the form at the bottom of the page, we will ask you to enter your first name, surname and email address. Then, in the sign-up confirmation request, we will ask you to state your newsletter type preferences.

CHAT: We may ask you to enter your email address and telephone number as well as your name.

REVIEWS: We will use the name that you provide.

In all cases: we will process your IP address and session log

2. Legal basis and purposes of processing

The data will be processed to allow for the conducting of activities relating to the establishment and the management of the service requested of the controller. It is mandatory to provide the data in order to follow up on the purchase or the booking and in all cases in which the legal basis is the execution of pre-contractual or contractual measures performed at the request of the data subject; it is optional in all cases in which the processing is based on consent such as for the sending of newsletters; in any instance where consent is not given (with the exception of instances where this is mandatory or optional) it will not be possible to complete requests.

The data will be processed lawfully, fairly and with the utmost confidentiality, in compliance with appropriate security measures as provided for by the Code and the Regulation.

Processing will be performed using analogue/digital means. The data will not be disclosed publicly.

In particular:

1. PURCHASE: The main purpose is to allow the purchasing and subsequent use of experiences; the ancillary purposes are of an accounting and fiscal nature or relate to the handling of any disputes with the data subject; the legal basis on which the processing is based is, first and foremost, the execution of the contract and, secondarily, the fulfilment of legal obligations by the controller and the legitimate interest of protection in the event of a dispute;
2. BOOKING: The main purpose is to allow the booking and subsequent use of hotel services; the ancillary purposes are of an accounting and fiscal nature in relation to credit card details and the handling of any disputes with the data subject; the legal basis on which the processing is based is, first and foremost, the execution of the pre-contractual measures performed at the request of the data subject and, secondarily, the fulfilment of legal obligations by the controller and the legitimate interest of protection in the event of a dispute;
3. INFORMATION REQUESTS: The purpose is to make contact with accommodation providers and request information; the legal basis is the execution of pre-contractual measures performed at the request of the data subject and the request will be sent directly to the selected accommodation provider which will acquire the data as the independent controller and will use the data to respond to the request, providing its own privacy statement;
4. NEWSLETTER: The purpose is to inform you of news and promotions (via email, telephone, SMS or WhatsApp) and the legal basis is consent. With explicit consent, we can proceed with indirect marketing, offering you services and products provided by our commercial partners (we do not pass on your data). With your explicit consent, we can proceed with profiling you, combining the data supplied with those available online in order to get an overview of your interests and to provide you with personalised offers. With your explicit consent, we can conduct retargeting campaigns and/or use email to detect social media profiles for personalised marketing campaigns. Lastly, in accordance with article 130, paragraph 4, of Legislative Decree 196/03, following the purchase of a product or service, your data will be exported in a CRM to send commercial information about similar products to the one purchased, your consent is not necessary but you may refuse the processing at any time; ;
5. CHAT: The purpose is to respond to questions and the legal basis is the execution of pre-contractual measures performed at the request of the data subject. The data may also be processed to defend any legal dispute arising with the client and this represents the legitimate interest of the controller. ;
6. REVIEWS: The review request will be sent on the basis of the controller’s legitimate interest, whilst the data subject may freely choose whether or not to leave a review of the services and therefore is based on consent. The data may also be processed to defend any legal dispute arising with the client and this represents the legitimate interest of the controller. ;
7. IP address and session log: we will process the data on the basis of legitimate interest of the controller. ;

3. Processing modalities and data storage period

The Controller will process the personal data for the period of time necessary for fulfilling the purposes set out above, specifically:

PURCHASE: we will delete the data 10 years after the purchase.

BOOKING: we will delete the data 10 years after the booking of the service.

INFORMATION REQUEST: we will delete your data 48 months after the final email is sent; or if it is necessary to keep a record of it, we will verify the obsolescence of the data every 12 months. In the event that potential disputes or litigation arise from the content of the emails, the data will be stored for longer and until the conclusion of the potential litigation or until the end of the limitation period and the expiry of the civil or criminal actions.

NEWSLETTER: we will delete your data 5 years after the final date on which consent was given.

CHAT: we will delete your data after having replied to your requests, or if it is necessary to keep a record of it, we will verify the obsolescence of the data every 12 months. In the event that the content of the chat may give rise to potential disputes or litigation, the data will be stored for longer until the conclusion of the potential litigation or until the end of the limitation period and the expiry of the civil or criminal actions.

REVIEWS: we will process your data until you ask us to delete them or until they become obsolete. We will check the obsolescence of the data every 12 months.

IP address and session log: the data will be deleted after 30 months.

4. Data disclosure

The Controller may disclose the data for the purposes specified in article 2 to all entities to which disclosure is legally compulsory for the fulfilment of the purposes required by law. The data will not be disclosed publicly. Data will be disclosed to the payment gateway which will use them as independent controllers as well as to our suppliers who will use them as a data processor.

5. Place of storage and transfer of the data

The personal data will be managed and stored on servers located within the European Union belonging to the Controller and/or third-party companies appointed and duly named as data processors.

In addition, for the purposes of sending commercial information, the Controller has the intention of moving the location of the servers to non-EU countries. With immediate effect, the Contractor shall ensure that data is transferred outside the EU in compliance with the applicable laws implementing the standard contractual clauses specified by the European Commission.

6. Rights of the data subject

The user, as the data subject, has the rights specified in article 15 of the Regulation, specifically:

1. The data subject has the right to confirm the existence of the personal data relating to them, even if not yet registered, and to receive them in an intelligible form.
2. The data subject has the right to obtain:
   a) the origin of the personal data;
   b) the purposes and modalities of the processing;
   c) the logic applied in the event of processing performed using electronic devices;
   d) the identification details of the controller, processor and representative;
   e) the data subjects or categories of data subjects to which the personal data may be disclosed or who may become aware of it as designated representative in the member state, or as processor or appointee.
3. The data subject has the right to obtain:
   a) the updating, correction or, when necessary, the completion of the data;
   b) the deletion, anonymisation or blocking of data processed unlawfully, including those which it is not necessary to store for the purposes for which they have been collected or subsequently processed;
   c) confirmation that the operations referred to in points a) and b) have been brought to the attention, including in terms of their content, of those persons to whom the data have been disclosed or circulated, except in the event that such compliance is impossible or requires the use of requires the use of resources which are manifestly disproportionate to the protected right.
4. The data subject has the right to object, in full or in part:
   a) for legitimate reasons to the processing of personal data relating to them, even if relevant to the collection purposes;
   b) to the processing of personal data relating to them for the fulfilment of purposes not specified in article 2.

In accordance with articles 15 et seq. of the GDPR, the user has the right to request access at any time to their personal data, the rectification or deletion of the data, the restriction of processing in the cases provided for by article 18 of the GDPR, obtaining the data relating to them in a structured, commonly used format which can be read by an automatic device in the instances provided for by article 20 of the GDPR. At any time, the user may revoke their consent as per article 7 of the GDPR; the user may lodge a complaint with the competent regulatory authority pursuant to article 77 of the GDPR if they consider that the processing of their data is in breach of the regulations.

The user may submit a request to oppose the processing of their personal data pursuant to article 21 of the GDPR in which they indicate the reasons for the opposition: the Controller reserves the right to assess the request which will not be accepted if there are legitimate relevant reasons for proceeding with the processing which prevail over the interests, rights and freedoms of the user.

The data subject may, at any time, exercise their rights as specified in the article above by sending an email to: info@bormio.eu