Information On The Processing Of Personal Data Art. 13 Regulation (Eu) 2016/679 (Gdpr)
DATA CONTROLLER:
AQUARDENS Wellness & Hospitality Srl with registered office in Via Valpolicella 63 - 37026 Pescantina VR Tax code and VAT number 05162290232 - email: privacy@aquardens.it
DATA PROTECTION OFFICER (“DPO” or RPD)
The DPO/RPD of Aquardens can be contacted at the following e-mail address: dpo@aquardens.it
How we use your common personal data, what conditions makes the processing lawful, and how long it is kept.
We collect the following common data directly from you (as the "data subject"), through traditional and online channels: personal and contact data; data relating to membership, participation and use of initiatives and services organised by the Thermal Park; website registration data; browsing data; purchase data, possibly relating to the overall volume of expenditure progressively made and/or details of purchases; payment data; shipping and delivery data.
We use your common data for the following purposes:
1.Loyalty purposes, in particular for the attribution of benefits associated with the purchase of an entrance ticket to the Thermal Park, such as, by way of example but not limited to, the assignment of discounts at the time of purchase, access to special services offered at certain times of the year, and the sending of surveys to measure the level of satisfaction with the service/product purchased.
2.For the purposes of customer care and customer service complaint management regarding requests of various nature or the handling of complaints.
Duration: In cases sub.1 and 2, personal data will be kept for as long as necessary to take advantage of the loyalty services or the handling of requests or complaints. If they are to be retained for further purposes, such data shall be retained for 10 years from the termination of the relationship, without prejudice to any different retention periods provided for by law or sector regulations.
3. For the purpose of creating and managing your personal account, should you decide to use our personal area and be part of our community. In this case we may, for example, identify you and assist you in case you lose your access data (username or password), assist you in the purchase of tickets or services, sale of products through the e-commerce area of the site, etc.
Duration: In case sub. 3, your personal data will be processed for the duration of your membership to the reserved area, unless you request the deletion of your account.
Legal Basis: The legal basis of the processing for the purposes set out in points 1,2 and 3 above is represented by the need to execute a contract to which the data subject is a party, pursuant to Art. 6.1(b) GDPR.
4.Administrative, accounting and legal purposes connected with the management of the relationship with the customer/user.
Duration: In case sub. 4 the personal data will be processed for the duration provided for by law and/or specific accounting/tax regulations.
Legal Basis: The legal basis of the processing for the purposes referred to in point 4 above is represented by the need to fulfil obligations provided for by national and/or supranational regulations pursuant to Art. 6.1 lit. c) GDPR.
For all the above-mentioned purposes (Points 1 to 4) the provision of data is mandatory. Refusal to provide the data does not allow for the management of loyalty purposes, the registration to the personal area, the management of requests and/or complaints and the fulfilment of legal obligations.
4.Marketing purposes: Aquardens will use your data to send you commercial communications by automated (e.g. sms, email, push notifications via app and instant messaging) and traditional (e.g. phone calls with operator) contact methods.
Duration: Your personal data will be processed for marketing purposes for a maximum duration of
36 months from the date of your last consent.
Legal Basis: The legal basis of the processing for marketing purposes is represented by your consent, which is specific, optional and revocable at any time (art. 6.1 lit.a) GDPR).
5.Profiling purposes, Aquardens will use your data to create a customer profile according to your preferences, habits, interests, behaviours, products purchased, responses to market research in order to send you personalised commercial communications (e.g. personalised offers and coupons). The data helps us to understand, through your purchases and the pages you visit on our e-commerce, what your consumption habits are in order to carry out analysis or to tailor our promotional campaigns according to your interests.
Duration: Your personal data will be processed for profiling purposes for a maximum of 18 months from the date of your last consent.
Legal basis: The legal basis for processing for marketing purposes is your consent, which is specific, optional and revocable at any time (Art. 6.1 lit.a) GDPR).
For marketing and profiling purposes (Points 4 and 5), the provision of data is optional. Refusal to provide data for marketing and/or profiling purposes will not affect the purchase of services and/or products from Aquardens.
Processing of special categories of data (e.g. health data)
We only use your so-called special sensitive data (e.g. health data) to enable you to obtain the specific services you have requested, in particular for access to the medical centre.
In the event that the processing of sensitive data is related to the provision of healthcare services on a private basis, Aquardens will process your data as the data controller on behalf of and for the account of the individual healthcare professionals who are the data controllers.
In the event that the processing of sensitive data is related to the provision of healthcare services under contract, Aquardens will process your data as Data Processor in the name and on behalf of the Data Controller Azienda Ulss 9 Scaligera.
Browsing data processed through the website www.aquardens.it
The computer systems and software procedures used to operate the website www.aquardens.it acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.
This information is not collected in order to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and IT environment.
This data is used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct operation, and is deleted after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes to the detriment of the site.
Complete information on the use of cookies and interaction services with external platforms (e.g. social networks) on the Aquardens website is available at the following link: www.aquardens.it/it/cookie-policy/.
Which subjects receive your data
The data may be communicated to subjects acting as data controllers, such as, by way of example, banks and credit institutions, supervisory and control authorities and any legitimised public subject, such as judicial and/or public safety authorities; the data may also be processed on behalf of the Data Controller by subjects designated as data processors, such as, by way of example, companies providing IT services.
Who we authorise to process your data
The data will be processed exclusively by employees of the company assigned to the pursuit of the above-mentioned purposes, who have been expressly authorised to process the data and who have received appropriate operating instructions
Transfer of your data outside the EU
Data may be transferred to third countries outside the European Economic Area (EEA) (e.g. USA). In this case, the transfer of Personal Data will take place in accordance with the provisions of the GDPR, Title V, Art. 44 et seq. In particular, the transfer will take place to a third country deemed adequate pursuant to Article 45 GDPR in accordance with the decision adopted by the Court of Justice of the European Union or, for third countries not subject to an adequacy decision, the transfer will take place on the basis of the Standard Contractual Clauses, pursuant to Article 46 GDPR, subject to verification that the third country guarantees an adequate level of protection of Personal Data.
What are your rights
You may request from the Controller access to the personal data concerning you, its rectification or erasure, the integration of incomplete personal data, the restriction of processing in the cases provided for by Article 18 GDPR as well as the objection to processing in cases of legitimate interest of the Controller for reasons related to your particular situation.
You also, for cases where the processing is based on consent or contract and is carried out by automated means, have the right to exercise the right to data portability, i.e. to receive your personal data in a structured, commonly used and machine-readable format, as well as, if technically feasible, to transmit it to another data controller without hindrance.
Finally, you have the right to withdraw your consent at any time for marketing and/or profiling purposes, as well as to object to the processing of your data for marketing purposes, including profiling in connection with direct marketing and the sending of communications for similar products and services.
Your rights may be exercised, using the specific application made available by the Data Protection Authority (https://www.garanteprivacy.it/home/modulistica-e-servizi-online#diritti), by writing to privacy@aquardens.it or by sending the Data Controller a registered letter with acknowledgement of receipt.
Complaint
If you believe that the processing of personal data referring to you has been carried out in violation of the provisions of the Data Protection Act, you have the right to lodge a complaint with the Data Protection Authority, as provided for in Article 77 of the Regulation itself, or to take legal action (Article 79 of the Regulation).
