Privacy Policy

Information on the processing of personal data
Last updated: 25 February 2018

Pursuant to Legislative Decree n. 196/2003 (hereinafter, the “Privacy Code“) as well as, starting from 25 May 2018, by EU Regulation no. 679/2016 (hereinafter, the “GDPR” or, together with the Privacy Code, the “Privacy Policy“), La Ciriola, with registered office in Strada di Valle Spoletina 16/58, Piediluco, 05100 Terni, Fiscal Code and VAT no. IT00248830556 (hereinafter, the “Company” or the “Owner“), as the data controller, informs you of the methods and circumstances with which it will process personal data and information
– provided by you through one of the following sites: http://www.laciriola.com/en/ (hereinafter, individually, the “Site”), or
– provided to the Company by a third party previously authorized by you, as the owner, to the processing of your personal data, giving consent to the communication to third parties for promotional, commercial and marketing purposes.

Type of data being processed

  1. Personal data
    The personal data processed by the Company are as follows: name, surname, date of birth, gender, telephone number, residential address, postcode, telephone number, e-mail address. In the event that we collect such personal data directly from you and through the Site, the system stores the IP address of the network you used at the time of registration in order to keep proof of your registration of your consent. Moreover, in the event that your data have a different origin from your direct conferment (for example, when we have obtained your data from a third party), the latter has communicated to us, together with your data, also the IP address the network you used when you gave your specific consent to the disclosure of your third-party data, including for promotional, commercial and marketing purposes.
    The registration of the IP address of the network used at the moment of the consent can be useful in order to allow the competent Authorities to carry out any investigative or in-depth investigation deemed appropriate in your interest and against any unlawful act carried out by third parties subject your data.
  2. Navigation data
    The computer systems and software procedures used to operate the Site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified individuals, but which by their very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of the computers used by users connecting to the site, the addresses in the Uniform Resource Identifier (URI) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the operating system and the user’s computer environment. This data, except for the data corresponding to the IP address of the network you used at the time of registration, for which the same as specified in the previous point a), are used for the sole purpose of obtaining anonymous statistical information on the use of the site and check its correct functioning and are deleted immediately after processing.
  3. Cookies
    No personal data of users is acquired by the Site in this regard. Cookies are not used to transmit information of a personal nature, nor are CDs used. persistent cookies of any kind, or systems for tracking users. The use of cd. session cookies (which are not stored permanently on the user’s computer and are automatically deleted when the browser is closed) is strictly limited to the transmission of session identifiers (consisting of random numbers generated by the server) necessary to allow exploration safe and efficient site. The cd. session cookies used on this site avoid the use of other technologies that could compromise the privacy of users’ browsing and do not allow the acquisition of personal identification data.

Legal basis and purpose of the processing

  1. Promotional, commercial and marketing purposes
    Subject to obtaining your explicit consent (except in the case where the Company has legitimately obtained your data from a data controller to whom you previously and specifically consented for promotional, commercial and marketing purposes, including communication to third parties), the processing of your data will take place to achieve the purposes connected and instrumental to sending, always exclusively by the Company, on a periodic basis, offers, discounts and / or other commercial initiatives of the Company or our business partners. Failure to provide consent for these purposes will not allow you to receive such offers, discounts and / or commercial communications.
    The company shall specify that by accepting the processing for promotional, commercial and marketing purposes, your data will not be disclosed to any third party. In fact, in the absence of your specific consent, the Company never shares your data with the subjects who use the services of the same to spread their commercial offers.
    Moreover, even if you decide to consent to the processing of data for the purposes specified in this point, you will still have the right to object, in whole or in part, to processing for the aforementioned purposes, making it simple request to the Company, without any formalities, at the addresses already indicated at the bottom of this statement.
  2. Communication to third parties for promotional, commercial and marketing purposes
    Subject to obtaining your explicit consent (except in the case where the Company has legitimately obtained your data from a data controller to whom you previously and specifically consented for promotional, commercial and marketing purposes, including communication to third parties), your data may be used by the Company in order to communicate them to third parties (as better specified in the next point called “Categories of recipients of data”) for sending commercial communications (marketing) and / or direct sales on its own and its partners’ initiatives, via e-mail, fax, telephone, sms and any other remote communication technology – including communications via social media.
    The consent to the processing of your data for this specific purpose is absolutely optional and your refusal to treatment will not affect in any way the opportunity to continue receiving communications referred to the other purposes described above.
    Moreover, even if you decide to consent to the processing of data for the purposes specified in this point, you will still have the right to object, in whole or in part, to processing for the aforementioned purposes, making it simple request to the Company, without any forma.

Owner, persons in charge and responsible for data processing

  1. Data controller
    The data controller provided by users is the Company, as defined in the preamble, in the person of its legal representative pro tempore.
  2. Trustees of the treatment
    The persons employed as staff of the Company, or other specifically appointed external subjects in charge of processing, may become aware of your data as they are responsible for carrying out certain processing operations connected and instrumental to the provision of the service and / or additional purposes to be you allow.
  3. Responsible for the treatment
    With regards to the data controllers appointed by the data controller, we inform you that with reference to the processing concerning the delivery activity through e-mail messages of communications for promotional, commercial and, in general, marketing purposes, the The Company has appointed the following subjects as external processors:
    – 
    SiteMinder: the personal data provided through The Booking Button will be processed in accordance with the new regulation, available at the following links: https://www.siteminder.com/legal/privacy/, https://www.siteminder.com/legal/data-security/.

Method of treatment

Your personal data will be processed using manual or electronic means, with methods strictly related to the aforementioned purposes and, in any case, so as to guarantee the security, protection and confidentiality of the data.
Furthermore, it is further specified that the processing of personal data is carried out in ways that minimize the risk of destruction or loss, even accidental, of the data, unauthorized access or processing not allowed and not in accordance with the purposes of collection. In particular, in the processing of data, the Company and the individuals identified as data controllers will take advantage of organizational, physical and logical measures to guarantee their security and confidentiality, with the use of any appropriate measure to allow and guarantee the classification, storage and confidentiality of the data (eg, by way of example, periodic checks, storage in closed cabinets, fire protection devices, electrical continuity, user identification, antivirus check, periodic backups, etc.).
Personal data may be processed by employees, collaborators and consultants of the Company, specifically appointed as persons in charge of processing, for the performance of specific operations necessary for the pursuit of the aforementioned purposes, under the direct authority and responsibility of the Company and in accordance with the instructions that will be issued by the same.

Recipients of the data

The data may be communicated, your prior express consent, and exclusively for the purposes indicated above, to the categories of subjects operating in the following economic / product categories:

  • Services and products relating to the communications and technology sector and the like.
    Finance and banking sector: financial entities, insurance, investment, social security and the like.
  • Free time: pay TV, editorials, sports, collecting, photography, pastime, games, transport, navigation, tourism (hotels, tour operators, travel agencies, airlines, etc.), aerospace, gardening, hobbies, lottery, competitions, communication and entertainment, art, music and the like.
  • Distribution and commerce: electronics, information technology, image and sound, fashion, accessories, clothing, textiles, bazaars, cosmetics and sanitary, chemical, pharmaceutical and biotechnology, agro-food, supermarkets, beverages, office equipment, furniture, and the like.
  • Automotive: products and services related to cars, industrial vehicles, cycles and motorcycles, trucks, mechanics and metallurgy, and the like.
  • Energy and water: products related to electricity, hydrocarbons, gas, water and utility, and the like.
  • Education, training, education, universities, and the like.
  • Communication and services: advertising agencies, marketing, events, consultancy, advertising, PR, advertising dealers, media centers, telecommunications, market research, mobile marketing agencies, and the like.
  • Ecology and environment.
  • Construction, civil engineering and real estate products / services: construction, decoration, home, design, real estate agencies, and the like.
  • Exhibitions and events, and the like.
  • IT, internet, e-commerce sites, etc.

In particular, regardless of this product list, as of now we specify that your data, in the case of specific consent to the purposes of processing communication and / or transfer to third parties for promotional, commercial and marketing purposes, will be disclosed to third-party companies who will use them as provided for in the autonomous information provided by them, for example by communicating to your e-mail address.
For the sake of completeness, we inform you that in some cases these companies, in their capacity as independent data controllers, may prefer to write directly to inform you in detail about the way they will process your data, what opportunities they have in store for you and how you can do it your rights to them. These subjects, acting as independent data controllers, after sending appropriate information to the interested party, will process your data in order to send you promotional, commercial and marketing communications, via e-mail, fax, telephone, text messages and any other technology. distance communication, without prejudice to your right to oppose the processing for such purposes at any time, by making a simple request without any formalities to the relevant data controller.

Data retention period

At any time you can oppose the processing of your personal data by sending an e-mail to the address indicated at the end of this Information. You can also unsubscribe from our lists by clicking on the appropriate hyperlink for the deletion contained at the bottom of our e-mails. In these cases, your data will be deleted in the time necessary to complete your request.
Even after your cancellation, although we will no longer send you our commercial communications or communications on behalf of third parties, we may continue to retain some of your data in order to be able to prove that you have obtained valid consent for all communications that occurred until your request for cancellation. We will not share this information with anyone except as permitted by law.
If you receive our communications on the basis of a contractual relationship with the Company, we will only delete your data when this relationship is interrupted and / or according to the provisions of the contract and applicable law. Finally, in case the e-mail sending systems encounter problems in the delivery of the communications to your e-mail address, or in the case in which they were to find the inactivity of your account for a prolonged period, the Company could provide to erase your data after an unspecified period of time, between 6 and 10 years.

Data transfer abroad

The Company may use services offered by third-party companies, which will process your data as data controllers and in accordance with the instructions given to them by the Company. It is possible that some of the treatments carried out by the managers take place outside the territory of the European Union, such as in the USA. In these cases, the Company uses legal instruments to ensure adequate protection of your personal data (eg by requesting such counterparts to sign Standard Contractual Clauses).

Your rights

As an interested party, you are granted the following rights to the personal data collected and processed by the Data Controller as part of the treatment outlined above:

  • Right of access
    You have the right to obtain from the Company confirms that personal data processing is in progress for you and in this case, to obtain access to personal data and the following information: (i) the purposes of the processing; (ii) the categories of personal data in question; (iii) the recipients or categories of recipients to whom your personal data have been or will be disclosed, in particular if recipients of third countries or international organizations; (iv) when possible, the retention period of the personal data provided or, if not possible, the criteria used to determine this period; (v) the right to lodge a complaint with a supervisory authority.
  • Right of rectification, opposition and cancellation
    You have the right to obtain the correction of inaccurate personal data concerning yourself and, taking into account the purposes of the processing, the right to obtain the integration of incomplete personal data, including by providing an additional declaration. In addition, you have the right to obtain the deletion of your personal data if there is one of the following reasons: (i) personal data are no longer necessary for the purposes for which they were collected or otherwise processed; (ii) the data are processed unlawfully; (iii) you have revoked the consent on the basis of which the Owner has the right to process your data and there is no other legal basis that allows the Data Controller to process the data; (iv) you opposed the processing activity and there is no legitimate overriding reason; (v) personal data must be deleted to fulfill a legal obligation.
    However, the Company has the right to disregard the exercise of the aforesaid cancellation rights if the right to freedom of expression and information prevails or for the exercise of a legal obligation or to defend one’s right to trial.
    At any time, you can oppose the processing even for only one of the purposes of the treatment described above.

In addition to the above, as of May 25, 2018, by virtue of the full operation of the GDPR, you are also recognized the following rights:

  • Right to data portability
    You have the right to receive, in a structured, common and readable format, your personal data provided to the Company and processed by it on the basis of consent, as well as the right to transmit such data to another Data Controller indicated by you without any impediment.
  • Right to limitation of treatment
    You have the right to obtain from the Company the limitation of processing: (i) for the period necessary to the Data Controller to verify the accuracy of such personal data concerning you which you have contested the accuracy; (ii) in case of unlawful processing of your personal data; (iii) when you need your data to be processed for the assessment, exercise or defense of a right in court; (iv) for the period necessary for the verification of the possible prevalence of the legitimate reasons of the Owner with respect to your request for opposition to the treatment.
    You can exercise the rights listed above by contacting the Company through the addresses indicated in the following point.
    Finally, we remind you that you are guaranteed the right to contact the competent data protection authority in case you believe there has been a non-compliant processing of your data.

Company contact details

You can exercise your rights at any time by sending a request to the Company as the data controller by e-mail at [email protected]