RESIDENCELARUSTICA.IT PRIVACY POLICY

Who is the Data Controller?[1]

Malù S.r.l., with registered office in Via 42 Martiri, 156 - 28924, Verbania (VB) (VAT number: 00854220035) (hereinafter, the "Data Controller")

How can I contact the Data Controller?

The company's contact details are:

PEO: info@residencelarustica.it

PEC: srlmalu@mypec.eu

Address: Via 42 Martiri, 156 - 28924, Verbania (VB)

1. Introduction

Under the European Regulation on the Protection of Personal Data (GDPR), legal persons are not considered to be affected and therefore the European Regulation does not apply. However, if personal data referring to a natural person is included in the context of the collection of company data, that person will be considered a data subject within the meaning of the aforementioned regulation, with the consequent applicability of the relevant legislation.

2. What types of processing are carried out through the website? And what are the legal bases, purposes and storage times?

SENDING INFORMATION EMAILS	PURPOSE	The purpose of the data processing is to send emails to provide information regarding the stay.
	LEGAL BASIS	Execution of the contract.
	STORAGE TIMES	24 months
	OTHER INFORMATION	The User has full freedom to release the requested data, as there is no legal obligation to provide it. However, if the User chooses not to provide the data reported as essential, the Data Controller will not be able to accomplish the indicated purpose.

AVAILABILITY REQUEST	PURPOSE	The purpose of the data processing is to request the availability of a stay on the dates indicated.
	LEGAL BASIS	Execution of pre-contractual measures carried out at the request of the Data Subject. In the event of litigation, the data will be processed for the purpose of acting or defending in court and this corresponds to the legitimate interest of the Data Controller.
	STORAGE TIME	24 months
	OTHER INFORMATION	The User has full freedom to release the requested data, as there is no legal obligation to provide it. However, if the User chooses not to provide the data reported as essential, the Data Controller will not be able to accomplish the indicated purpose.

CONTACT IN CASE OF NEW AVAILABILITY	PURPOSE	The purpose of the data processing is to contact the User if the facility is available again on the dates requested by the User.
	LEGAL BASIS	Execution of pre-contractual measures carried out at the request of the Data Subject.
	STORAGE TIME	If, after contacting the User again, the latter accepts the proposal, then the data is processed for contractual performance; if the User does not accept, the data is deleted.
	OTHER INFORMATION	The User has full freedom to release the requested data, as there is no legal obligation to provide it. However, if the User chooses not to provide the data reported as essential, the Data Controller will not be able to accomplish the indicated purpose.

MARKETING AND PROFILING THROUGH DIGITAL PLATFORMS	PURPOSE	The purpose of the data processing is to display marketing content based on your interests, as identified by your interactions on our website or social media. This includes the use of digital platform retargeting tools to deliver targeted advertising messages.
	LEGAL BASIS	Consent that can be acquired through various methods: 1. Through Cookies on our Website: Your consent to marketing and profiling cookies is collected through the cookie settings on our website. 2. For Custom Audience CRM Campaigns (Prospecting and Retargeting): For these campaigns, we obtain your explicit consent to use your contact data (e.g., email address) for marketing purposes. Interaction with Social Pages: If you have consented to the use of profiling cookies on our Website, we may process your contact data and the information communicated during the interaction with the Social Pages. We use this information, in accordance with your social media privacy settings, to display personalized marketing ads.
	STORAGE TIME	The data will be kept until the consent is revoked through the cookie settings.
	OTHER INFORMATION	1. Consent acquired through Cookies on our Website: The User can manage or revoke this consent at any time, as described in our Cookie Policy. We also inform you that cookies can be both first and third party and therefore installed, through us, directly from Meta. 2. Consent acquired for Custom Audience CRM Campaigns (Prospecting and Retargeting): This consent allows us to process your data to identify similar audiences (lookalikes) and to show targeted advertisements on social media and other digital platforms. In the case of simple segmentation of the User, your consent is not required.

BROWSING DATA	PURPOSE	Site security
	LEGAL BASIS	We will process the data based on the legitimate interest of the company in cybersecurity and the fulfilment of legal obligations. The legal basis for the processing of cookies other than those necessary is consent.
	STORAGE TIME	24 months
	OTHER INFORMATION	For the regulations on cookies, please refer to the specific information.

3. What else should I know?

The data will be processed lawfully, correctly and with the utmost confidentiality, in compliance with the appropriate security measures as provided for by the Code and the Regulations. The processing will be carried out by digital means. The data shall not be disclosed publicly. In addition, the User will not be subjected to automated decision-making processes such as profiling unless they consent to this through the installation of cookies or other tracking tools for the standardisation of which reference is made to the specific information.

4. To whom will my data be communicated?

The Data Controller may communicate the data to all subjects to whom the communication is mandatory by law for the fulfillment of the purposes provided for by law.

The Data Controller also makes use of some companies or IT tools that carry out processing activities on the personal data of the Data Subjects in the exclusive interest of the Data Controller, all adequately appointed as Data Processors pursuant to Art. 28 GDPR.

The list of Data Processors can be found on site.

5. What is the place of storage and transfer of data?

The management and storage of personal data will take place on servers located in Italy. However, the data may be transferred outside Europe for the performance of certain activities (sending information emails). The Data Controller guarantees that the non-EU transfer takes place in accordance with Articles 44-47 Chapter V of the GDPR through the signing of standard contractual clauses and/or through the adequacy decision of 10 July, 2023.

6. What are my rights and how can I exercise them?

a) Rights of the Data Subject

The User, in their capacity as a Data Subject, has the rights referred to in Art. 15 et seq. of the Regulation and precisely:

1. RIGHT OF ACCESS (Art. 15 GDPR)

The Data Subject shall have the right to obtain confirmation as to whether or not personal data concerning them exist, regardless of its being already recorded, and communication of such data in intelligible form.

2. RIGHT OF RECTIFICATION (Art. 16 GDPR)

The Data Subject shall have the right to obtain the rectification of inaccurate personal data concerning them and also the integration of incomplete data.

3. RIGHT OF CANCELLATION (Art. 17 GDPR)

The Data Subject shall have the right to obtain the deletion of personal data in the presence of particular reasons such as the revocation of consent, opposition to processing or if the data is no longer necessary with respect to the purposes for which it was collected and processed or in the event of unlawful processing. It will not always be possible to proceed with cancellation, but it will certainly be the responsibility of the Data Controller to provide adequate justification.

4. RIGHT OF LIMITATION OF PROCESSING (Art. 18 GDPR)

The Data Subject has the right to obtain restriction of processing in special cases such as, for example, in the case of a request for rectification or opposition during the time of assessment of requests.

5. RIGHT TO PORTABILITY (Art. 20 GDPR)

If the processing is based on consent or contract and is carried out by automated means, the Data Subject may receive them in a structured, commonly used and machine-readable format or request that they be transmitted to another Data Controller.

6. RIGHT TO OBJECT (Art. 21 GDPR)

The Data Subject has the right to object, entirely or in part:

a) to the processing of their personal data for legitimate reasons, even if such processing is relevant to the purposes the data have been collected for;

b) to the processing of personal data concerning them for the pursuit of purposes not covered by Art. 2.

The User may formulate a request to object to the processing of their personal data pursuant to Article 21 of the GDPR in which they give evidence of the reasons justifying the objection: the Data Controller reserves the right to assess the request, which would not be accepted in the event of the existence of compelling legitimate grounds for processing that prevail over the User's interests, rights and freedoms.

7. RIGHT TO LODGE A COMPLAINT

The Data Subject has the right to lodge a complaint with the competent supervisory authority pursuant to Article 77 of the GDPR if they consider that the processing of their data is contrary to the legislation in force.

b) Operating procedures:

The Data Subject may at any time exercise the rights referred to in the preceding article by contacting the Data Controller at the addresses indicated above.

Latest version: 7/05/2024

This privacy policy was drawn up by Polimeni.Legal

[1] Pursuant to Article 4 no. 7 GDPR: the Data Controller is the person who determines the purposes and means of the processing of personal data and their responsibilities are identified by Article 24 GDPR.