Processing of personal data
Informativa per il trattamento dei dati personali
Information on the processing of personal data Ducrot Rose Garden di Ecoluxury Travel S.r.l. with registered office in Via d'Ascanio 8, 00186 Rome, as the data controller (hereinafter "Data Controller"), informs you, pursuant to EU Regulation 679/2016 ("GDPR") and the legislation, including national legislation, on the protection of personal data for time applicable ("Privacy Policy"), that your data will be processed in the following ways and for the following purposes:
Purpose of the processing
The Data Controller processes personal, identification and non-sensitive data (by way of example but not limited to, name, surname, address, telephone number, e-mail, etc.), as well as personal data. - hereinafter, "personal data" or also "data") communicated by you when registering to the website ducrotrosegarden.com and ecoluxurytravel.it - (hereinafter, the "Site") or to the Controller's newsletter request form, when ordering and/or purchasing products or services online through the Site, when filling in and sending a contact form to the Controller or, in any case, when making any request to the Controller.
-
- Purpose and legal basis of the processing
Your Data are processed, without your prior consent, for the following purposes:
A. Service purposes:
(a) the performance of the contract or the fulfilment of pre-contractual obligations:
-
- fulfilling pre-contractual, contractual and fiscal obligations deriving from existing relations with you
-
- allow you to register on the Site
-
- process and manage orders received and/or purchases made online;
-
- allow you to use the services that you may have requested
-
- process a contact request;
-
- allow you to apply online and process your application;
-
- manage and maintain the Site;
-
- comply with obligations required by law, regulation, EU legislation or an order from the Authority;
-
- prevent or detect fraudulent activity or abuse detrimental to the Site;
-
- exercise the Controller's rights, such as the right of defence in court;
-
- preventing or detecting fraudulent activities or abuses harmful to the Site.
(b) the pursuit of a legitimate interest of the Data Controller, in particular:
-
- analysing cookies - as set out in the Cookie Policy - arising from your use of the Site;
-
- prevent or detect fraudulent activity or abuse detrimental to the Site;
-
- comply with obligations required by law, regulation, EU legislation or an order from the Authority;
-
- exercise the Controller's rights, such as the right of defence in court;
-
- to send you via e-mail newsletters, commercial communications and/or advertising material on products or services of the Controller and its associated companies.
B. only with your consent, for Marketing Purposes:
to send you via e-mail newsletters, commercial communications and/or advertising material on products or services of the Controller and its associated companies.
Processing methods
The processing of your Data is carried out - on paper (archives) and electronically (Molecole srl website and management software and office 365) - by means of the operations of collection, recording, updating, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, deletion and destruction of the Data.
Data retention
The Data Controller shall process the Data for the time necessary to reply to your request and fulfil the above purposes and in any case for no longer than 5 years from the collection for contact data and for no longer than 6 months from the collection for navigation data. Data for Marketing purposes will be processed for no longer than 2 years from their collection.
Access to data
Your Data may be accessed for the above purposes by
employees and/or collaborators of the Data Controller, in their capacity as data processors and/or internal processors and/or system administrators;
third party companies or other entities (e.g. website providers, e-payment service providers, suppliers, hardware and software support technicians, credit institutions, professional firms, travel agencies, etc.) that perform outsourcing activities on behalf of the Data Controller, in their capacity as external data processors.
Data communication
Your Data may be communicated, even without your consent, for the above-mentioned purposes to control bodies, law enforcement agencies or the judiciary, which will process them, at their express request, in their capacity as autonomous data controllers for institutional purposes and/or by virtue of the law in the course of investigations and controls. Your Data may also be communicated to third parties (e.g. partners, freelancers, agents, etc.), in their capacity as autonomous data controllers, for the performance of activities instrumental to the purposes described above.
Transfer of data
Data is not disseminated and will not be transferred to countries outside the EU. The management and storage of personal data will take place on servers located within the European Union. It is in any case understood that the Data Controller, should it become necessary, will have the right to move the location of the servers to Italy and/or the European Union and/or non-EU countries. In this case, in order to ensure an adequate level of protection of Personal Data, the transfer of data to non-EU countries will take place pursuant to the adequacy decisions approved by the European Commission or the adoption by the Data Controller of the Standard Contractual Clauses prepared by the European Commission.
Provision of Data
The provision of Data is mandatory for the Purposes of the Service. Should you decide not to provide the Data, we will not be able to process your request.
The provision of Data for Marketing Purposes is optional. You may therefore decide not to provide the Data or to deny the possibility to process Data already provided: in this case, you will not be able to receive personalised commercial communications on the Owner's products, but you will still be entitled to use the services of the Site.
The provision of Data is mandatory for the Purposes of the Service. Should you decide not to provide the Data, we will not be able to process your request.
The provision of Data for Marketing Purposes is optional. You may therefore decide not to provide the Data or to deny the possibility to process Data already provided: in this case, you will not be able to receive personalised commercial communications on the Owner's products, but you will still be entitled to use the services of the Site.
Rights of the data subject
In your capacity as data subject, the Controller informs you that you have the right to
-
- obtain confirmation of the existence or otherwise of your Personal Data, even if not yet registered, and that such Data be made available to you in an intelligible form;
-
- obtain an indication and, where appropriate, a copy of a) the origin and category of the Personal Data; b) the logic applied in the event of processing carried out with the aid of electronic instruments; c) the purposes and methods of processing; d) the identification details of the Data Controller and the data processors; e) the subjects or categories of subjects to whom the Personal Data may be communicated or who may become aware of it, in particular if recipients in third countries or international organisations; e) where possible, the period of retention of the Data or the criteria used to determine this period; f) the existence of an automated decision-making process and, if so, the logic used, its importance and the consequences foreseen for the data subject; g) the existence of adequate safeguards in case of transfer of the Data to a non-EU country or an international organisation;
-
- obtain, without undue delay, the updating and rectification of inaccurate Data or, where interested therein, the integration of incomplete Data
-
- obtain the deletion, transformation into an anonymous form or blocking of Data: a) unlawfully processed; b) no longer necessary in relation to the purposes for which they were collected or subsequently processed; c) in case of revocation of the consent on which the processing is based and if there is no other legal ground, d) if you object to the processing and there is no overriding legitimate reason to continue the processing; e) in case of fulfilment of a legal obligation; f) in case of Data referring to minors. The Data Controller may refuse erasure only in case of: a) exercise of the right to freedom of expression and information; b) fulfilment of a legal obligation, performance of a task carried out in the public interest or exercise of public authority; c) reasons of public health interest; d) archiving in the public interest, scientific or historical research or for statistical purposes; e) exercise of a right in court;
-
- obtain the restriction of processing in the event of: a) contestation of the accuracy of the Personal Data; b) unlawful processing by the Controller to prevent its deletion; c) exercise of a right in court; d) verification of whether the Controller's legitimate reasons prevail over those of the data subject;
-
- receive, if the processing is carried out by automatic means, without hindrance and in a structured, commonly used and readable format the Personal Data concerning you in order to transmit them to another data controller or - if technically feasible - to obtain the direct transmission by the Data Controller to another data controller
-
- object, in whole or in part: a) for legitimate reasons, to the processing of Personal Data concerning you, even if pertinent to the purpose of collection; b) to the processing of Personal Data concerning you for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communications, through the use of automated calling systems without the intervention of an operator by email and/or through traditional marketing methods by telephone and/or mail lodge a complaint with the Data Protection Authority.
-
- proporre reclamo all’Autorità Garante per la Protezione dei Dati Personali.
In the above cases, where necessary, the Data Controller will inform the third parties to whom your Personal Data is communicated of any exercise of rights by you, except in specific cases (e.g. when such fulfilment proves to be impossible or involves a manifestly disproportionate use of means compared to the right protected).
Methods of exercising rights
You may exercise your rights at any time by
sending a registered letter with acknowledgement of receipt to the Controller's address;
by sending an email to info@ducrotrosegarden.com;
By phone +39 06 60513090.
Data controller and person responsible for processing
The data controller is Ecoluxury Travel S.r.l., via d'Ascanio 8, 00186 Rome.
The internal data controller is: Enrico Ducrot. The appointed Data Protection Officer is: Angelo Adamo.
The updated list of internal and external Data Protection Officers is kept at the Data Controller's offices.
In this regard, if you require any further information or have any questions about the privacy policy of this site, please contact us by email at info@ducrotrosegarden.com