Caorle, VENEZIA 
Privacy Policy – Newsletter
Regulation (EU) 2016/679 · Articles 13 and 14
Information on the processing of personal data
Biasuzzi S.r.l. – Divisione Turismo
Biasuzzi S.r.l. – Divisione Turismo provides this privacy notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”). The notice is organised by situation: the general part contains the information that applies to all processing operations; in the following sections, open the one that matches what you are doing (for example “If you request a quote”) to find out which data we process, for what purposes, on what legal basis, for how long and what happens if you do not provide them.
1. Data controller and joint controllership
The data controller is Biasuzzi S.r.l. – Divisione Turismo (hereinafter also the “Controller”), with registered office in Ponzano Veneto (TV), Via Morganella Ovest no. 55, who can be contacted for any matter relating to the protection of personal data at the e-mail address privacy@biasuzzispa.com.
In order to offer its customers a wider and more complete range of tourism services, Biasuzzi S.r.l. – Divisione Turismo has entered into commercial agreements with Industrial Project d.o.o., with registered office in Fažana (HR), Dragonja street no. 115 (hereinafter the “Joint Controller”), with which it shares personal data for the management of the “BiCard” loyalty programme and for marketing activities (including measuring the effectiveness of promotional communications by means of tracking pixels), profiling and customer loyalty. For these activities the two companies act as joint controllers pursuant to Article 26 GDPR (together, the “Joint Controllers”) and have entered into an agreement governing their respective roles and responsibilities towards data subjects; the essence of the agreement can be requested using the contact details above.
Each section states whether the processing is carried out by the Controller alone or by the Joint Controllers.
2. Scope of this notice
This notice describes the processing of personal data carried out through: the website www.villaggiosanfrancesco.com and its subdomains; the online forms (information request, quote request, newsletter, gift card, online check-in); direct contacts with the Controller’s staff (booking offices, reception, telephone, e-mail); the services provided during the stay (App, WiFi, BiCard programme); the systems in place to protect the security of the facilities (video surveillance and access control).
This notice does not cover third-party websites that can be reached via links on the site. The cookies and other tracking tools used by the site (name, purpose, first- or third-party provider, duration, any transfers outside the EU) are described in the Cookie Policy (www.villaggiosanfrancesco.com/cookie-policy), which can also be reached from the link at the bottom of the site, where you can change your choices at any time.
The services offered online are intended for adults. Data of minors taking part in the stay are processed exclusively as provided by parents or accompanying adults, for hospitality purposes and to comply with legal obligations.
3. Categories of personal data processed
Depending on the situation, the Controller may collect and process the following categories of personal data: personal and identification data (first and last name, gender, date and place of birth, nationality, passport or other identity document details); contact details (postal address, telephone number, e-mail address); browsing and technical data (IP address, device identifiers, data on interaction with communications); payment data (credit/debit card number or other payment details); preferred language; vehicle registration plates; photos and video footage; information on personal preferences or specific needs, including any health data provided to meet particular needs during the stay; data relating to the “BiCard” loyalty programme; employer details (for events or business stays); information on activities carried out or services requested during previous stays; data concerning family members or other travel companions.
The data are collected directly from the data subject or, in the cases indicated for the individual purposes (groups, companies, gift cards), from the person making the request on behalf of others.
4. Purposes, legal basis and retention period
Personal data are processed for the purposes listed below, organised by situation. Open the item that matches what you are doing: each one indicates the data processed, the purposes, the legal basis, the retention period and the consequences of not providing the data. Unless otherwise stated, the processing is carried out by the Controller alone.
02If you request informationContact form, e-mail, telephone, chat
Processing carried out by the Controller
What data we process
- first and last name;
- contact details (postal address, telephone number, e-mail address);
- content of the request and specific needs indicated;
- data concerning family members or other travel companions, if provided by you.
Purposes, legal basis and retention
Responding to requests: providing information on the Controller’s services and tourist facilities to users who request it and handling any subsequent exchanges.
Legitimate interest of the Controller in responding to users’ requests (Art. 6(1)(f) GDPR).
For the time needed to respond to the request and handle subsequent exchanges and, in any case, no longer than 12 months from the last communication.
Provision of data and consequences of refusal
Providing the data is necessary to receive a reply: otherwise, the Controller cannot follow up on the request.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
03If you request a quote onlineThe website’s “request a quote” form
Processing carried out by the Controller
What data we process
- first and last name;
- contact details (postal address, telephone number, e-mail address);
- facility and period of interest, group composition (number and age of participants);
- specific personal needs or requirements indicated in the request.
Purposes, legal basis and retention
Preparing the quote: drawing up the requested quote and handling pre-contractual exchanges.
Performance of pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR).
For the time needed to prepare the quote and for a further 5 years.
Promotional activities (optional): sending e-mail communications about products, services, offers and events of the Joint Controllers. What is described in the section “If you subscribe to the newsletter” applies, including the use of tracking pixels.
Consent of the data subject (Art. 6(1)(a) GDPR).
For 24 months from the last sending, unless consent is withdrawn or an objection is made earlier.
Provision of data and consequences of refusal
Providing the data required by the form is necessary: otherwise, the Controller cannot prepare the quote. Consent to promotional activities is optional: without it you will not receive commercial communications, with no consequence for the quote.
If you accept the quote and book, the section “If you request a quote or book through our offices” also applies to the data.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
04If you request a quote or book through our officesTelephone, e-mail, agencies, groups and companies
Processing carried out by the Controller
What data we process
- for the person requesting the quote and the other participants in the stay: first and last name, postal address, telephone number, e-mail address;
- bank details and payment terms;
- stay details, accommodation preferences, specific personal needs or requirements indicated in the request;
- for groups: list of participants; for companies: employer details and details of the employees or collaborators taking part.
Where the data come from
If you request a quote for a group or on behalf of a company, the data of the other participants are provided to us by you. It is your responsibility to make sure you are entitled to share them and to make this notice available to those persons.
Purposes, legal basis and retention
Sale of products and services: preparing the quote, concluding and performing the contract for the sale of the products and services offered by the Controller, communicating any circumstances relating to the order and managing payments.
Performance of a contract and of pre-contractual measures (Art. 6(1)(b) GDPR).
For the time needed to complete the booking and, thereafter, for a further 5 years from the date of the quote or of the last stay at the Controller’s facilities.
Compliance with legal obligations: fulfilment of legal obligations, in particular in civil, tax, public security matters (including reporting guests’ personal details to the competent Police Headquarters (Questura) pursuant to Art. 109 of the T.U.L.P.S.), banking and data protection matters.
Compliance with legal obligations (Art. 6(1)(c) GDPR).
For the period required by the relevant legislation; data relating to tax documents are kept for 10 years.
Provision of data and consequences of refusal
Providing the data is necessary: otherwise, the Controller cannot prepare the quote or conclude the contract.
During the stay, the section “If you stay at our facilities” applies.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
05If you buy a Gift CardThe website’s gift card form
Processing carried out by the Controller
What data we process
- of the buyer: first and last name, postal address, e-mail address, payment data (credit/debit card number or other payment details);
- of the recipient: first and last name, contact details for delivering the voucher, any personalised message.
Where the data come from
To manage the gift voucher, the Controller uses the data contained in the order, which also includes the recipient’s data. It is the responsibility of the person buying the gift card and providing the recipient’s data to make sure they are entitled to share them and to make this notice available to the recipient.
Purposes, legal basis and retention
Sale of products and services: concluding and performing the contract for the purchase of the gift card, issuing and delivering the voucher, communicating any circumstances relating to the order and managing payments.
Performance of a contract (Art. 6(1)(b) GDPR).
For the time needed to process the order and for the voucher to be used and, thereafter, for a further 10 years.
Compliance with legal obligations: fulfilment of legal obligations, in particular in tax and accounting matters.
Compliance with legal obligations (Art. 6(1)(c) GDPR).
For the period required by the relevant legislation; data relating to tax documents are kept for 10 years.
Provision of data and consequences of refusal
Providing the data required by the form is necessary: otherwise, the Controller cannot process the order.
Specific recipients
In addition to the recipients indicated in the general part: entities providing logistics and delivery services; entities providing banking and payment services; entities carrying out anti-fraud checks on payments.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
06If you create an account on the websiteRegistration to the reserved area
Processing carried out by the Controller
What data we process
- first and last name, e-mail address, password (stored in encrypted form);
- contact details and data entered in the profile;
- history of bookings and services managed through the account.
Purposes, legal basis and retention
Registration on the website: creation of the personal account, access to and use of the related services (management of bookings, saving data for subsequent purchases).
Performance of a contract (Art. 6(1)(b) GDPR).
Until the account is deleted at your request or the service ends. In any case, the account and related data are deleted after 3 years of inactivity.
Provision of data and consequences of refusal
Providing the data is necessary to create the account: otherwise, the website’s services remain available without registration, where applicable.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
07If you check in onlineBefore arriving at the facility
Processing carried out by the Controller
What data we process
- for each participant in the stay: first and last name, gender, date and place of birth, nationality, passport or other identity document details;
- postal address, telephone number, e-mail address;
- vehicle registration plate.
Purposes, legal basis and retention
Hospitality: carrying out the activities associated with check-in (verifying the booking, assigning the accommodation, preparing access devices). If you do not check in online before arrival, you may receive an SMS reminding you of this option: such messages are purely service-related, not commercial.
Performance of a contract (Art. 6(1)(b) GDPR).
For the time needed to complete the procedure; thereafter the terms indicated in the section “If you stay at our facilities” apply.
Compliance with legal obligations: fulfilment of legal obligations, including reporting guests’ personal details to the competent Police Headquarters (Questura) pursuant to Art. 109 of the T.U.L.P.S. and obligations relating to the tourist tax.
Compliance with legal obligations (Art. 6(1)(c) GDPR).
For the period required by the relevant legislation.
Provision of data and consequences of refusal
Providing the data is necessary to perform the contract and to comply with legal obligations: otherwise, check-in will be carried out on arrival at the facility, with the same data being collected.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
08If you stay at our facilitiesHospitality, services, App, events
Processing carried out by the Controller
What data we process
- first and last name, gender, date and place of birth, nationality, passport or other identity document details;
- postal address, telephone number, e-mail address, preferred language;
- payment data (credit/debit card number or other payment details);
- vehicle registration plates, photos and video footage;
- information on personal preferences or specific needs, including any health data provided to meet particular needs during the stay;
- data relating to membership of the “BiCard” loyalty programme, employer details (for events or business stays), information on activities carried out or services requested during previous stays, data concerning family members or other travel companions.
Purposes, legal basis and retention
Hospitality: carrying out the activities associated with check-in and check-out; providing recreational and entertainment activities; reception, luggage storage, parking and other requested services; handling requests connected with particular needs, including health needs; handling complaints and service reviews; SMS or telephone notifications about collecting parcels delivered to the facility and about requested interventions.
Performance of a contract (Art. 6(1)(b) GDPR). For any health data spontaneously provided for the needs of the stay: explicit consent of the data subject (Art. 9(2)(a) GDPR).
For the time needed to complete the procedure and, thereafter, for a further 5 years from the date of the last stay. Data relating to recreational and entertainment activities are kept for 30 days.
Provision of services via the App: booking and use of activities, events and services within the facility. Access credentials are sent by e-mail or handed over at check-in.
Performance of a contract (Art. 6(1)(b) GDPR).
Until the account is deleted at your request or the service ends; in any case the account is deleted after 5 years of inactivity. If the account is not activated, the related data are deleted within 30 days of the end of the stay.
Documentation of events: taking photos and videos of freely attended events held at the facilities, to make them known to the public also through the Controller’s web and social media channels. The documentation produced is not used for advertising campaigns. You can object at any time and ask for images showing you to be removed.
Legitimate interest of the Controller in publicising the initiatives held at its facilities (Art. 6(1)(f) GDPR).
For the duration of the event and for the subsequent period useful for documenting it.
Fighting health emergencies: compliance with epidemic prevention regulations, where applicable.
Compliance with legal obligations (Art. 6(1)(c) GDPR; Art. 9(2)(i) GDPR).
Unless otherwise provided by law, for 15 days from collection.
Provision of data and consequences of refusal
Providing the data for purposes A and B is necessary for the performance of the contract: otherwise, the Controller cannot provide the requested services. Processing C and D do not require consent; you may object to processing C at any time.
The sections “If you enter our facilities”, “If you use the WiFi”, “If you join the BiCard programme” and “In any case: legal obligations and protection of rights” also apply.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
09If you enter our facilitiesAccess control and video surveillance (guests, visitors, suppliers)
Processing carried out by the Controller
What data we process
- images recorded by the video surveillance systems;
- vehicle registration plates detected by automatic reading systems;
- identifiers of the electronic wristbands or other access devices given to guests, with date and time of entry and exit.
Purposes, legal basis and retention
Access control: ensuring that only authorised persons and vehicles enter the facilities and verifying the presence of persons or vehicles in the event of damage or emergencies, also by means of automatic number plate recognition systems and electronic wristbands.
Legitimate interest of the Controller in preventing unauthorised persons and vehicles from entering and in knowing who is present in the event of emergencies or claims for damages (Art. 6(1)(f) GDPR).
The data are deleted by the start of the season following that of the stay.
Video surveillance: protecting the safety of persons and property within the facilities. Areas under video surveillance are indicated by appropriate signs.
Legitimate interest of the Controller in protecting the safety of persons and property at its facilities (Art. 6(1)(f) GDPR).
For 72 hours from recording, unless requested by the judicial or police authorities or needed to protect the Controller’s rights in court.
Provision of data and consequences of refusal
The processing is necessary to access the facilities and does not require consent. You may object on grounds relating to your particular situation.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
10If you use the facilities’ WiFiWiFi network for guests
Processing carried out by the Controller
What data we process
- data automatically collected by the system for the operation of the service: MAC address, IP address, device name, identifier of the user who logged in, parameters relating to the device’s operating system and IT environment;
- date and time of connections.
Purposes, legal basis and retention
Connection to the WiFi network: enabling and managing users’ connection to the WiFi network.
Performance of the contract relating to the WiFi service (Art. 6(1)(b) GDPR).
For 6 months from the date of the last access to the network.
Compliance with legal obligations: handling requests from the judicial and police authorities.
Compliance with legal obligations (Art. 6(1)(c) GDPR).
For 6 months from the date of the last access, without prejudice to any extensions needed to comply with orders of the Authorities.
Provision of data and consequences of refusal
The processing is necessary to use the service: without it, the Controller cannot provide the connection. WiFi data are not used for marketing purposes.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
11If you join the BiCard loyalty programmePoints collection and discount programme
Processing carried out by the Joint Controllers (Biasuzzi S.r.l. – Divisione Turismo and Industrial Project d.o.o.)
What data we process
- personal data and contact details;
- card code and personal account credentials;
- purchases and stays at the Joint Controllers’ facilities, points and discounts accrued.
Purposes, legal basis and retention
Management of the “BiCard” programme: technical and administrative management of the discount programme set up for customers, in accordance with the rules available in the dedicated section of the website. The credentials for managing the personal account are sent by e-mail.
Performance of a contract (acceptance of the programme rules) (Art. 6(1)(b) GDPR).
For 5 years from the date of the first purchase of products and services offered by the Joint Controllers.
Provision of data and consequences of refusal
Providing the data is necessary to join the programme: otherwise, it is not possible to benefit from the discounts.
The programme is managed by Biasuzzi S.r.l. – Divisione Turismo and Industrial Project d.o.o. as Joint Controllers: the essence of the joint controllership agreement can be requested using the contact details indicated in the general part.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
12If you subscribe to the newsletter or consent to marketingPromotional e-mail communications, tracking pixels, consent management
Processing carried out by the Joint Controllers (Biasuzzi S.r.l. – Divisione Turismo and Industrial Project d.o.o.)
What data we process
- first and last name, e-mail address;
- information on interaction with the communications sent (opening of the message, clicks on links, technical data of the device), collected through tracking pixels;
- date, time and method of giving and withdrawing consent.
Purposes, legal basis and retention
Promotional activities: sending e-mail communications containing information on products, services, offers and events of the Joint Controllers (newsletter).
Consent of the data subject (Art. 6(1)(a) GDPR).
For 24 months from the last sending, unless consent is withdrawn or an objection is made earlier.
Measuring the effectiveness of communications (tracking pixels): promotional communications may contain tracking tools (tracking pixels) capable of detecting the opening of the message, some technical information about the device and interaction with the communication, in order to measure the effectiveness of campaigns and optimise their content and frequency. Consent to receive promotional communications also covers this processing. You retain the right to withdraw at any time either your entire marketing consent or only your consent to tracking, in the latter case continuing to receive communications without tracking.
Consent of the data subject (Art. 6(1)(a) GDPR), included in the marketing consent and separately revocable.
Data collected through tracking pixels are deleted 24 months after collection.
Consent and withdrawal management: verifying that subscription takes place with confirmed consent (double opt-in) and recording withdrawals in an exclusion list (blacklist), to avoid sending further communications to those who do not want them.
Legitimate interest of the Joint Controllers in collecting validly given consents and keeping track of withdrawals (Art. 6(1)(f) GDPR).
Double opt-in data for 1 month from registration; data kept in the blacklist for 3 years from withdrawal.
Provision of data and consequences of refusal
Consent is optional and may be refused or withdrawn at any time, with the sole consequence of not receiving promotional communications. To withdraw consent, simply use the link at the bottom of each e-mail or write to privacy@biasuzzispa.com; you can also withdraw only your consent to tracking at the same address.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
13If you have already been our guestCommunications on services similar to those purchased (so-called soft spam)
Processing carried out by the Controller
What data we process
- e-mail address provided in the context of the contract;
- products and services purchased.
Purposes, legal basis and retention
Communications on similar services: sending by e-mail satisfaction questionnaires and communications about the Controller’s products and services similar to those purchased, which may be of interest to guests. Communications are selected on the basis of the products and services purchased; no further profiling is carried out without your consent.
Legitimate interest of the Controller in informing its customers about the services offered and improving them (Art. 130(4) of Italian Legislative Decree 196/2003 (Privacy Code); Art. 6(1)(f) GDPR).
For a maximum period of 6 months from the end of the stay.
Provision of data and consequences of refusal
The processing does not require consent, but you can object at any time, when the address is collected or on the occasion of each communication, via the link at the bottom of the e-mail or by writing to privacy@biasuzzispa.com: the only consequence is that you will no longer receive communications of this kind.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
14If you consent to profilingPersonalised offers based on your preferences
Processing carried out by the Joint Controllers (Biasuzzi S.r.l. – Divisione Turismo and Industrial Project d.o.o.)
What data we process
- personal data and contact details;
- information on previous purchases and services used, preferences expressed;
- where you have consented to tracking, information on interaction with the communications received.
Purposes, legal basis and retention
Personalisation of commercial offers: analysis, also by electronic means, of specific consumer behaviour and habits, in order to improve the services provided and to send commercial proposals of real interest.
Consent of the data subject (Art. 6(1)(a) GDPR).
For 12 months from the recording of the data or, if earlier, until consent is withdrawn.
How the analysis works
The Joint Controllers analyse, also with automated tools, the products and services requested (for example the facility chosen, period, type of accommodation, additional services) to identify tastes, preferences, habits and needs and offer consistent proposals. This activity serves solely to choose which communications to send and does not produce decisions with legal or similarly significant effects on the person.
Provision of data and consequences of refusal
Consent is optional and can be withdrawn at any time, with the sole consequence of not receiving communications personalised on the basis of your purchases and preferences.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
15In any case: legal obligations and protection of rightsPurposes common to all situations
Processing carried out by the Controller
What data we process
- the data collected in the situations described in the other sections, to the extent necessary for the following purposes.
Purposes, legal basis and retention
Compliance with legal obligations: fulfilment of legal obligations, in particular in civil, tax, accounting, public security matters (including reporting guests’ personal details to the competent Police Headquarters (Questura) pursuant to Art. 109 of the T.U.L.P.S.), banking and data protection matters, including handling requests from the Authorities.
Compliance with legal obligations (Art. 6(1)(c) GDPR).
For the period required by the relevant legislation; data relating to tax documents are kept for 10 years.
Disputes and prevention of offences: asserting or defending the Controller’s rights, also in court, and detecting or preventing fraud, crimes and offences.
Legitimate interest of the Controller in establishing, exercising or defending a right (Art. 6(1)(f) GDPR; Art. 9(2)(f) GDPR).
For the period necessary for the purpose, in accordance with the limitation periods of the rights; in the event of a dispute, for 10 years from its settlement.
Provision of data and consequences of refusal
The processing is necessary to comply with legal obligations or to protect the Controller’s rights: it is not possible to object to the former; you may object to processing B on grounds relating to your particular situation.
Statements and consents
Where consent is required, it will be requested and documented through forms, double opt-in, e-mail and dedicated web pages.
5. Processing methods and security
The data are processed with electronic and paper-based tools by personnel authorised and instructed by the Controller. The Controller and the Joint Controller have adopted appropriate technical and organisational measures to prevent the loss of data, unlawful or incorrect use thereof and unauthorised access.
The Controller does not take decisions based solely on automated processing that produce legal effects or similarly significantly affect the person. Any automated analysis of preferences, aimed solely at selecting the communications to be sent, is described in the sections “If you have already been our guest” and “If you consent to profiling”.
6. Categories of data recipients
For the purposes described in the individual sections, the Controller may disclose the data, for its own needs or to comply with legal obligations, to the following categories of recipients:
- public authorities, supervisory and control bodies, public security authorities;
- IT service providers (hosting, cloud computing, booking platforms, e-mail marketing and consent management platforms);
- entities providing customer service and contact centre activities;
- entertainment companies and other service providers within the accommodation facilities;
- entities providing logistics and delivery services;
- professionals or companies providing the Controller with legal, tax, accounting, economic-financial, technical-organisational, data processing, communication and marketing services;
- entities providing banking, financial, insurance and debt collection services;
- entities carrying out anti-fraud checks on payments;
- the Joint Controller, limited to the activities carried out under joint controllership.
Entities processing data on behalf of the Controller are appointed as data processors pursuant to Art. 28 GDPR; the updated list can be requested using the Controller’s contact details. The data are not disseminated, except as indicated in the section “If you stay at our facilities” for the documentation of events. Since the data are also processed with IT tools, they may be visible to those providing support and maintenance for such systems.
7. Transfer of data to third countries
Some of the Controller’s suppliers, in particular IT and e-mail marketing service providers, are based in the United States of America. Transfers take place exclusively on the basis of adequacy decisions of the European Commission (for recipients certified under the EU-U.S. Data Privacy Framework) or of the standard contractual clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR, supplemented where necessary by additional measures. A copy of the safeguards adopted can be requested using the Controller’s contact details.
8. Rights of data subjects
In relation to the personal data processed, you may exercise the following rights at any time:
- Access (Art. 15 GDPR): to know whether your data are being processed and to obtain access to them and a copy;
- Rectification (Art. 16 GDPR): to obtain the correction of inaccurate data and the completion of incomplete data;
- Erasure (Art. 17 GDPR), restriction (Art. 18 GDPR) and portability (Art. 20 GDPR), in the cases provided for by law;
- Objection (Art. 21 GDPR): to object, on grounds relating to your particular situation, to processing based on legitimate interest; to object at any time, without having to give reasons, to processing for direct marketing purposes;
- Withdrawal of consent (Art. 7 GDPR), at any time and without affecting the lawfulness of processing already carried out; withdrawal may also concern only tracking through tracking pixels, while continuing to receive promotional communications without tracking tools;
- Joint controllership (Art. 26 GDPR): to know the essence of the joint controllership agreement concluded between Biasuzzi S.r.l. – Divisione Turismo and Industrial Project d.o.o.
To exercise your rights, you can write to privacy@biasuzzispa.com or, by ordinary mail, to the Controller’s registered office indicated in point 1. At the same address you can request further details on the processing (for example the legitimate interest balancing test or the list of data processors).
If you believe that the processing infringes data protection legislation, you may lodge a complaint with the competent Supervisory Authority (Art. 77 GDPR): the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it), or the Authority of the Member State in which you habitually reside, work or where the alleged infringement took place.
9. Updates to this notice
The Controller may update this notice to adapt it to changes in legislation or in the processing. The current version, with the date of the last update, is published on the website; in the event of significant changes, data subjects will be informed by appropriate means.
Privacy policy on data processing – Newsletter
1. Data controller
The Data Controller is the company Biasuzzi S.p.A. – Divisione Turismo (hereinafter also referred to as “Data Controller”), which has its registered office in Ponzano Veneto (TV) in Via Morganella Ovest 55 and which can be contacted for matters relating to the protection of personal data at the email address privacy@biasuzzispa.com. The Data Controller has entered into commercial agreements with the company Industrial Project d.o.o. (hereinafter also referred to as the “Joint Data Controller”), which is based in Fazana (HR) in Dragonja street 115, with which it shares personal data for the purpose of sales promotion and customer loyalty activities. In carrying out the above-mentioned activities, Biasuzzi S.p.A. – Divisione Turismo and Industrial Project d.o.o. act as Joint Data Controllers (in the following Privacy Policy, when the term “Joint Data Controllers” is used, we will therefore refer jointly to Biasuzzi S.p.A. – Divisione Turismo and Industrial Project d.o.o.). In compliance with the provisions of Art. 26 of the GDPR, the two companies have entered into an agreement in order to regulate their respective roles and responsibilities towards the data subjects, an extract of which can be requested from Biasuzzi S.p.A. – Divisione Turismo at the addresses indicated above.
2. Categories of personal data processed
We will process the following categories of personal data: first name, last name and email address.
3. Purposes of the processing, legal basis and storage period
Personal data will be processed by the Joint Data Controllers for the purposes and under the conditions set out below.
Purposes
Advertising activities aimed at users: for sending email communications containing information on the data controller’s products, services and special offers.
Legal basis
Consent of the data subject.
Data storage period
For twenty-four months after the last sending, unless the user revokes or exercises the right to object at an earlier time.
4. Consent and possible refusal
Data processing is based on the customer’s consent, who is free to grant or refuse it and possibly revoke it at any time, with the only consequence, in the event of refusal or revocation, of not receiving periodic newsletter communications.
5. Processing methods
Joint Data Controllers have adopted specific security measures to prevent the loss of personal data, unlawful or incorrect use thereof and unauthorised access thereto.
6. Categories of recipients of personal data
For the fulfilment of the purposes indicated at point 5, the Data Controller may communicate the data collected to the categories of subjects indicated below: providers of IT services, such as internet services and cloud computing; subjects that perform customer service activities; professional offices and other subjects that provide assistance, consultancy and communication services. Where necessary, data recipients will be designated as data controllers, in accordance with the provisions of Article 28 of the GDPR.
7. Transfer of data to third countries
Personal data processed by the Joint Data Controllers may be transferred to other companies based in the United States of America (USA) solely for the purposes indicated above. Said transfer will take place exclusively following the signing between Biasuzzi S.p.A. – Divisione Turismo and the companies receiving the data of standard contractual clauses (S.C.C.) adopted by the Commission of the European Union (Art. 46, paragraph II, points C and D of the GDPR).
8. Rights of data subjects
In relation to the personal data provided, data subjects have the right at any time to request: confirmation of whether or not personal data concerning them is being processed and, if so, to obtain access to the data and a copy thereof (Art. 15 of the GDPR); the rectification of any inaccurate personal data or the integration of incomplete data (Art. 16 of the GDPR); in the cases specifically provided for by the legislation, the cancellation of the data (Art. 17 of the GDPR), the limitation of their processing (Art. 18 of the GDPR) and the opposition to their processing following the revocation of consent (Art. 21 of the GDPR). In order to exercise these rights, data subjects may send their requests by email to the Data Controller at privacy@biasuzzispa.com. Alternatively, data subjects may use the postal addresses indicated in point 1 of this Privacy Policy. If data subjects consider that their rights under data protection legislation have been infringed, they may lodge a complaint with the Supervisory Authority (www.garanteprivacy.it) pursuant to and for the purposes of Article 77 of the GDPR.
Call us