Information about our Data Protection Policy

Dear Data subject,

Our company takes your personal data seriously and guarantees to protect data we collect from any risk of violation.

This policy statement, in accordance with guidelines published in EU regulation 679/2016, (hereinafter refered to as 'the GDPR') describes the type of data and scope for which it is collected and processed.

Who we are

Roberto Petrucci uses and is responsible for certain personal information about you.

Any questions regarding protection of your data should be directed to the following email address: info@cortonaprivatetours.com

General data collection

We collect the following data:

• Navigation data
  Data pertaining to data subject navigation on our website, such as IP address, browser type and version, log, etc.
• Personal data
  Personal data such as name, address, telephone, email address, etc.
• Information provided by the data subject
  Our website may contain contact forms where the data subject requests contact or assistance. We request you refrain from entering any sensitive personal data listed in article 9 of the EU regulation.

The company refrains from requesting sensitive personal data listed in GDPR article 9 concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a physical person, data concerning health or data concerning the data subject's sexual orientation.

Transferring personal data outside of the EU

No personal data will be transferred outside of the EU by us.

SCOPE

Data provided by the data subject enables the company to offer content and services chosen and/or purchased, to manage and process requests for information, provide assistance and comply with laws the company is subject to. Under no circumstances will the company sell personal data to third parties or use it for any unnamed scope.

Personal data is processed for:

• Online registration and requests for information and/or to be contacted
  Personal data is used to register data subject, give data subject requested information and/or brochures and for any other such contact.
• Contract data management
  Personal data may be used to initiate purchases of products or services, process an order, erogate a service, production, or shipping of a purchased product, invoicing and payment processing, complaints and/or customer service claims, and any other such obligation deriving from the contract.
• Security of personal data
  As outlined in article 49 del GDPR the company processes data subject's personal data across suppliers (third parties or partners), insofar as is strictly and proportionately necessary to guarantee network and information security. The company will promptly inform data subject when a data violation occurs as outlined in article 33 of the GDPR concerning notification of a personal data breach.
• Profiling
  f data subject gives consent, we use personal data to analyze or predict personal aspects marketing purposes per data subject's personal preferences to fit their profile and needs.

Lawfulness of processing

• Registration and contact and/or information request
  Processing shall be lawful whereby the data subject has given consent to the processing of personal data for registration, request for information, contact, and/or brochures and where processing is necessary for compliance with a legal obligation.
• Performance of a contract
  Processing shall be lawful whereby it is necessary for the performance of a contract and in compliance with a legal obligation.
• Systems security
  Processing shall be lawful where it is in compliance with legal obligations provided for in article 32 of the GDPR, and to protect the vital interests of company assets and systems security.
• Profiling
  Processing shall be lawful where data subject consent for profiling is given specifically as outlined in article 6 of the GDPR, and which may be revoked by the data subject at any time.

Data Storage

Personal data is processed in accordance with principles pertaining to privacy, fairness, necessity, pertinence, lawfulness, and transparency imposed upon in the GDPR for the amount of time necessary to exercise the scope for which data is collected and in any case, not longer than 10 years from initial collection for the Service or, in the case of a Service/product purchase, the amount of time necessary for completing the purchase.

Data subject rights

Right of access by the data subject are outlined in article 15 of the GDPR and at any time, the data subject may:

• receive confirmation whether personal data is being processed and access information regarding the purposes of processing or disclosure recipients, and access that information;
• update, modify, and/or correct personal data;
• request erasure, pseudonymisation, blockage for unlawful violation or restriction;
• oppose processing for legitimate reasons, including profiling;
• oppose personal data processing for the scope of sales or advertising or market research or any commercial communications;
• revoke consent, where given, without prejudice for lawful processing based on prior consent;
• receive a copy of personal data and request they be transferred to another environment.

In the event there is a violation of data subject rights, in accordance with art. 77 of the GDPR the data subject may contact the supervisory controller or file for judicial remedy pursuant to article 78.