Privacy Policy - Serendipity eng

PRIVACY & COOKIES POLICY

THIS POLICY DESCRIBES THE INFORMATION WE PROCESS TO PROVIDE OUR SERVICES OR TO ENSURE MAXIMUM SERVICE TO OUR CUSTOMERS.

INTRODUCTION

As required by European Union Regulation no. 679/2016 (“GDPR”), the following information is provided to the user (“Data Subject”) regarding the processing of their personal data.

WHO WE ARE

Data Controller

The Data Controller and Data Processor is Boutique Country House Serendipity di Gonzalez Maderid Elisa – Località San Rocco, 11 – 61044 Cantiano (PU)
VAT No. 03464260540 – Email: serendipitycantiano@pec.it

Data Processor

The Data Controller has appointed a Data Processor, who can be contacted here:

Email: info@serendipitycantiano.it

Who can view the data?

Third parties appointed by us to manage some of our activities may have access to and view the data contained on the website. These individuals are internal staff of agencies and companies tasked with carrying out certain activities on our behalf (for example, web agencies, freelancers, or e-commerce managers).

These individuals may not, however, process this data unless we have a specific written mandate.

WHAT DATA WE PROCESS

Personal identification data

First name, last name, physical address, nationality, province and municipality of residence, landline and/or mobile telephone number, tax code, email address(es), social network contact information

Social media information for companies, associations, public entities, and freelancers

Company name or VAT number, VAT number, tax code, registered office and administrative address, First and last name of contact persons, Address(es), contact person’s email address, telephone number(s), social network contact information

Traceable traffic data

Logs, IP address of origin, general statistical data, social network connection data

THE DATA CONTROLLER DOES NOT REQUIRE THE DATA SUBJECT TO PROVIDE SO-CALLED DATA. “SPECIAL DATA”, THAT IS, IN ACCORDANCE WITH THE PROVISIONS OF THE GDPR (ART. 9), PERSONAL DATA REVEALING RACIAL OR ETHNIC ORIGIN, POLITICAL OPINIONS, RELIGIOUS OR PHILOSOPHICAL CONVICTIONS, OR TRADE UNION MEMBERSHIP, AS WELL AS GENETIC DATA, BIOMETRIC DATA INTENDED TO UNIQUELY IDENTIFY A NATURAL PERSON, DATA CONCERNING HEALTH OR A PERSON’S SEX LIFE OR SEXUAL ORIENTATION.

WHY WE NEED YOUR DATA

TO PROCESS YOUR REGISTRATION REQUEST AND THE PROVISION CONTRACT FOR THE SELECTED SERVICE AND/OR PURCHASED PRODUCT

In this case, we process the data subject’s personal data to add you to our customer list and to comply with legal obligations.

This data will also be used to send invoices or other documents necessary for the proper performance of our role as a service or product supplier.

This data will be entered into our management database and will be used solely and exclusively to maintain our collaborative relationship with the data subject.

MANAGE AND EXERCISE CONTACT REQUESTS SUBMITTED BY THE DATA SUBJECT AND PROVIDE ASSISTANCE

This data is processed at your explicit request and consent to respond to your questions. This data is processed only following a request from the Data Subject.

The legal basis for this processing is the fulfillment of the services related to the registration request, information and contact requests, and/or the sending of informational materials, and compliance with legal obligations.

PROVIDE SUGGESTIONS ON ADDITIONAL ACTIVITIES RELATING TO SERVICES/PRODUCTS SIMILAR OR COMPLEMENTARY TO THOSE PURCHASED BY THE DATA SUBJECT (ART. 47 GDPR)

The data controller, even without the Data Subject’s explicit consent, may use the contact information provided only for Services/Products similar to those being sold, unless the Data Subject explicitly objects.

PROVIDE SUGGESTIONS FOR ADDITIONAL ACTIVITIES DIFFERENT FROM THE SERVICES/PRODUCTS PURCHASED

In this case, the data will be processed only if the Data Subject has provided consent.
Processing may occur through automated email, text message, or telephone communication systems.

DATA PROVIDED BY THE DATA SUBJECT WILL NOT BE DISCLOSED TO THIRD PARTIES.

IDENTIFICATION DATA NOT PROVIDED (ART. 13 GDPR)

If the Data Subject does not provide the identifying data necessary to process requests received or the completed form, the Data Controller will not be able to process the data related to the management of the requested services and/or the contract and the related Services/Products, nor to perform the obligations that depend on them.

CONSENT DENIED FOR USES OTHER THAN THOSE RELATED TO THE MANAGEMENT OF THE CONTRACTUAL RELATIONSHIP

If the data subject does not consent to the use of their data for the purpose of receiving information or specific information on promotional activities, their consent remains valid for the performance of those activities necessary for the management of the contractual relationship.

HOW WE COLLECT DATA

THROUGH AUTOMATIC DATA COLLECTION SYSTEMS THAT TRACK INFORMATION ON OUR WEBSITE NAVIGATION IN AN AGGREGATE WAY.

This allows us to perform statistics and analyze all those interested in our services. This information may also be collected through software or plugins external to our website
(so-called “Cookies” –> See point 9 of this document)

THROUGH FORMS THAT SITE USERS CAN FREELY CHOOSE TO LEAVE IN ORDER TO BE CONTACTED OR INFORMED

THROUGH FORMS NECESSARY FOR OUR E-COMMERCE TO BEST IMPROVE OUR ONLINE SALES ACTIVITY

THROUGH ONE-TO-ONE MEETINGS AT TRADE FAIRS, EVENTS, INITIATIVES, OR CONTACTS

Explicit consent is requested in all these methods. In the case of offline data collection, consent will be countersigned; in the case of online data collection, consent is given when the “Submit” link (or similar words) is clicked.

WHERE THE DATA IS STORED

The data being processed is stored in two ways:

Data collected through our website will be entered into a database on the website and on servers provided by the maintainer of our web services.

Data collected offline will be stored in dedicated folders located at our company’s registered office or operating site.

HOW DATA IS PROTECTED

Data collected from the website

The data we collect through the website is protected by passwords reserved for website administrators only.

The website has two protection systems.

The first is a website encryption system using the https protocol.

The second is a website protection system integrated into the website itself, which:

Prevents access by any unauthorized person

Blocks access if passwords are considered “banned” because they are considered “hacked.”

All data is stored on servers owned by our maintainer.

Data collected offline

All data collected offline is stored in dedicated folders located within the company headquarters.

The company is always manned during designated working hours, while during closing hours it remains closed and accessible only with a password. The folder in which the data is stored is anonymized.

HOW LONG DO WE RETAIN DATA?

In general, the Data Subject’s personal data will be retained for as long as necessary for the legitimate purposes for which it was collected, unless there are legitimate and specific requests for deletion.

Specifically, it will be retained for 20 years for personal data collected for the performance of activities related to or similar to the services or products sold.

However, for data provided to the Data Controller for commercial promotion purposes for services other than those already purchased by the Data Subject, for which the Data Subject initially provided consent, it will be retained for 48 months, unless the consent is revoked.

Regardless of the Data Subject’s decision to remove their personal data, they will in any case be retained in accordance with the terms established by applicable laws and/or national regulations, for the sole purpose of ensuring the specific requirements of certain Services (for example, but not limited to, Certified Email, Digital Signature, and Electronic Storage – see the relevant section).

Furthermore, personal data will in any case be retained to fulfill obligations (e.g., tax and accounting) that remain in place even after the termination of the contract (Article 2220 of the Italian Civil Code); for these purposes, the Data Controller will retain only the data necessary to fulfill them.

This does not affect the cases in which rights arising from the contract and/or registration must be asserted in court, in which case the Data Subject’s personal data, exclusively those necessary for these purposes, will be processed for the time strictly necessary to achieve those purposes.

DATA SUBJECT RIGHTS

The data subject has the right to obtain from the data controller, upon request, the data held by the Data Controller regarding the data subject (so-called right to data portability).

Furthermore, the data subject may request deletion from any database or other data storage location, or the correction of any such data, at any time and without having to provide any justification for such request.

For any information or needs, the data subject may contact the Data Controller or the Data Processor directly at the contact details provided in section 1 of this document.

The maximum timeframe established by law for the Data Controller to process such requests is one month.

The data subject may also lodge a complaint with the competent supervisory authority in Italy (the Italian Data Protection Authority), or with the authority performing its duties and exercising its powers in the Member State where the GDPR violation occurred.

COOKIES AND SERVICES PROVIDED BY THIRD PARTIES

Cookies are data sent from the website and stored by the internet browser on the user’s computer or other device (e.g., tablet or mobile phone). The interested party can manage and disable cookies directly from their browser.

Below you can find the cookie management methods for the most popular browsers:

Internet Explorer: http://windows.microsoft.com/it-IT/internet-explorer/delete-manage-cookies

Google Chrome: https://support.google.com/chrome/answer/95647

Mozilla Firefox: http://support.mozilla.org/it/kb/Gestione%20dei%20cookie

Opera: http://help.opera.com/Windows/10.00/it/cookies.html

Safari: https://support.apple.com/kb/PH19255

Technical cookies and third-party cookies may be installed on our website or its subdomains.

In any case, users can manage, or request the general deactivation or deletion of cookies, by changing their browser settings. This deactivation, however, may slow down or prevent access to some parts of the site.

THREE TYPES OF COOKIES

TECHNICAL COOKIES – THIRD-PARTY COOKIES – PROFILING COOKIES – TECHNICAL COOKIES

These are all cookies that enable the safe and efficient use of our website.

Technical cookies are essential for the proper functioning of our website and are used to allow users to navigate normally and take advantage of the advanced services available on our website.

The technical cookies used are divided into session cookies, which are stored exclusively for the duration of browsing until the browser is closed, and persistent cookies, which are stored in the user’s device memory until they expire or are deleted by the user.

THIRD-PARTY COOKIES

Some of the services listed below collect aggregate statistics and may not require the User’s consent or may be managed directly by the Data Controller—depending on how they are described—without the help of third parties.

If the tools listed below include services managed by third parties, these may—in addition to what is specified and even without the Data Controller’s knowledge—track Users. For detailed information, please consult the privacy policies of the listed services.

LINKS TO THE FACEBOOK SOCIAL MEDIA PAGE (FACEBOOK, INC.)

The “Like” button and Facebook social widgets are services allowing interaction with the Facebook social network, provided by Facebook, Inc.