Privacy policy referred to in the former Legislative Decree 196/03 and EU Regulation no. 679/2016
Under the terms provided for in Article 13 of the Legislative Decree 196/03 and following the entry into force of EU Regulation no. 679/2016, in accordance with the provisions of Article 13 of the aforementioned European Regulation, we would like to inform you of the following.
Purpose of the processing
Your personal data, freely communicated and acquired by us due to the activity carried out by
Tourist Consortium of Pistoia City
Adua Avenue, 128 Pistoia
VAT registration number: 0141660047
Will be treated lawfully and fairly for the following purposes.
The processed data are updated, relevant, complete and not exceeding the purposes listed above for which they are collected and subsequently processed.
Methods of processing
The data will be processed, in compliance with the necessary security and confidentiality, through the following methods: collection of data from the interested party, collection and recorded for specific, explicit and legitimate purposes, used in further processing operations in terms compatible with these purposes, processing carried out with the help of electronic and automated tools (collection of data electronically, directly at the interested party).
Legal basis for processing
The legal basis for the processing of your personal data is based on the registration to the web portal . Legitimate interests pursued by the Data Controller:
The legitimate interests pursued by the Data Controller in the processing of data is given by having to respect and honor the contractual obligations signed between the parties. Pursuant to Article 6 the lawfulness of the processing is based on the consent manifestly expressed by the interested party, documented in writing. Mandatory or optional nature of the provision of data and consequences of any refusal to respond: the nature of the provision of data by you is mandatory so that the data controller can provide the services requested. In case of refusal it will therefore be impossible to complete the registration process and the System Owner will not be able to fulfil the contractual obligations.
Communication of data to third parties
Your personal data will be processed by the Data Controller, by the Data Processors appointed by him and by the persons in charge of the processing strictly authorized. Your personal data are not subject to dissemination.
Shelf-life
Your personal data will be stored for no. 10 years after the termination of the service/supply relationship of the product at the computer files owned by the Tourist Consortium for the City of Pistoia.
Intention of the Data Controller to process personal data
The Data Controller will not transfer your personal data to a third country or to an international organization.
Data Controller and Data Processor
The data controller is the Tourist Consortium for the City of Pistoia. The interested party may at any time exercise the rights reserved to him, pursuant to Article 7 of which the full text is provided: Article 7 Legislative Decree no. 196/2003 and Article 15 EU Regulation 679/2016 – Right of access to personal data and other rights – “The interested party has the right to obtain confirmation of the existence or otherwise of personal data concerning him, even if not yet registered, and their communication in intelligible form. The interested party has the right to obtain the indication: of the origin of personal data; of the purposes and methods of processing; of the logic applied in case of processing carried out with the help of electronic tools; the identification details of the data controller, the manager and the representative designated pursuant to Article 5 paragraph 2; of the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them in their capacity as designated representative in the territory of the State, as managers or persons in charge. The interested party has the right to obtain: the updating, rectification, or, when there is interest, the integration of data; the cancellation, transformation into anonymous form or the blocking of data processed in violation of the law, including those which need to be stored in relation to the purposes for which the data were collected or subsequently processed; the attestation that the operations of which to letter a. and b. have been brought to knowledge, also regarding their content, of those to whom the data have been communicated or diffused, except where such fulfilment is found to be impossible or involves the use of means manifestly disproportionate to the right protected. The interested party has the right to object in whole or in part: for legitimate reasons to the processing of personal data concerning him, even if pertinent to the purpose of collection; the processing of personal data concerning him for the purpose of sending advertising material or direct sales or for carrying out market research or commercial communication”. In particular, the data subject may at any time request the Data Controller access to personal data and the rectification or cancellation of the same or the restriction of the processing concerning him or her or to oppose to their processing, in addition to the right to data portability. The data subject has the right to withdraw consent at any time without prejudice to the lawfulness of the processing based on the consent given before the revocation and has the right to lodge a complaint with a supervisory authority. The exercise of rights can be exercised by writing to the e-mail address.