PRIVACY POLICY

Information pursuant to Art. 13 EU Reg. 2016/679 (GDPR)
(Web Policy)

In compliance with the provisions of EU Reg. 2016/679 (European Regulation for the protection of personal data),with this information notice Borgo Ai Conti S.r.l with registered office in Florence, Via Frà D. Buonvicini no. 17, tax code, VAT number and registration number with the Register of Companies of Florence 06063480484 (hereinafter referred to as ‘Borgo Ai Conti’)- in its capacity as Data Controller – provides the necessary information regarding the processing of the personal data you provide on this site when filling out the contact form.
This information does not apply to other websites that may be consulted via links on the Owner’s domain website. Users/visitors must read this Privacy Policy carefully before submitting any personal information and/or filling in any electronic form on this site.

Pursuant to Art. 13 EU Reg. 2016/679, we therefore provide you with the following information:

DATA CONTROLLER, DATA PROCESSORS AND AUTHORISED PERSONS

The data controller, pursuant to Articles 4 and 24 of EU Reg. 2016/679 is Borgo Ai Conti S.r.l., with registered office in Florence, Via Frà D. Buonvicini no. 17, tax code, VAT number and registration number with the Register of Companies of Florence 06063480484. The Data Controller can be contacted at the following e-mail address privacy@borgoaiconti.it.
The updated list of Data Processors and Authorised Persons can be consulted at the company’s registered office.

DATA PROTECTION OFFICER (DPO)

A Data Protection Officer has not been appointed. The company does not fall within the cases envisaged by Article 37 of EU Reg. 2016/679 and, therefore, is not obliged to compulsorily appoint such a figure.

TYPE OF DATA PROCESSED

  • Browsing data (e.g. IP addresses or domain names of computers and terminals used by users);
  • Data provided by the user: identification and contact data (including that of minors), personal codes/passwords, payment data and other data provided by interested parties in the free fields;
  • Cookies and other tracking systems: technical cookies and user profiling cookies.

PURPOSE, LEGAL BASIS AND LAWFULNESS OF PROCESSING

The legal basis for the processing is the performance of a contract, a requested service or the execution of pre-contractual measures and, in the cases expressly provided for, the consent freely given by the data subject.
The company informs you that it will process the data you have communicated in compliance with the conditions of lawfulness set out in Article 6 EU Reg. 2016/679 and to the extent strictly necessary to fulfil the following purposes:

  • navigation/registration and use of services on this website;
  • to respond to any requests for information or quotes made to the data controller via the relevant contact forms or by e-mail. The optional, explicit and voluntary sending of messages via the form or to the contact addresses of the data controller entails the acquisition of the sender’s contact data, necessary to reply, as well as all the personal data included in communications and requests for services/reservations;
  • for making/modifying travel bookings (individual and group), through the website and/or contact centre;
  • to respond to any requests for information or quotations for the vehicle rental service;
  • only with prior specific and distinct consent, for marketing activities through the sending of e-mails or newsletters of an advertising nature.

RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

The data collected may be communicated to recipients, appointed pursuant to Art. 28 EU Reg. 2016/679, who will process the data in their capacity as external Data Processors and/or as natural persons acting under the authority of the Data Controller and Data Processor.
Precisely, the data may be communicated to the following entities:

  • companies that provide services for the management/maintenance of the computer system, communication networks and web platform;
  • companies in the group to which Borgo Ai Conti S.r.l. belongs or affiliates;
  • firms or companies within the scope of legal assistance and tax consultancy relationships, credit institutions, debt collection companies, professionals;
  • authorities responsible for fulfilling legal obligations and/or provisions of public bodies, upon request.

DATA TRANSFER TO A THIRD COUNTRY AND/OR INTERNATIONAL ORGANISATION

Data of a personal nature provided to the company – especially for bookings – may be transferred abroad, within or outside the European Union. The possible transfer of data may be carried out in order to execute the contract concluded between the Controller and the data subject or between the Controller and another natural person in favour of the data subject, pursuant to Art. 49, co.1, lett. b) and c) EU Reg. 2016/679.

STORAGE PERIOD OR CRITERIA USED TO DETERMINE THIS PERIOD

The processing will be carried out using computerised or manual methods and tools designed to guarantee maximum security and confidentiality, by persons specifically authorised to do so.
In compliance with the provisions of Art. 5 EU Reg. 2016/679 and the principle of minimisation, the data collected will be stored on protected computer systems or in paper form in such a way as to allow the identification of the data subjects for a period of time not exceeding the achievement of the purposes for which the personal data are collected, until consent is revoked and in any case no later than 24 months after collection.
Surfing data are not kept for more than 7 days and are deleted immediately after their aggregation. After these terms the data will be destroyed or anonymised. If for any reason you consider that the purpose of the processing (before the aforementioned time limit) has been exhausted, you must notify the company in writing, which will proceed to the immediate deletion of the data collected.

RIGHTS OF THE INTERESTED PARTIES AND HOW TO EXERCISE THEM

In your capacity as data subject, you may assert your rights as set forth in Chapter III (Articles 15-22) of EU Reg. 2016/679 by contacting the Data Controller by e-mail at privacy@borgoaiconti.it, by registered letter with return receipt – c/o the address of the company’s registered office – or by paper delivery. It should be noted that in the event that the Controller does not comply spontaneously, you have the right to lodge a complaint with the Supervisory Authority or a judicial appeal.

Your rights under EU Reg. 2016/679 are precisely as follows:

  • obtain confirmation of the existence or otherwise of personal data concerning you, even if not yet recorded, and their communication in intelligible form (right of access). In particular, the data subject has the right to access the following information (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the subjects or categories of subjects to whom the personal data may be communicated; (d) the storage period of the personal data or the criteria used to determine that period; (e) the existence of the data subject’s right to request from the controller the rectification or erasure of personal data concerning him or her or to object to the processing of personal data concerning him or her f) the right to lodge a complaint with the supervisory authority; g) information on the source of the data, if not collected from the data subject; h) the existence of an automated decision-making process, including profiling, and in such cases at least the logic used; i) the right to be informed of the safeguards in place if the personal data are transferred to a third country; l) the right to obtain a copy of the personal data undergoing processing;
  • obtain: a) rectification or, where interested therein, integration of the data (right to rectification); b) erasure of personal data concerning him/her without undue delay (right to be forgotten); c) restriction of the processing (right to restriction of processing); d) certification to the effect that the operations as described above have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this proves impossible or disproportionate;
  • the right to receive one’s own data in a structured, machine-readable format in order to reuse them for other purposes and through different services, and the right to transmit one’s own data to another Data Controller without hindrance (right to portability)
  • the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, including profiling. If the data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him/her for such purposes (right of objection);
  • the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning him/her or significantly affects him/her in a similar way
  • the right to withdraw consent at any time, without prejudice to the lawfulness of the processing based on consent given before the withdrawal, where the processing is based on Article 6(1)(a) EU Reg. or Article 9(2)(a) EU Reg;
  • in certain situations, the right to receive notices that your personal data has been breached.

METHODS OF DATA PROCESSING

The personal data you provide will be recorded, processed, managed and stored in paper form and/or with the aid of electronic computerised tools and in any case in such a way as to guarantee the security and confidentiality of the same.

NATURE OF CONFERMENT AND CONSENT

The provision of personal data for the purposes set out in point 4 is optional. Any partial or total failure to provide data will result in the partial or total impossibility of using the services offered by the Data Controller, e.g. to receive replies to requests for information forwarded. Failure to consent to the use of data for marketing activities does not prevent the use of the other services offered by the site. Any consent given may be revoked at any time in the manner set out in point 8. Consents obtained for the above-mentioned purposes are not bound to each other and the user may revoke one of them without invalidating the others.

DISCLOSURE OF DATA

The personal data collected shall in no case and for no reason be disclosed to third parties not authorised by the Data Controller and may only be shown at the request of the Judicial, Financial and Guarantor Authorities, as well as to all other subjects to whom disclosure is required by law for the fulfilment of the aforesaid purposes.