PRIVACY POLICY PURSUANT TO ART. 13 OF REGULATION (EU) 679/No. 2016

PROVINCIA DI BELLUNO, (Tax ID: 93005430256 – VAT No.: 00847010253) (hereinafter “PROVINCE”), in the person of its legal representative in office, with registered office in Belluno, Via S. Andrea, 5, and Consorzio DMO Dolomiti (Tax ID and VAT No.: 01178460257) (hereinafter “CONSORTIUM”), in the person of its legal representative in office, with registered office in Belluno (BL), Via Sant’Andrea, 5 – 32100, in their capacity as Joint Controllers of the processing pursuant to Articles 4, No. 7 and 26 of the EU Regulation No. 2016/679 (GDPR), inform you that, in accordance with Article 13 of the GDPR, your personal data described in Article 1 below will be processed for achieving the purposes described in Article 2 below.
PROVINCE and CONSORTIUM will, hereinafter, be jointly referred to only as “Joint Controllers”: in this regard, they specify that the essential content of the relevant Joint Controllership agreement for processing pursuant to Article 26, paragraph 2 of the GDPR can be easily viewed by sending a specific request to any of the contact addresses provided in Article 6 below.

1. Category of personal data to be processed.

1.1. For the purpose of pursuing the purposes described in Art. 2, the Joint Controllers collect and process your personal data pursuant to Art. 4, No. 1 of the GDPR so-called identifiers (e.g., first name, last name, e-mail address, telephone number) requested on any of the forms on this website (hereinafter “Site”).

2. Purpose of processing and its legal basis.

2.1. Your personal data will be/can be processed, by the Joint Controllers, for the following purposes, subject to obtaining your informed, free and explicit consent:

• Sending of commercial/promotional/advertising/marketing communications (including, market research), to be carried out by automated/electronic/screen-based means (e.g., e-mail; website; mobile app; social network page; newsletter) or by non-automated/traditional means (e.g., by the postal service).

In compliance with Article 13, paragraph 2, letter c) of the GDPR, the Joint Controllers inform you of your right to withdraw your consent, at any time, for the purpose described in Article 2.1. letter a), although such withdrawal shall not affect the lawfulness of the processing carried out with your consent given prior to withdrawal.
In this regard, the Joint Controllers point out that the legal basis of the purpose described in Art. 2.1. letter a) is found in Art. 6, paragraph 1, letter a) of the GDPR, and in Art. 130, paragraphs 1 and 2 of the revised Legislative Decree No. 196/2003 (Privacy Code).

A tal riguardo, i co-Titolari precisano che la base giuridica della finalità di trattamento descritta all’art. 2.1. lettera a) si rinviene nell’art. 6 paragrafo 1) lettera a) del GDPR, e nell’art. 130 commi 1) e 2) del novellato D.Lgs. n. 196/2003 (Codice Privacy). 

2.2. Your personal data shall be processed, by the Joint Controllers for achieving the following purposes:

• Responding to your request for contact and/or more information, made by completing any of the appropriate forms on our Site.

In compliance with Art. 13, paragraph 2, letter e) of the GDPR, the Joint Controllers specify that any failure to provide (even partially) your personal data, clearly indicated as required on any of the special forms found on our Site, may make it impossible for us to correctly or completely achieve the purpose of processing referred to in Art. 2.2. letter b).
In this regard, the Joint Controllers clarify that the legal basis of the processing referred to in Art. 2.2(b) is found in Art. 6, paragraph 1, letter b) of the GDPR.

3. Storage period.

3.1. In compliance with Article 13, paragraph 2, letter a) of the GDPR, the Joint Controllers inform you of the following storage periods, after which your personal data will either be deleted, destroyed or rendered anonymous: (i) for the achievement of the purpose referred to in Art. 2.1. letter a): up until you withdraw your consent given earlier for achievement of the purpose in question; (ii) for achievement of the purpose referred to in Art. 2.2. letter b): 10 years from responding to your request for contact and/or further information, which may be extended, if necessary, in order to comply with regulatory obligations (including any arising in the meantime) or to assert or defend a right, even in court.

4. Recipients.

4.1. In compliance with Art. 13, paragraph 1, letter e) of the GDPR, the Joint Controllers specify that your personal data may be disclosed, where appropriate and necessary, to one or more recipients pursuant to Art. 4, No. 9) of the GDPR, identified as follows, generally, by category: (i) for the achievement of the purpose referred to in Art. 2.1. letter a): entities authorised for processing by the Joint Controllers under Articles 4, No. 10), 29 and 32, paragraph 4 of the GDPR, even separately from each other (hereinafter “authorised delegates”); consultants or companies of various kinds that provide, however, services and/or performances (including professional ones) connected, even indirectly, to the achievement of the purpose in question (e.g., marketing companies); (ii) for the achievement of the purpose referred to in Art. 2.2. letter b): subjects authorised to process; consultants or companies of various natures that provide, however, services and/or performances (including professional) related, even indirectly, to the achievement of the purpose in question (e.g., IT companies).

5. Transfers.

5.1. The Joint Controllers specify that your personal data are stored in automated, partially automated or non-automated files belonging to or otherwise traceable, even indirectly, to the latter, and located within the European Economic Area (EEA).

6. Rights of the data subject.

6.1. In relation to your personal data, the Joint Controllers inform you of your right to exercise the following rights, possibly subject to the restrictions provided for in articles 2 undecies and 2 duodecies of the Privacy Code: right of access pursuant to Art. 15 of the GDPR: right to obtain confirmation as to whether or not personal data are being processed, as well as the information referred to in Art. 15 of the GDPR (e.g., purpose of processing, storage period); right to rectification pursuant to Art. 16 of the GDPR: right to correct, update or complete incomplete personal data; right to erasure pursuant to Art. 17 of the GDPR: right to obtain the erasure or destruction or anonymisation of personal data, where, however, the conditions listed in the same article are met; right to restriction of processing pursuant to Art. 18 of the GDPR: right with a markedly precautionary connotation, aimed at obtaining the restriction of processing where the assumptions governed by the same Art. 18 exist; right to data portability pursuant to Art. 20 of the GDPR: right to obtain personal data, provided to the Controller, in a structured, commonly used and machine-readable format (and, where required, to transmit them directly to another Controller), where the specific conditions indicated by the same article are met (e.g., legal basis of consent and/or performance of a contract; personal data provided by the data subject); right to object pursuant to Art. 21 of the GDPR: right to obtain the termination, on a permanent basis, of a specific processing of personal data; right to lodge a complaint with the Supervisory Authority (i.e., Italian Data Protection Supervisor) pursuant to Art. 77 of the GDPR: right to lodge a complaint when it is believed that the processing in question violates national and EU personal data protection legislation. 

6.2. In addition to the rights described in Art. 6.1. above, the Joint Controllers specify that, in relation to your personal data, there exists, where possible, the right to exercise, on the one hand, the (sub)right provided for in Art. 19 of the GDPR (“The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17[1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject of such recipients if the data subject so requests”), to be considered connected and related to the exercise of one or more of the rights regulated in Articles 16, 17 and 18 of the GDPR; on the other hand, the Joint Controllers point out to you that, in relation to your personal data, there subsists, where possible and conferring, the right to exercise the right provided for in Art. 22 paragraph 1) of the GDPR (“The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”), subject to the exceptions provided for in paragraph 2) below.

6.3. In compliance with Article 12, paragraph 1 of the GDPR, the Joint Controllers undertake to provide the communications referred to in Articles 15 to 22 and 34 of the GDPR in a concise, transparent, intelligible, easily accessible form and in simple and clear language: this information will be provided in writing or by other means, possibly electronic, or, at the request of the data subject, will be provided orally provided that the latter’s identity is proven by other means.

6.4. In compliance with Art. 12 paragraph 3 of the GDPR, the Joint Controllers undertake to provide information regarding the action taken regarding any request made under Art. 15 to 22 of the GDPR without undue delay and, in any case, no later than one month after receipt of the request; this period may be extended by 2 months if necessary, taking into account the complexity and number of requests (in such case, the Joint Controllers undertake to inform you of such extension and the reasons for the delay, within one month of receipt of the request).

6.5. The rights set out above (except for the right under Art. 77 of the GDPR) can be exercised by contacting us at the addresses provided in Art. 7 below.

7. Contact details.

7.1. PROVINCE may be contacted at the following address: provincia.belluno@pecveneto.it; CONSORTIUM may be contacted at the following address: segreteria@dmodolomiti.it

7.2. The Data Protection Officer (DPO) referred to in Art. 37 of the GDPR, appointed by PROVINCE, may be contacted at the following address: rpd@provincia.belluno.it; the Data Protection Officer (DPO) referred to in Art. 37 of the GDPR, appointed by CONSORTIUM, may be contacted at the following address: segreteria@dmodolomiti.it

PROVINCIA DI BELLUNO

Consorzio DMO (Destination Management Organization) Dolomiti

(in the person of their respective legal representatives in office)

Belluno, April 19, 2024.