Privacy policy

This Privacy Notice applies exclusively to this website.

Privacy Notice pursuant to Legislative Decree 30 June 2003 No. 196 and the European Regulation on the protection of personal data No. 2016/679 (GDPR), as amended.

The EU Regulation 2016/679 (GDPR “General Data Protection Regulation” – General Data Protection Regulation) provides for the protection of individuals and other subjects with regard to the processing of personal data, which must be based on the principles of fairness, lawfulness, transparency, and the protection of confidentiality and personal rights.

The confidentiality, protection and security of the data processed are of particular importance; for this reason, Cesenatico Bellavita – Consorzio di Promozione Turistica pays the utmost attention to safeguarding your personal data. When we collect, process and store personal data, we comply with all legal requirements, in particular the provisions of the EU General Data Protection Regulation (Regulation (EU) 2016/679 “GDPR”) and all applicable personal data protection laws.

 

DATA CONTROLLER

Cesenatico Bellavita – Consortium for Tourist Promotion (“Cesenatico Bellavita”), headquartered in Cesenatico (FC), Via G. Mazzini, 93, 47042, VAT/Tax Code. 04000200404

Contacts: Tel. 0547-679389  Email: info@cesenaticobellavita.it

You may submit any questions or requests regarding your personal data and privacy compliance using the contact details provided in this notice.

We inform you that the Personal Data you provide via this website will be processed, in particular, by Hospitality Marketing S.r.l. (marketing agency) and Area38 by Hospitality Factory S.r.l. (web agency) as Data Processors (“Processor”) on behalf of Cesenatico Bellavita.

Hospitality Marketing S.r.l.: via Macanno, 38/G – 47923 Rimini (RN), VAT No. 03437890407
Contacts: +39 0541/307408

Area38 by Hospitality Factory S.r.l.: via Macanno, 38/Q -47923- Rimini (RN), VAT no. 03884020409
Contacts: +39 0541/307585

For further details, see point 9) of this notice.

An agreement for Joint Data Control regarding the processing of personal data has been established between Cesenatico Bellavita and the associated facilities (hotels) featured on this website; you can review it by clicking on this link

 

DATA SUBJECTS

The categories of Data Subjects are web users who make use of the services provided within this website.

 

LEGAL BASIS FOR PROCESSING

The personal data managed within this website are processed on the following legal bases:

– Performance of contractual/pre-contractual measures
– Legal obligations
– Legitimate interest
– Consent

 

PURPOSES OF THE DATA PROCESSING

The personal data collected by this website are processed for the following purposes:

A – Request for quote and information: the personal data provided by filling in the request for quote, offers, quotation and information request form (for example, via email, telephone contact, etc.), are processed in order to fulfil and/or respond to the request. The data is mandatory; without it, we will not be able to process your request. The legal basis for this data processing is contractual and pre-contractual obligation; legitimate interest; consent, in the event that special/sensitive data is provided, such as, for example, health data, data relating to health status, ethnic or religious origin, etc.

These types of special categories of data may also be processed for:

to comply with legal obligations, regulations, national and EU legislation, and with orders issued by authorities legally empowered to do so;
to establish, exercise and/or defend a right in court;
to become aware of health-related data such as, for example, food intolerances, allergies, temporary or permanent disabilities of the customer and/or their family members and travel companions.

Should the data subject communicate, via contact forms (or other free-text fields), portals, or through telephone contact or email address, special categories of data (e.g. data relating to health, etc.) pursuant to Art. 9 of Regulation (EU) 2016/679, such declarations constitute a free, specific, informed, and unambiguous positive action by which the data subject gives their explicit consent for their personal data to be processed.

If the user should, for any reason, provide personal data of third parties, they must ensure that these parties are aware of and have been duly informed of this privacy notice and have consented to the relevant processing.

B – Commercial/marketing: subject to consent, the personal data entered on this website are also collected for commercial and marketing purposes through the sending of emails/newsletters, in order to keep you updated on news, initiatives, events, promotions, offers and other promotional material. The newsletter service is carried out using dedicated software (for example, Sendinblue SAS). The legal basis is consent; processing will continue until consent is withdrawn by the data subject. This website features a portal through which affiliated establishments (hotels) individually access (after entering their credentials) the contact database of those who have made a request for that specific establishment and have given consent for their data to be processed for marketing purposes.

C – Links to external platforms: this website may contain links that redirect to external platforms (such as links to social media, or links that redirect to the websites of associated organisations); where this is the case, such processing enables publications, interactions, reviews and comments to be made via social networks or other external platforms. Any interactions and information acquired by this website are in any case subject to the user’s privacy settings for each social network with which they have an account. Once the user leaves this website, they are redirected to a third-party website or application and are no longer subject to this privacy notice.

D – Administrative/tax purposes: the personal data collected by this website are intended for carrying out all administrative, accounting and tax activities related to the requested service. The legal basis for this processing is a legal obligation.

 

Consent given may be withdrawn at any time using methods similar to those provided for its granting, by contacting us at the addresses indicated in this notice, without prejudice to the lawfulness of processing based on consent before its withdrawal.

The provision of data for purposes A) and D) is mandatory; failure to provide personal data will prevent Cesenatico Bellavita from delivering the requested services and fulfilling the requests of the data subjects. The provision of consent for purposes B) and C) is not mandatory; failure to provide consent will not affect the other requested services.

 

DATA GATHERED

The use of this website is restricted to visitors who are at least 18 years old; such visitors expressly approve this Privacy Policy with regard to the methods and purposes described herein.

The categories of data that may be collected are as follows:

Common personal data (for example, first name, surname, date and place of birth, email address, telephone number, residential/home address)
Special/sensitive personal data (for example, health data, ethnic and religious origin, and other special categories of data)

It is possible that certain data, in addition to those required for the operation of the site, may be used solely to obtain anonymous statistical information about the use of the site and to check that it is functioning correctly; specifically, reference can be made to the information regarding Cookies.

In the event that the data subject communicates, via contact forms (or other free-text fields), portals, or through telephone contact or email address, special categories of data pursuant to Art. 9 of Regulation (EU) 2016/679, such declarations constitute a free, specific, informed expression of will, and an unequivocal positive action by which the data subject gives their explicit consent for their personal data to be processed.

If the user should, for any reason, provide personal data of third parties, they must ensure that these parties are aware of and have been properly informed about this privacy notice and have consented to the relevant processing.

AUTOMATED DECISION-MAKING PROCESS AND PROFILING

The Data Controller informs that the personal data provided by users for the purposes indicated in point 4) of this notice will not be processed by means of a fully automated decision-making process; however, they may be subject to profiling in relation to the choices made and the type of service requested.

With regard to the processing of browsing data on this website, please refer to the specific Cookie Policy.

 

METHOD OF TREATMENT

The processing of personal data will be carried out by acquiring documents in electronic form (including by entering data into software/management systems) and/or paper form, using IT and manual methods that ensure the confidentiality and security of the data. The data are collected in accordance with the relevant regulations, with particular attention to the security measures provided by the GDPR (Art. 32), using procedures designed to guarantee the security and confidentiality of the data; for this purpose, data processing is carried out by consistently applying technical and organisational security measures to protect against the risks of loss, unlawful or improper use, and any unauthorised access. The data will be processed exclusively for the required purposes; they will be stored within offices, cabinets/shelves, within email inboxes, and also electronically archived on IT devices (PCs, notebooks, etc.).

 

DATA RETENTION PERIOD

Personal data will be retained for no longer than is necessary to achieve the purposes for which they were collected and subsequently processed; they may also be processed for a further period:

until the completion of the purposes under consideration and also subsequently in order to fulfil all legal obligations, as well as retained within the time limits established by current legislation;
within the time limits established by legislation, including secondary legislation, which require data retention (for example, retention relating to tax/administrative data);
for the period necessary to protect the rights of the data controller in the event of any disputes related to the provision of the service;
Data processed on the basis of informed consent will be retained until such consent is withdrawn or the data subject exercises their rights; for example, marketing/newsletter processing will continue until consent is withdrawn by the data subject.

Any consent given may be withdrawn at any time using methods similar to those provided for its granting, by contacting the Data Controller through the contact details indicated in this notice, without prejudice to the lawfulness of processing based on consent before its withdrawal.

 

DATA COMMUNICATION

The data provided will be processed under the authority of the Data Controller and by personnel/collaborators appointed by the Data Controller; by Data Processors and/or other Sub-Processors selected based on specific regulatory requirements. By way of example, the data may be processed by:

– owner/partners;
– authorised personnel/collaborators appointed by the Data Controller;
– duly appointed data processors and sub-processors;
– web agency (Area38 by Hospitality Factory S.r.l);
– marketing agency (Hospitality Marketing S.r.l.);
– software provider for sending marketing emails (Sendinblue SAS);
– affiliated accommodation facilities, such as hotels and residences, which receive specific requests from interested parties via the contacts and forms on this website;
– third-party service providers acting on behalf of the Data Controller, for example IT service providers, technical IT support, system administrator, mailing managers, logistics service providers;
– entities collaborating with the Data Controller as independent Data Controllers;
– all those entities – including Public Authorities, Public Bodies, Supervisory and Control Bodies – who have access to the data by virtue of legal provisions, Regulations or EU Legislation, within the limits set by such Rules;
– companies belonging to or associated with Cesenatico Bellavita;
– administrative and judicial authorities and bodies by virtue of legal obligations;

The list of Data Processors can be provided upon request by contacting Cesenatico Bellavita using the contact details provided in this privacy notice.

 

USER RIGHTS

Pursuant to EU Regulation 679/2016 (GDPR) and national legislation, the User may, in accordance with the procedures and within the limits set out by the applicable legislation, exercise the following rights (Articles 15 to 22 of the Reg. EU 679/2016):

– request confirmation of the existence of personal data concerning them (right of access);
– know its origin;
– receive intelligible communication thereof;
– obtain information about the logic, methods and purposes of the processing;
– request the updating, rectification, restriction, supplementation, erasure, transformation into anonymous form, or blocking of data processed unlawfully, including data no longer necessary for the purposes for which it was collected;
– in cases of processing based on consent, receive, at the sole cost of any support, their data provided to the Data Controller, in a structured, machine-readable format commonly used by an electronic device;
– the right to lodge a complaint with the Supervisory Authority:

Data Protection Authority:
https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524;
– as well as, more generally, exercise all rights granted to them under current legislation.

Should the data subject, in any case, wish to object to the processing of their data for newsletter/marketing purposes, as well as withdraw the consent given, they may do so at any time by clicking on the link at the bottom of the email or by contacting the Controller indicated in this notice, without prejudice to the lawfulness of processing based on consent given prior to withdrawal.

Requests can be made by contacting the following details:
Tel. 0547-679389 – Email: info@cesenaticobellavita.it

 

DATA TRANSFER

Your data may also be transferred to countries outside the EU; however, should such a transfer be necessary, the data will be transferred on the basis of an Adequacy Decision or through Standard Contractual Clauses (EU Standard Contractual Clauses, EU SCCs), as well as via Binding Corporate Rules.

In the absence of an adequacy decision or appropriate safeguards, or binding corporate rules, the transfer of personal data to a third country or an international organisation is permitted as provided for in Article 49 of the GDPR (General Data Protection Regulation).

The transfer of data to non-EU countries may occur as a result of the use of Google services; use of social media; mailing services; external data processors.

 

CHANGES TO THIS PRIVACY NOTICE

The Data Controller reserves the right to update this Privacy Notice at any time.

Changes and clarifications will take effect immediately upon their publication on the website; should any material changes be made to this policy, you will be informed in this section.

To check for any changes or updates, we recommend that users review this policy periodically.