PRIVACY POLICY CASCINA CORTE DELLE ROSE

Dear Customer, pursuant to Articles 13/14 of Regulation 679/2016 on the protection of individuals with regard to the processing of personal data, the undersigned, as data controller, is required to inform you, with regard to the processing of the personal data you have provided to us in the course of our business relationship, about:

a) Purpose of processing
The data collected is processed for the following purposes:
1) fulfilment of tax, accounting and civil law obligations;
2) management of the contractual relationship between the parties;
3) use of contact details provided by customers for informational or contractual purposes only;
4) presence of a video surveillance system installed for the purpose of protecting company assets.

b) Recipients of the processing
Beyond the Data Controller, within the scope of the purposes referred to in point a), the data may be communicated to public bodies or public administrations that request it in the performance of institutional functions, within the limits established by laws and regulations.
By law, the personal data of persons staying at our facility must be transmitted electronically to the Lombardy Region and the State Police.
Data concerning the economic relationship between the parties and your bank details may be communicated to credit institutions if payment by bank transfer is agreed.
The images captured by the video surveillance system are stored in the internal recording system and are kept in memory for a maximum of 48 hours. After this period, the system automatically deletes or overwrites the images.
If processing is carried out for purposes other than the fulfilment of contractual obligations or not related to the performance of economic activities, we will ask for your specific consent.

c) Processing methods
Data processing is carried out both manually and automatically. In particular, automated processing allows data to be organised according to multiple search criteria; however, no data extraction or aggregation is carried out for purposes other than those stated in the previous point, nor are any assessments made based solely on automated data processing.
Manual processing consists of collecting documents in traditional files, cards and paper archives with logic strictly related to the purposes indicated and, in any case, in such a way as to guarantee the security and confidentiality of the data.

d) Nature of data provision and consequences of refusal
The provision of personal data collected for the purposes referred to in points a.1 and a.2 is mandatory, otherwise it will be impossible to establish the contractual relationship.

e) Rights
We inform you that you have the right to request the Data Controller to access your personal data, correct it, delete it, limit its processing, and you also have the right to object to the processing of personal data and exercise the right to portability. The rights referred to in this point may be exercised as provided for in Articles 15, 16, 17, 18, 20, and 21 of EU Regulation 2016/679.
For information and clarification, you may contact the secretarial office of the Data Controller, asking to speak to the person in charge of responding to data subjects.
You have the right to lodge a complaint with the supervisory authority provided for by national law.

f) Data retention
We retain personal information for as long as necessary to fulfil the purposes for which it was collected, in accordance with this policy, and we expect that the data may be retained for a period not exceeding the requirements of the law, from the moment the contractual relationship ends, where required by law or to defend a right in court.

g) Data controller and data processor
The data controller is Ms Ilaria Grazioli, domiciled at the above address.

The Data Processor