Policy on the processing of personal data and acquiring consent
The Travel Agency YOUR EVENT GROUP SRL, as processing controller, pursuant to art. 13 of the General European Regulation on the Protection of Personal Data 679/20016 (hereinafter the “GDPR”) hereby provides the following information on the processing of the personal data which you, as the data subject, have communicated to us:
a) for the organisation of a tourist package;
b) for mediation to purchase a tourist package organised by third parties;
c) for mediation to purchase individual services such as accommodation or trasport or ticketing or tourist services in general
d) for mediation to purchase additional insurance services connected to the tourist packages/services facilitated or purchased singly (medical - luggage policies; cancellation; assistance for the traveller in difficulty;
e) to fulfil the assignment related to application to be issued visas.
Processing purpose and legal basis.
Moreover, the data you provided could include some personal data defined by the GDPR and by Italian harmonising laws as “particular” (e.g. health, legal). Sensitive/particular data will be processed for purposes described below and only with your specific consent.
a) Purposes related to the contractual service.
Your personal data will be processed to fulfil obligations resulting from negotiations and from the contract to organise the tourist package. That is the mandate to facilitate the purchase of the connected tourist services or the mediation mandate to purchase single tourist services or to execute obligations resulting from all contractual obligations; including the negotiation stage indicated in the previous letters from a) to d), to enable the Travel Agency (TA) to supply the service in the best way possible, in particular:
to finalise, manage and execute the contractual relations between you and the TA;
to respond to your requests;
to send notices, related to the tourist package or services purchased or other additional and accessory services /e.g. information on the tourist services purchased; changes to contractual conditions; cancellations).
b) Legal purposes.
Your personal data will also be processed:
to fulfil legal obligations, regulations, national, community and international laws or resulting from orders issued by Authorities allowed to do so by law:
ascertain, exercise and/or defend a TA right in a dispute, even legal;
comply with fiscal and accounting obligations;
comply with obligations linked to laws on the safety and health of travellers;
comply with obligations linked to laws on the transport of goods and passengers.
c) Purposes linked to business and statistics
Your data will also be processed for purposes related or pertinent to activities performed by the TA and to process statistics and market surveys anonymously.
d) Further purposes
Moreover, if you should specifically consent, your personal data will be processed for the following purposes:
Marketing Purposes, including:
a. promotional activities of the TA and/or commercial partners, implemented using automated means (e.g. email, sms, instant messaging applications, etc.) and in non automated ways (e.g. ordinary mail, phone call with operator, etc.). In particular, the TA may use your email address, provided when the tourist packages or services are purchased, to send you information and promotional communications linked to similar services and products and offered by the TA and/or by commercial partners also without your consent, as long as you do not object to that use. The commercial partners belong to the following goods categories:
- reception activities;
- air lines /shipping lines; railway carriers; road carriers;
- travel agencies and travel agency Networks;
- profiling activities, that is the analysis of your travel preferences and market surveys in order to improve the offer of services and commercial information presented by us, making it more compliant with your interests. That activity can also take place through satisfaction questionnaires and/or the use of profiling cookies used when navigating our websites and apps. Processing for Marketing Purposes (that is both for promotional and profiling activities) may only take place with your consent.
How data is provided and the consequences of a refusal.
Providing your personal data is optional. However, without the data required for the purposes indicated in points a) and b) (related to the contractual and legal service), the service requested or part of it cannot be provided and you cannot make use of the abovementioned opportunities.
Providing the optional data will enable the TA to improve the services offered, to make them increasingly more respondent to the personal interests of its customers.
Providing sensitive/particular data is voluntary; however, without that consent the TA might not be able to fulfil some contractual obligations linked to the processing of that data.
Categories of personal data recipients.
Your data will not be circulated. Your data can be communicated, solely for the above purposes, to the following subject categories:
- personnel in the TA, as processing operators;
- to suppliers of the tourist services included in packages sold, or who provide connected or single ones purchased c/o the TA;
- insurance companies providing additional coverage and connected to the tourist packages and services purchased;
- people, companies, associations or professional firms providing services or assistance and consultancy to the TA in order to protect its rights (for example, accountants, lawyers, tax advisors, auditors, auditing or due diligence consultants, etc.);
- subjects who have the right to access your data according to laws and secondary regulations or orders issued by Authorities authorised to do so by law, including airport, port, customs and border authorities.
Transfer of personal data outside the European Union.
Your personal data may be transferred abroad to third party Companies belonging to the European Union or not, always for the above mentioned purposes.
If the data is transferred to non EU Countries which have not been attributed a European Union Adequacy decision pursuant to art. 45 and/or art. 46 of EU Reg. 2016/679, please note that it will not be possible to exercise the rights established by the Regulation with the Controller or Processing Controllers, or directly with the third parties (as an example: hoteliers, local travel services, local insurance companies, public or private health care institutes etc.). Because that data processing and/or retention obligation based on European Union standards is not foreseen by the laws of the hosting Country. For the transfer to those Countries, by signing the consent to this policy, consent is specifically given to send the data to them, well aware that it is impossible to exercise rights established by European laws.
On signing this policy, the data subject acknowledges that it knows and accepts the non recognition of adequacy by the European Commission of the personal data processing standards in Countries where the holiday is to take place and, nevertheless, asks to book and execute the journey.
Retention of personal data.
The personal data will be processed using manual and digital tools, applying logics that are strictly related to the purposes themselves. In any case, in a way that guarantees the security and confidentiality of the data itself.
The personal data will be stored for a period that does not exceed the time needed to achieve the purposes for which it was collected and then processed. The personal data will be stored for the entire duration of the contract finalised by you and for a subsequent period;
within terms established by laws in force;
within terms established by secondary laws in force that impose retention of data (for example tax declarations);
within the period needed to protect the rights of the data controller in any disputes linked to the supply of the service.
The personal data collected and processed for profiling purposes will be stored for a maximum of ten (10) years after which it will be erased automatically or permanently anonymised.
Processing Controller and Processors.
Process Controller is the Travel Agency YOUR EVENT GROUP SRL, with registered office in Milan (MI) postal code 20132, via San G. 8. de la Salle, 4/A.
Rights of the data subject.
Pursuant to arts.15 to 22 of the GDPR, at any time, also related to profiling activities, you have the right to:
- ask the controller for access to your personal data and information related to it; rectify incorrect data or integrate it if incomplete; erase personal data relating to you (if one of the conditions indicated
- in art.17 paragraph 1 of the GDPR should occur and in compliance with exceptions set forth in paragraph 3 of the same Article); restrict the processing of your personal data (if one of the hypotheses indicated in art.18, paragraph 1 of the GDPR should occur);
- request and obtain from the controller - if the legal basis of processing is the contract or consent, even if performed using automated means – your personal data in a structured format readable by an automatic device, also to communicate that data to another controller (so-called right to the portability of personal data);
- object to the processing of your personal data at any time when specific situations concerning you occur;
- revoke consent at any time, limited to the hypothesis that processing is based on your consent for one or more of the specific purposes and related to common personal data (e.g. date and place of birth or place of residence), or specific data categories (e.g. data revealing your racial origin, political opinions, religious beliefs, state of health or sex life). Processing based on consent and performed prior to consent being revoked still remains legal;
- present a complaint to a supervisory authority (Personal Data Protection authority – www.garanteprivacy.it
Providing Consent to processing
The consent of the data subject is required for the purposes in letters c), d) and in that case is optional. Not authorising the processing of data will, however, mean it is not possible to provide information. We are hereby informing the data subject that the Controller may use automated decision-making processes, including profiling, in order to provide the data subject with information, targeted offers and special discounts. The data subject may, at any time, request that the flow of information be interrupted and revoke processing consent.