European Regulation EU/2016/679 (hereinafter the “GDPR”) lays down rules on the protection of natural persons with regard to the processing of personal data. In compliance with the principle of transparency set out in article 5 of the Regulations, Trentino Marketing S.r.l. is providing you with information, as required in articles 13 and 14 of the GDPR, for the processing of your data collected as regards the purpose of requesting information. 

Identity and contact data of the Data Controller
Trentino Marketing S.r.l.
Via Romagnosi, n. 11 - 38122 Trento
privacy@trentinomarketing.org

Contact data of the Data Protection Officer
Trentino Sviluppo S.p.A.
Via Zeni, n. 8 - 38068 Rovereto
dpo@trentinosviluppo.it

1. Categories of personal data processed
   Within the scope of the purposes of the processing indicated in paragraph 2 above, only personal data will be processed concerning: name and surname, email, city and country, mobile number.
2. Purposes of data processing and legitimate basis
   2.1. Your personal data are processed without your consent for the following purposes:
            a.    to transfer of personal data as per para. 1 to the subjects indicated in Provincial Law No. 8 of 2002 under articles 9 and 11 quater and/or accommodation for the purpose of requesting information on www.visittrentino.info. Such entities will become autonomous Data Controllers of the data.
   The legal basis of processing is article 6, letter b) GDPR: the performance of a contract to which the data subject is a party or the performance of pre-contractual measures undertaken at the request of the data subject.
   Supplying the data is not mandatory, but it is a pre-requisite for accessing the service itself. Therefore, should you not supply your personal data, you will not be able to use the service.
            b.    Your personal data also will be processed to comply with a legal obligation to which the data controller is subject; the legal basis for the processing is article 6 c) of the GDPR.
   2.2. Your personal data are also processed with your consent for to allow us to send you our newsletter regarding, for example, events, promotions and in general for tourist marketing activities within the Trentino area and to send you the best holiday proposals.
   The legal basis of processing is article 6 a) of the GDPR: the data subject has given consent to the processing of his or her personal data for one or more specific purposes. Supplying the data is not mandatory, but it is a pre-requisite for receiving the newsletter. Therefore, should you not give your personal data, you will not receive our newsletter.
   You may withdraw your consent at any time by unsubscribing from the newsletter.
3. Categories of recipients of personal data
   As regards the purposes indicated in the paragraph 2 above, the personal data you will send us will be made accessible to internal employees authorised to process data within the limits of their duties, to external suppliers duly nominated Data Processors, and to all subjects that have the legal right to receive them or to other subjects for which specific authorisation is achieved in the event of request.
   The updated list of the Processors can be consulted by request to privacy@trentinomarketing.org with the subject line: requesting information – processors list.
4. Processing methods
   Your personal data shall be processed as indicated in article 4, 2) of the GDPR – whether or not by automated means – such as: collection, recording, organization, structuring, updating, storage, adaptation or alteration, retrieval and analysis, consultation, use, disclosure by transmission, alignment, interconnection, restriction, erasure or destruction. In any case, the logical and physical safety and, more in general, the confidentiality, integrity and availability of the personal data processed shall be guaranteed by putting in place all of the necessary and appropriate technical and organizational measures.
5. Disclosure and profiling
   Your personal data shall not be disclosed or used for profiling.
6. Storage and transfer of personal data abroad
   The handling and storage of the personal data occurs in clouds and/or on servers located within the European Union and owned and/or available to the Data Processor and/or to third party enterprises, all duly nominated Data Processors. 
7. Retention period of personal data

   The personal data collected for the purposes indicated in section 2 above will be processed and retained as follows:
   2.1. They will be processed and retained for the duration of the collaboration relationship;
   2.2. Until the withdrawal of your consent but, in any case, no later than 48 months from the last access to the profile or modification made.
   After these periods, the data will be deleted unless European or national regulations provide for their retention.

8. Rights that can be exercised
   In compliance with articles 15 -21 of the GDPR, you may exercise the rights indicated therein and in particular:
   • Right of access (article 15, GDPR): to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, receive the information regarding, in particular: purposes of the processing, categories of personal data processed and storage period, and recipients to whom the data may be disclosed;
   • Right to rectification (article 16, GDPR): to obtain, without undue delay, the rectification of inaccurate personal data concerning you, as well as the right to have incomplete personal data completed;
   • Right to erasure (article 17, GDPR): to obtain, without undue delay, the erasure of the personal data concerning you, in the cases laid down in the GDPR;
   • Right to restriction (article 18, GDPR): to obtain the restriction of the processing of the data from the Data Controller in the cases laid down in the GDPR;
   • You have the right to receive the names of the recipients of your data, if you so request (article 19, GDPR): to the extent that this does not prove impossible or involve a disproportionate effort, the Data Controller shall notify each of the possible recipients to whom personal data have been transmitted of the rectification, dele-tion, or restriction of processing carried out;
   • Right to portability (article 20, GDPR): to receive the personal data concerning you and that has been provided to the Data Controller in a structured, commonly used and machine-readable format, as well as to send it to another Data Controller without hindrance, in the cases laid down in the GDPR;
   • Right to objection (article 21, GDPR): ·     to object to the processing of your personal data, including profiling, at any time for reasons connected to your specific situation. The data controller no longer processes the personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of a legal claim. You may object without giving any reason if your data is processed for marketing purposes, including profiling related to the latter.

If the processing is carried out on the basis of consent given by the data subject, he/she may withdraw his/her consent at any time, without prejudice to the lawfulness of the processing carried out before the withdrawal.

In the case of processing of the data referred to in paragraph 2, you may exercise these rights by simply sending a request to Trentino Marketing according to the procedure available at the following link https://www.trentinomarketing.org/it/privacy.

In addition, you have the right to lodge a complaint with the Data Protection Supervisor, and to appeal to the competent judicial authority (article 77, GDPR).