Privacy Policy of the Website and Cookie Policy
ex Art. 13 of EU Regulation 2016/679 ("Regulation" or "GDPR")
Data Controller and Contact Information
Naar Tour Operator S.p.A., with registered office in Via M. Pagano 40, 20145 Milan, Tel. +39024855851, e-mail privacy@naar.com (hereinafter "Data Controller"), informs you that your personal data provided during the booking process, such as your personal details and contact information, will be processed for the following purposes;
Data Protection Officer
The Data Controller has also appointed a Data Protection Officer ("DPO"), as required by the GDPR, with duties of supervision, vigilance, and specialist advice in the field of privacy, who can be contacted for any support at the following e-mail address: dpo@naar.com;
Navigation Data
Categories of Data Processed
The computer systems and software procedures used to operate the Website acquire, during their normal operation, some Personal Data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of computers used by users connecting to the Website, URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user's computer environment. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the Website and to check its correct functioning (see the paragraph on cookies below), to identify anomalies and/or abuses, and is deleted immediately after processing. The data could be used by the competent authorities to ascertain responsibility in the event of hypothetical computer crimes against the site.
Data Provided Voluntarily by the Data Subject
Apart from what is specified for navigation data, the user is free to provide the personal data contained in any request forms on the website (e.g., to activate newsletters, free registration, purchase, etc.). Failure to provide such data may make it impossible to provide the service. When using some Services of the Website, the processing of Personal Data of third parties sent by you to Naar may occur. With respect to these cases, you act as an independent data controller, assuming all the obligations and responsibilities of the law. In this sense, you grant the widest indemnity with respect to any dispute, claim, request for compensation for damage from processing, etc., that should be received by Naar from third parties whose Personal Data have been processed through your use of the Website's functions in violation of the applicable personal data protection regulations. In any case, if you provide or otherwise process Personal Data of third parties when using the Website, you guarantee from now on - assuming all related responsibility - that this particular processing hypothesis is based on an adequate legal basis pursuant to art. 6 of the Regulation which legitimizes the processing of the information in question.
Reserved Area for Travel Agencies
Personal data and contact details relating to travel agents who intend to register their agency in the area reserved for professional operators, including authentication credentials for access.
Purposes of Processing and Legal Bases
The processing of data, collected directly from the user, voluntarily or through the automatic functions of the Website (including the installation of cookies on the user's client or terminal device), has the purpose of providing and supplementing the services provided by the Website, including the area reserved for professional operators, including the management of interactions between the Website and the user, the improvement of navigation and use of the Website with the aim of improving the user's experience in using the Website itself.
The data processed by means of the cookies described above with the specific technical purpose related to the functionality of this website, and the processing therefore has as its legal basis the legitimate interest of the data controller (art. 6.1.f GDPR) to ensure the regular operation of the website and to guarantee browsing security.
The legal basis for the processing relating to the area reserved for professional operators is the execution of pre-contractual measures adopted at the request of the same (art. 6.1.b of the Regulation) as the processing is necessary for the provision of the Service.
The provision of Personal Data for these purposes is mandatory to activate the Services provided by the Website.
Recipients of Personal Data
Where strictly necessary for the pursuit of the aforementioned purposes, your personal data may also be disclosed to:
• Employees and collaborators of the Data Controller, in their capacity as persons authorized to process data (or so-called "data processors");
• Third parties who carry out outsourcing activities on behalf of the Data Controller, in their capacity as data processors;
• Judicial or supervisory authorities, administrations, bodies, and public bodies;
• Companies and professional operators that provide electronic data processing and software and IT consulting services, as well as the management of information services related to the management of hosting and the website;
Data Transfer to Third Countries
Your personal data will be processed by the Data Controller within the territory of the European Union.
Should it be necessary, for technical and/or operational reasons, to make use of parties located outside the European Union, or should it be necessary to transfer some of the collected data to technical systems and cloud-managed services located outside the European Union area, the processing will be regulated in accordance with the provisions of Chapter V of the Regulation and authorized based on specific decisions of the European Union. All necessary precautions will therefore be adopted to ensure the most complete protection of personal data by basing such transfer: a) on adequacy decisions of the third countries recipient expressed by the European Commission; b) on adequate guarantees expressed by the third-party recipient pursuant to art. 46 of the Regulation; c) on the adoption of binding corporate rules.
Data Retention Period
Your personal data will be kept for the period of time strictly necessary for the pursuit of the specific purposes indicated above in compliance with civil and fiscal retention obligations and the limits provided for by law. In some cases, it is not possible to specify in advance the retention periods for personal data. In these cases, we will determine the retention period based on the following criteria: necessity, legal obligation, our legitimate interest.
Rights of the Data Subject
Data subjects have the right to ask the data controller for access to personal data and the rectification or erasure of the same or the restriction of the processing concerning them or to object to their processing (articles 15 and 21 of the GDPR).
Data subjects, when the conditions are met, also have the right to lodge a complaint with the Supervisory Authority (Garante) according to the procedures provided for.
More specifically, at any time, the following rights may be exercised:
• Access to personal data: obtain confirmation as to whether or not personal data concerning you is being processed, and, if so, access to the following information: the purposes, the categories of data, the recipients, the retention period, the right to request rectification or erasure or restriction of processing or opposition to the processing itself, as well as the existence of an automated decision-making process including profiling and the logic used;
• Request rectification or erasure of the same or restriction of processing concerning you; "restriction" means the marking of stored data with the aim of limiting its processing in the future;
• Objection to processing: object for reasons related to your particular situation to the processing of data for the performance of a task carried out in the public interest or for the pursuit of the legitimate interests of the Data Controllers;
• Data portability: in the case of automated processing carried out on the basis of consent or in execution of a contract, to receive the data concerning you in a structured, commonly used, and machine-readable format;
• Withdrawal of consent to processing for marketing purposes, both direct and indirect, market research and profiling; the exercise of this right does not in any way prejudice the lawfulness of the processing carried out before the withdrawal;
• Lodge a complaint pursuant to art. 77 GDPR to the competent Supervisory Authority based on your habitual residence, place of work, or place of infringement of your rights; for Italy, the competent authority is the Garante per la protezione dei dati personali, which can be contacted using the contact details provided on the website http://www.garanteprivacy.it.
The aforementioned rights may be exercised by sending a specific request to the Data Controller or the DPO through the contact channels indicated in this information notice.
Requests relating to the exercise of your rights will be processed without undue delay and, in any case, within one month of the request; only in cases of particular complexity and the number of requests may this period be extended by a further 2 (two) months.
