Official tourism portal of Valdichiana Aretina
Information · Visit Valdichiana Aretina

Privacy Policy

Information on the processing of personal data

Information on the processing of personal data

This Privacy Policy aims to describe the management methods of the website www.visitvaldichiana.it (hereinafter: the "Site") with reference to the processing of users' personal data.

This is a general notice provided in compliance with Article 13 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the "Regulation") to all users who consult and, more generally, interact with the services provided through the Site by the Municipality of Cortona – Piazza della Repubblica, 13 Cortona (AR) (hereinafter: the "Data Controller" or "Entity").

This notice will illustrate the purposes and methods by which the Data Controller may collect and process your personal data, which categories of data are subject to processing, what the rights of data subjects are, and how they can be exercised.

The notice is provided exclusively for this Site; therefore, the Data Controller assumes no responsibility regarding other websites that may be consulted through hypertext links present on this Site. Data processing will take place by means of IT and manual tools.

By using this Site, users accept this notice and are therefore invited to read it before providing any personal information of any kind.

Data Controller

Municipality of Cortona - Piazza della Repubblica 13, 52044 – Cortona (AR)

Contact details of the Data Protection Officer

The Data Protection Officer of the Municipality of Cortona can be contacted at the following details:

Dr. Marco Marcellini (Data Protection Officer)

Telephone: 0575 62524, 339 2758634

Email: privacy@next20.it PEC: marco.marcellini@postecert.it

Types of data processed

Browsing data

The IT systems and software procedures used to operate this website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. These are information that are not collected in order to be associated with identified data subjects, but which by their very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numeric code indicating the status of the server's response (success, error, etc.), and other parameters relating to the operating system and the user's IT environment.

This data is used solely to obtain anonymous statistical information on the use of the site and to check that it functions correctly, and is deleted immediately after processing. The data may be used to ascertain liability in the event of hypothetical computer crimes against the site.

Some personal data whose transmission is implicit in the use of internet communication protocols (e.g., personal data acquired through site access logs) is collected by Web Analytics Italia. This data is processed for the technical management of the website and for the collection of analytical data on its traffic. For more information, please consult the specific WAI privacy notice at the address https://webanalytics.italia.it/privacy.

Data voluntarily provided by the user

Without prejudice to the above specified in relation to browsing data, the entity will collect the personal data that the user may provide through the Site in order to submit requests by e-mail, to subscribe to any newsletters, and it will collect first name, last name, e-mail address, etc. only if the user wishes to get in touch with the Data Controller or make use of the services offered on this website through the dedicated forms.

Through the Site, the Data Controller will not collect sensitive data or data belonging to the special categories referred to in Article 9 of Regulation (EU) 2016/679, nor data relating to criminal convictions or offences.

The processing of data provided by the user will take place in compliance with the purposes and methods indicated in this notice and in the specific notices made available from time to time.

Processing methods

Personal data are processed by manual and computer tools in order to achieve the purposes for which they were collected. Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorized access.

Data processing will be carried out by personnel directly under the authority of the Data Controller and/or by natural or legal persons specifically identified by the latter as persons in charge, appropriately appointed processors and their authorized persons.

Legal basis and purposes of processing for the provision of the requested services

The personal data provided pursuant to the paragraph "Data voluntarily provided by the user" will be processed by the Data Controller exclusively to respond to requests and to provide the services the user intends to use. The data will be processed only for these purposes. The provision of such data is necessary.

Recipients of processing

The recipients of processing are all users of the website or of the services made available through it, under the terms of applicable laws and as defined by Regulation (EU) 2016/679.

Optional provision of data

The user is free to decide whether or not to provide their personal data to the Data Controller through this website and/or the services connected to it. Failure to provide the data may make it impossible for the Data Controller to provide the requested service.

Communication and transfer of data

The data provided will in no case be disseminated or communicated to third parties, except for those entities whose right to access the data is recognized by provisions of law or orders of the authorities, as well as entities, including external and/or foreign ones, which the Data Controller uses to carry out instrumental and/or ancillary activities, including providers of software solutions, web applications and storage services.

Further information may be obtained by the data subject by sending a request to the Data Controller. For the purposes described, the Data Controller may communicate some of the personal data collected to third parties, who will process the personal data in their capacity as Data Processors.

The list of Data Processors may be requested from the Data Controller by writing to

Comune di Cortona – Piazza della Repubblica 13, 52044 – Cortona (AR)

Duration of processing

The data will be retained in order to follow up on the requests and services chosen, requests made through the Site. The data will be retained for the period strictly necessary.

Rights of data subjects

Please note that, in accordance with current legislation, the data subject has the following rights:

to request and obtain information about the existence of their data held by the Data Controller and access to such data; for data processed by automated systems, to request the communication of their data and/or transfer to another controller; to request and obtain the modification and/or correction of their personal data if they believe it is inaccurate or incomplete; to request and obtain the deletion – and/or restriction of processing – of their personal data if the data or information is not necessary – or no longer necessary – for the purposes stated above, after the retention period indicated in the preceding paragraph has expired.

In particular, you are granted the following rights: Art. 15 – "Right of access by the data subject", Art. 16 – "Right to rectification", Art. 17 – "Right to erasure", Art. 18 – "Right to restriction of processing", Art. 20 – "Right to data portability" of EU Regulation 2016/679, within the limits and under the conditions set out in Art. 12 of the Regulation itself.

Such requests may be addressed to Comune di Cortona - Piazza della Repubblica 13, 52044 – Cortona (AR). You are also informed that, under the applicable legislation, you may lodge any complaints concerning the processing of your personal data with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

Cookies

Depending on the web browser in use, the user may disable or selectively accept the use of cookies. In this case, browsing may not be equally smooth, some site functions may not be available, and some web pages may not display correctly.

The site uses Web Analytics Italia (WAI) cookies to collect information, in aggregated form, on the number of users and how they use the site, solely for the purpose of producing anonymous statistics and verifying the site's correct functioning.

For more information, please consult the specific WAI privacy notice at the following address: https://webanalytics.italia.it/privacy.

You can access the full cookie notice via the link available at the bottom of this site or by clicking here.

Types of Data collected

Among the Personal Data collected by this website, either independently or through third parties, are: postal code, email, province, geographic location, Usage Data, Cookies and various types of Data indicated here by way of example, but not exhaustively. Full details on each type of data collected are provided in the dedicated sections of this privacy policy or through specific information texts displayed before the data is collected.

Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically during browsing.

Unless otherwise specified, all requested Data is mandatory. Where certain Data is indicated as optional, Users are free to refrain from communicating such Data, without any consequence on the availability of the Service or its operation.

Users who have doubts about which Data is mandatory are encouraged to contact the Owner.

Any use of tracking tools by this website or by the owners of third-party services used, unless otherwise specified, is aimed at providing the Service requested by the User, in addition to the further purposes described in this document.

The User assumes responsibility for the Personal Data of third parties obtained, published or shared and guarantees that they have the right to communicate or disseminate it, releasing the Owner from any liability towards third parties.

Methods of processing

The Data Controller adopts appropriate security measures aimed at preventing unauthorized access, disclosure, modification or destruction of Personal Data. The processing is carried out by means of IT and/or telematic tools, with organizational methods and logic strictly related to the purposes indicated.

In addition to the Data Controller, in some cases, other parties involved in the management of this website (administrative, sales, marketing, legal staff, system administrators) or external parties (such as third-party technical service providers, postal couriers, hosting providers, IT companies, communication agencies) may have access to the Data, and may also be appointed as Data Processors by the Data Controller, if necessary.

The updated list of Data Processors may always be requested from the Data Controller.

Legal basis of processing

The Data Controller processes the user's data solely following a specific registration of the user within an area reserved for services offered by the controller.

The data are processed exclusively following a request and/or subscription to a service provided by the controller, which may also be based on a legitimate interest of the controller, a public interest, or simply the performance of a service directed to the user.

Place

The Data are processed at the operational offices of the Data Controller and in any other place where the parties involved in the processing are located. For further information, contact the Data Controller.

The User's Personal Data may be transferred to a country other than the one in which the User is located. To obtain further information about the place of processing, the User may refer to the section on the details of the processing of Personal Data.

The User has the right to obtain information regarding the legal basis for transferring Data outside the European Union or to an international organization governed by public international law or established by two or more countries, such as the UN, as well as regarding the security measures adopted by the Owner to protect the Data.

If any of the transfers described above take place, the User may refer to the respective sections of this document or request information from the Owner by contacting them at the details provided at the beginning.

Data transfer abroad

Data is not transferred to third countries outside the European Economic Area.

Retention period

Data is processed and retained for the time required by the purposes for which it was collected. Therefore:

  • Personal Data collected for purposes related to the performance of a contract between the Owner and the User will be retained until such contract has been fully performed.
  • Personal Data collected for purposes related to the Data Controller's legitimate interest will be retained until that interest has been fulfilled. The User may obtain further information regarding the legitimate interest pursued by the Data Controller in the relevant sections of this document or by contacting the Data Controller.

Where the processing is based on the User's consent, the Data Controller may retain Personal Data for longer until such consent is withdrawn. In addition, the Data Controller may be obliged to retain Personal Data for a longer period in compliance with a legal obligation or upon order of an authority.

At the end of the retention period, Personal Data will be deleted. Therefore, upon expiry of such period, the rights of access, erasure, rectification and the right to data portability can no longer be exercised.

Purposes of Processing the Data collected

The User's Data is collected to enable the Data Controller to provide its Services, as well as for the following purposes: registration and authentication limited to specific services offered by the site, contacting the User, location-based interactions, statistics, displaying content from external platforms, payment sessions, infrastructure monitoring, handling support requests and contact.

To obtain further detailed information on the purposes of processing and on the Personal Data actually relevant to each purpose, the User may refer to the relevant sections of this document.

Data Processors

The Organization may rely on third parties to carry out activities and related processing of personal data for which it is the Data Controller. In accordance with applicable regulations, such parties ensure levels of experience, capability and reliability sufficient to guarantee compliance with the current provisions on processing, including the aspect of data security.

The Organization formalizes instructions, tasks and obligations for such third parties by appointing them as "Data Processors". Such parties are subject to periodic checks in order to verify that the levels of guarantee recorded at the time of the initial assignment are maintained.

User Rights

Users may exercise certain rights with respect to the Data processed by the Data Controller.

In particular, the User has the rights listed below.

  • Withdraw consent at any time. The User may withdraw the consent previously given to the processing of their Personal Data.
  • Object to the processing of their Data. The User may object to the processing of their Data when it takes place on a legal basis other than consent. Further details on the right to object are indicated in the section below.
  • Access your Data. The User has the right to obtain information about the Data processed by the Data Controller, certain aspects of the processing, and to receive a copy of the Data processed.
  • Verify and request rectification. The User may verify the accuracy of their Data and request its updating or correction.
  • Obtain restriction of processing. When certain conditions apply, the User may request restriction of the processing of their Data. In such case, the Data Controller will not process the Data for any purpose other than storing it.
  • Obtain erasure or removal of your Personal Data. When certain conditions apply, the User may request that the Data Controller erase their Data.
  • Receive your Data or have it transferred to another controller. The User has the right to receive their Data in a structured, commonly used and machine-readable format and, where technically feasible, to obtain its transfer without hindrance to another controller. This provision applies when the Data is processed by automated means and the processing is based on the User's consent, on a contract to which the User is a party, or on pre-contractual measures related to it.
  • Lodge a complaint. The User may lodge a complaint with the competent personal data protection supervisory authority or take legal action.

Details on the right to object

When Personal Data are processed in the public interest, in the exercise of official authority vested in the Data Controller, or to pursue a legitimate interest of the Data Controller, Users have the right to object to the processing on grounds relating to their particular situation.

Users are informed that, where their Data are processed for direct marketing purposes, they may object to the processing without providing any justification. To find out whether the Data Controller processes data for direct marketing purposes, Users may refer to the relevant sections of this document.

How to exercise rights

To exercise their rights, Users may send a request using the contact details of the Data Controller indicated in this document. Requests are free of charge and will be handled by the Data Controller as soon as possible, and in any case within one month.

Changes to this privacy policy

The Data Controller reserves the right to make changes to this privacy policy at any time by notifying Users on this page. Please therefore check this page regularly, referring to the date of last modification indicated.

Where changes concern processing whose legal basis is consent, the Data Controller will collect the User's consent again, if necessary.

Defence in legal proceedings

The User's Personal Data may be used by the Owner in court or in the preparatory stages of possible legal action to defend against abuses in the use of this website or related Services by the User.

The User declares that they are aware that the Owner may be required to disclose the Data by order of public authorities.

Specific notices

At the User's request, in addition to the information contained in this privacy policy, additional and contextual notices may be provided regarding specific Services, or the collection and processing of Personal Data.

System logs and maintenance

For operation and maintenance reasons, this website and any third-party services it uses may collect system logs, i.e. files that record interactions and that may also contain Personal Data, such as the User's IP address.

Information not contained in this policy

Further information regarding the processing of Personal Data may be requested at any time from the Data Controller using the contact details.

Details on the processing of Personal Data

Personal Data is collected for the following purposes and using the following services:

  • Mailing List or Newsletter. With the optional subscription and registration to the services offered by the site in the dedicated sections, subscription to any mailing lists or newsletters may be requested. This subscription, linked to the specific service offered in the relevant section, will be subject to a specific notice and request for consent in accordance with current regulations.
  • Management of support and contact requests. This type of service allows the site to manage support and contact requests received via email or other tools, such as the contact form. The Personal Data processed depend on the information provided by the User within the messages and on the tool used for communication (for example, the email address).
  • Registration for access to the site's services. Personal Data collected: various types of Data as specified in the privacy policy of the service. The User registers for the requested service exclusively by completing the registration form for the chosen service and directly providing their Personal Data. Personal Data collected: email and other personal data varying with the proposed and/or requested service.
  • Statistics. Used to collect information, in aggregated form, on the number of users and how they visit the site. The site, as suggested by the AgID Web Analytics guidelines.

The data is collected only to process anonymous statistical information about the use of the site and to verify its correct operation; browsing data may be used to identify the user only in the event that this is necessary for the investigation of computer crimes.

  • Display of content from external platforms. This type of service allows you to view content hosted on external platforms directly from the pages of this site and to interact with it.

Technical and organisational security measures for the protection of data

Appropriate technical and organisational security measures pursuant to Art. 32 of the GDPR have been adopted, capable of ensuring:

  • The ability to permanently ensure the confidentiality, integrity, availability and resilience of processing systems and services;
  • The ability to promptly restore the availability and access to personal data in the event of a physical or technical incident;
  • The adoption of procedures capable of regularly testing, verifying and evaluating the effectiveness of the technical and organisational measures adopted in order to ensure the security of processing, also based on a risk assessment.