information pursuant to art. 13 of eu data protection regulation 2016/679
The following describes how the travu.co.uk website is managed with regard to the processing of personal data of users who use it.
Tramontana srl, the company that owns the website travu.it (hereinafter referred to commercially as “Travu”), is aware of the importance of protecting the confidentiality of personal data and is committed to complying with the current regulations on privacy and personal data protection that guarantee safe and confidential internet browsing.
The information is also provided pursuant to Art. 13 of the EU Regulation 2016/679 (GDPR) on the protection of personal data to those who interact with the site accessible electronically from the address www.travu.it. The statement is also made for all sites and services under the domain www.travu.it and not for other websites that may be accessed through links.
The statement also draws on other existing national and European legislation, including the ePrivacy Directive(Directive 2002/58/EC) concerning the processing of personal data and the protection of privacy in the electronic communications sector, to identify the minimum requirements for collecting personal data online.
OWNER AND CONTROLLER
In general, Tramontana Ltd. acts:
- as the Data Controller, i.e. independently determining the purposes and methods of processing, in the management of payment transactions for services, billing, data processed while browsing the site and used for the management of the newsletter and the various marketing, advertising and commercial promotion activities carried out by Travu.
- as a Data Processor in the management of service booking activities on behalf of Partners, who operate as autonomous Data Controllers, as they make decisions on the characteristics of the promoted services and the manner of their delivery.
GENERAL PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA
The processing of personal data is governed by the principles of lawfulness, fairness, transparency, purpose limitation and storage, data minimization, accuracy, integrity and confidentiality.
In particular, Tramontana Ltd. is committed to:
- Process the data exclusively for the purposes and in the manner outlined in the notice
- To process data for purposes for which the prior consent of the data subject is required only if there is express authorization to do so
- Respect for anonymity by allowing anonymous browsing of the site in areas that do not require authentication, except for automatic acquisition of browsing data
- Make data available to third parties only for purposes instrumental to the provision of the requested service or in other cases, except where permitted by law, only when the data subject has given consent
- Respect the rights of data subjects by responding to requests for deletion, amendment, supplementation of the data provided, opposition to the processing of data for the purpose of sending commercial and advertising information
- Ensure the proper and lawful handling of personal data, safeguarding the data subject’s right to privacy, and apply appropriate security measures to protect the confidentiality, integrity and availability of processed data
- Ensure maximum transparency by accompanying each data collection action with appropriate disclosures
TYPES OF DATA PROCESSED
“Personal data” is defined as “any information relating to an identified or identifiable natural person (i.e., the data subject); an identifiable person is one who can be identified, directly or indirectly, by reference in particular to an identifier such as a name, an identification number, location data, an online identifier, or to one or more characteristic features of his or her physical, physiological, genetic, mental, economic, cultural, or social identity;” (Art. 4 of EU Regulation 2016/679).
Therefore, personal data are the name, contact information and contact details, payment details, navigational computer identifiers, and metadata, such as the data of the device used to access the site, IP address, cookies, as well as any other information of the site user that is, directly or indirectly, obtainable from browsing.
Some of this data may come from, or be processed by, third parties that the site uses to deliver its services, including the Supplier Partners of the events and services promoted by the site.
RESERVATION AND PURCHASE OF SERVICES
Travu allows Partners providing events, cultural and leisure services in the national territory, selected and duly bound by appropriate contract with Travu, to promote and advertise their offerings to users of the web platform and related sites and to make related bookings by them.
When booking the chosen service, as well as later, by filling in special forms and data entry forms, the user will be asked to provide certain personal data, such as: first and last name, e-mail address, telephone number. For billing purposes, optionally selectable by the user, additional data, such as mailing address, VAT number, recipient code, may be required.
The information requested during booking and payment will be used to enable the proper management and delivery of the service to ensure the performance of all activities related and instrumental to the provision of this service. Once the booking is completed, the data provided by the user will be made available to the Partner, provider of the booked event, so that it can proceed with the management and delivery of the service.
For security reasons, a valid photo ID may be required to be presented to the Partner when using the service at the Partner. Travu does not capture ID data: please refer to the respective privacy policies provided by the Partners for the processing of this personal data.
If it is necessary to register on the site to access and use specific services, such as to manage and keep track of reservations, personal data will be processed for purposes related and functional to the provision of the service itself, including the management and processing of reservations, payments, shopping cart, user profile, commercial and customer care services, as well as for purposes related to administrative, accounting and regulatory compliance.
For booking management this site uses the third-party online booking system for tours, activities and destinationsRegiondo, provided by Regiondo GmbH.
Payment processing services allow the site to process payments by credit card or other means. The data used for payment is acquired directly from the operator of the requested payment service without being processed by this site.
This site uses the Stripe third-party online payment system, provided by Stripe, Inc .
DATA VOLUNTARILY PROVIDED BY THE USER
The voluntary and explicit sending of electronic mail messages to the addresses indicated in the different access channels of the site and the filling in of the specifically prepared forms, or the sending of reviews entails the subsequent acquisition of the address and data of the user, necessary to respond to the instances produced and/or provide the requested service.
Sending this data is done on an optional, explicit and voluntary basis, and involves the subsequent acquisition of the sender’s address, which is necessary to respond to requests, as well as any other personal data entered.
Travu will process this data assuming that it relates to the user or to third parties who have expressly authorized the user to give it based on an appropriate legal basis that legitimizes its processing. In this case, the user is the autonomous owner of the treatment, and assumes all the obligations and responsibilities of the law, conferring the broadest indemnity with respect to any dispute, claim, request for compensation for damages from treatment, etc. that should be received by Tramontana Ltd. from third parties whose personal data have been processed through the use of the site in violation of current regulations.
In any case, Tramontana srl invites the user not to send personal and/or confidential data unless strictly necessary: some categories of personal data (for example, sensitive data referring to one’s state of health) can only be processed with prior consent and with specific security measures aimed at ensuring confidentiality and integrity of the data. Tramontana srl therefore emphasizes the need to manifest explicit consent to the processing of special categories of personal data, should the user decide to transmit such information. Otherwise, the data will be immediately deleted.
Therefore, unless expressly provided, we urge you not to use contact forms for the transmission of sensitive data and, if necessary, to agree in advance to the transmission of such data.
Specific summary disclosures, bearing the appropriate legal basis for processing, will be displayed on the pages of the site set up for particular services involving the submission of personal data.
The computer systems and software procedures used to operate the website acquire, in the course of their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.
This is information that is not collected to be associated with identified interested users, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes IP addresses or domain names of computers used by users who connect to the site, addresses in URI (Uniform Resource Identifier) notation of requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), the browser and operating system used and other parameters related to the user’s operating system and computer environment, information about your clicks and the pages that were shown to you.
When using a mobile device, the site collects data identifying the device and other data on device settings and characteristics, malfunctions (e.g., crashes), and other system activity.
This data is used for the sole purpose of obtaining statistical information not associated with any user identification data about the use of the site and to check its correct operation and is deleted immediately after processing or within a few days. The data could be used to ascertain liability in case of hypothetical computer crimes against the site.
This data is stored in the systems of the Data Controller or in those of the Managers appointed to manage the website.
Accessing the site, consulting its contents and using its services allows the web server to automatically record so-called “system LOGs,” which is information that the user’s browser sends while browsing the site. This information consists of the web pages requested by the user, the documents accessed, edited or created, IP address, browser type, browser language, and the date and time of the request.
Statistical analysis services allow Travu to monitor and analyze traffic data, aimed at measuring site performance for research purposes, usability evaluations, and interest. This site uses Google Analytics, a statistical analysis service of browsing activity provided by Google Ireland Limited (EU) and Google LLC (USA).
Google Analytics uses your personal information, including data you give Google when you register for other services, for the purpose of tracking and examining your use of this site, compiling reports, and sharing them with other services developed by Google.
Google may use your personal information to contextualize and personalize ads in its ad network.
Google makes available an add-on to disable Google Analytics data collection(https://goo.gl/BdFny5).
Google Fonts is a font style display service operated by Google LLC. which allows styles to be integrated into site pages. The service is used through API requests to Google servers and some data (such as IP addresses) may be collected and used for analytical purposes.
Read more about data use via google fonts: https://bit.ly/35H4M12.
GOOGLE TAG MANAGER
This site uses Google Tag Manager, a solution that allows us to manage web page tags through a dedicated interface. The Tag Manager tool does not collect any personal data. This tool ensures the activation of other tags that in turn acquire data under certain conditions (e.g. Google Analytics services).
Google reCAPTCHA is a security service operated by Google LLC. which protects the site from fraud and abuse (e.g., spam or phishing) starting with distinguishing humans from robots, The service collects analyzes various user information (e.g., IP address, cookies, mouse movements, length of time spent on the site).
Data processing takes place in the United States, based on standard contractual clauses approved by the European Commission.
More information: https://www.google.com/recaptcha/about/
COMMERCIAL COMMUNICATIONS AND NEWSLETTERS
The processing of personal data collected through subscription to the newsletter is carried out in order to promote and advertise the products and services offered through Travu, by sending, by e-mail, commercial communications and informative and advertising material.
These services may also allow for the collection of data related to the date and time of the user’s viewing of messages, as well as the user’s interaction with them, such as information about clicks on links embedded in the messages.
At any time, you may discontinue sending commercial communications by using the unsubscribe tools available in those communications or update your preferences for sending communications, limiting or denying them altogether.
For newsletter services Tramontana Ltd. uses ActiveCampaign an address management and emailing service provided by ActiveCampaign, LLC that acquires personal data at the email address.
INTERACTIONS WITH SOCIAL NETWORKS
Tramontana srl processes personal data provided by users through the pages of social network platforms as part of its activities and for the purpose of managing interactions with users (comments, public posts, etc.). For the processing of personal data carried out by the operators of social networking platforms, please refer to the information they render through their respective privacy policies.
Integration of social media plugins. We have integrated social media plugins on the Booking.com website and apps. This means that when you click or tap one of the buttons (for example, the Facebook “Like” button), some information is shared with social media service providers.
If you are linked to your social media account when you click or tap one of these buttons, the social media provider may link this information to your social media account. Depending on your settings, they may also show these actions on your social media profile, which will then be visible to other users in your network.
This site also features services that allow you to interact with social networks, or other external platforms, directly from the pages of this site (e.g. comment and share widgets, “like” button, etc…). Some interactions may be shared with the social network: if you are linked to your social network account, these interactions may be shared on your profile or trigger personalized advertisements in the social network platform.
Social network interaction services may collect traffic data related to pages where the services are present, even if users do not interact with those services.
Interactions and information captured are in each case subject to the user’s privacy settings related to each social network.
Travu may use other social services, such as the instant message exchange system, to interact with users and communicate with them about its services.
DATA RELATED TO MINORS
The activities and services on this site are intended for adults. Tramontana srl will not accept reservations, registrations or acuities made by anyone under the age of 18 (eighteen) nor will it intentionally collect or use their personal information. Minors are therefore urged not to register, proceed to purchase or transmit personal information through the site.
PROFILING BY AUTOMATED PROCESSING OF PERSONAL DATA
Automated user profiling systems aimed at analyzing or predicting aspects regarding the user’s shopping choices, habits and preferences, browsing habits, and consumption choices based on browsing activities or the type of purchases made are active.
This site uses Google Ads, an interest-based behavioral advertising service provided by Google LLC, which links this site’s activity with the Google Ads advertising network for the purpose of tracking user visits to sites at which advertisers in the network offer their services.
There are also active third-party traffic analysis systems (e.g., Google Analytics) that may use the user’s personal data to optimize and contextualize ad network ads.
Please refer to the specific disclosure: [link all’informativa cookies]
PURPOSE AND LEGAL BASIS OF DATA PROCESSING
Personal data voluntarily provided by website users are processed for different purposes, specified below, and for which consent may be required:
|Purpose of processing||Legal basis and consent to processing|
|1. MANAGEMENT OF REQUESTS AND DELIVERY OF SERVICES|
|for the management of reservations and purchase of servicesfor the creation of the user account and purposes related to its management, in case of any registration to the site;to verify the identity of the user, including in case of support in the restoration of accessto manage any type of request for technical, commercial or administrative assistance, and provide additional services requested by the user||The processing is carried out in the context of the performance of a contract to which the user is a party or to the execution of pre-contractual measures taken at the request of the user (Art. 6, para. 1(b) of the GDPR).Consent is not necessary.|
|to follow up any requests made to us, for example by spontaneously sending messages, electronic or traditional mail to the addresses indicated on the site, which entail the subsequent acquisition of the address, including e-mail, of the sender or the relevant telephone numbering necessary to respond to the requests, as well as any other personal data included in the relevant communications.||The processing is carried out in the context of the performance of a contract to which the user is a party or to the execution of pre-contractual measures taken at the request of the user (Art. 6, para. 1(b) of the GDPR).Consent is not necessary.|
|for the execution of obligations required by laws, regulations and legislation, national and/or EU, as well as provisions issued by authorities empowered to do so by law or by supervisory and control bodies;||Processing is necessary to fulfill a legal obligation of which it is the subject (Art. 6(1)(a) GDPR).Consent is not required.|
|for cybersecurity, the prevention or detection of any fraud or abuse in the use of the site, or any fraudulent activity, and thus to enable the Owner to protect itself in court, for the detection and notification of personal data breaches(data breaches)||Processing is based on the legitimate interest of the Data Controller (Art. 6(1)(f) GDPR).Consent is not required.|
|2. MARKETING AND SALES PROMOTION ACTIVITIES|
|for marketing purposes, by sending newsletters (or also paper mail, e-mail, telephone and instant messaging services, when requested and specified) of communications, commercial offers, advertising, promotional and informational material, market research, surveys concerning new products and/or services offered by the Owner||Consent is necessary to carry out the processing. Consent is optional in all cases. Failure to consent, or subsequent withdrawal of consent, will have no consequence in the provision of services, except the inability to receive commercial communications and updates on services and promotions. The user, at the time of sending each communication, will have the right to express their opposition to the processing of data, in accordance with the rights granted to them.|
|3. PROFILING BY AUTOMATED PROCESSING OF PERSONAL DATA|
|to analyze or predict aspects regarding purchasing choices, habits and preferences, including those related to the geographical area of reference, as well as for the creation of profiles (individual and/or aggregated) in order to conduct market research, carry out promotional activities and propose personalized offers.to carry out activities of analysis and study of the user’s consumption habits and choices (so-called “profiling”), based on the type of purchases made, in order to conduct market research and personalized promotional activities.||Consent is necessary to carry out the processing. Consent is optional in all cases. Failure to consent, or its subsequent revocation, will not result in any consequences in the provision of services, except the inability to receive commercial communications in line with user preferences and optimize the services offered by Travu|
|to create a profile of the user through the use of profiling cookies, if the user has agreed to their use: collecting and analyzing information about activities, selections and choices made on the site; analyzing users’ activities by collecting information about previous purchases and browsing activities. The profile will be used to provide information about other products and/or services that it believes may be of interest to the user and to display personalized advertisements relevant to the user’s preferences.||Consent is necessary to carry out the processing and can be expressed by accepting the use of profiling cookies, in the manner indicated in the cookie banner. Consent is optional in all cases. Failure to consent, or its subsequent revocation, will not result in any consequences in the provision of services, except the inability to receive commercial communications in line with user preferences and optimize the services offered by Travu|
PURPOSE OF NAVIGATION DATA PROCESSING AND SYSTEM LOGS
Personal data whose transmission is implicit in the use of Internet communication protocols and system LOGs are processed only to obtain anonymous statistical information on the use of the site, to check its correct operation and to protect the computer systems that enable its operation.
The data do not allow the identification of data subjects and are not associated with other data sources that would allow assimilation such as to identify users.
Such data, such as the user’s IP address, could also be used to ascertain liability in case of hypothetical computer crimes against the site.
OBLIGATION OR OPTION TO GIVE DATA
Apart from what is specified above for browsing data, the user is free to provide personal data in forms or registration procedures. Failure to provide them may result in the inability to obtain what has been requested or to perform certain services, as specified below with reference to the aforementioned purposes:
1. MANAGEMENT OF REQUESTS AND DELIVERY OF SERVICES
the provision of data (which may be marked as necessary in the forms) is necessary for the pursuit of the purposes set out in point 1 and any refusal to provide such data will result in Travu being unable to handle bookings, provide services or fulfill user requests and for users to take advantage of the services available through the website.
In addition, the processing of data for these purposes is necessary in order to fulfill any legal obligations: personal data must be processed in accordance with applicable regulations, including their storage and communication to the Authorities for accounting, tax or other obligations.
2. MARKETING AND SALES PROMOTION ACTIVITIES
the provision of data, based on the user’s consent, is optional for the pursuit of the purposes set out in point 2 and failure to provide it, or withdrawal of consent, will not allow the sending of commercial and promotional communications. Failure to confer will not result in any consequences in the provision of services.
3. PROFILING BY AUTOMATED PROCESSING OF PERSONAL DATA
the provision of data, based on the user’s consent, is optional for the pursuit of the purposes set out in point 3 and failure to provide it, or withdrawal of consent, will not allow profiling activities, i.e. sending commercial and promotional communications in line with the interests expressed or showing the user personalized advertising messages. Failure to confer will not result in any consequences in the provision of services.
MODE OF TREATMENT
Personal data are processed by automated tools, methods and procedures for the time strictly necessary to achieve the purposes for which they were collected and for the pursuit of the purposes set forth in this policy.
In particular, the processing is carried out, through specially appointed personnel, mainly with the aid of electronic, computerized or otherwise automated means, through the use of electronic mail or other remote communication techniques.
Data are kept for the time strictly necessary to provide the requested service or for the time stipulated by applicable regulations.
In general, personal data provided by users that are no longer necessary for the pursuit of the purposes for which they were collected are deleted or anonymized, except for the retention requirements indicated herein, prescribed by law or indication to the contrary by the data subject.
Travu will also process personal data for as long as permitted by law, particularly as may be necessary to protect its interests from possible litigation or complaints regarding the services provided.
For the purposes of marketing, sales promotion and profiling, data retention will take place until consent is revoked, after which Tramontana srlTravu will no longer use the user’s personal data for such purposes, reserving the right to retain it as long as may be necessary to protect its interests from possible claims based on such processing.
Travu will also, on a yearly basis, check the continuity of the newsletter subscription assumptions, proceeding to the cancellation of addresses that are no longer valid or inactive.
Travu takes specific, appropriate and preventive security measures to safeguard the confidentiality, integrity, completeness, and availability of the personal data of the data subject, as well as to prevent data loss, illegal or incorrect use, and unauthorized access.
In particular, to protect the personal data of the data subject, the site uses an encryption system with SSL (Secure Sockets Layer) technology, which provides protection by encrypting information both on the login page and in other sections where you can release, view or modify your personal data.
In any case, Travu will not be held responsible about untruthful or incomplete information sent directly by the user (example: correctness of e-mail address, identification data or credit card details or contact information), as well as information about him/her that was provided by a third party, even fraudulently.
RECIPIENTS OF PERSONAL DATA
Personal data may be disclosed to individuals who can access the data by virtue of a provision of law, regulation, or EU legislation, within the limits provided by these rules.
For the provision and management of the services requested by the user, the user’s personal data may be disclosed to other parties, as autonomous data controllers and/or data processors:
- Partners, providers of the services booked by the user, to whom the data related to the booking is transmitted.
In case of complaints or disputes, Travu may have to communicate data and other information to the Partner to resolve the situation.
Partners will subject the user’s personal data to further processing in order to provide the service. For example, Partners may ask you for additional personal data, for example, to provide additional services or to ensure security. For the processing of these personal data, please refer to the respective privacy policies provided by the Partners.
- Fornitori di servizi di terze parti. Travu si avvale di servizi di fornitori esterni per:
- Gestire le prenotazioni, tramite il sistema di terze parti di prenotazione online per tour, attività e destinazioni Regiondo.
- Manage payments, through third-party services to process payments, handle chargebacks, or provide invoice collection services.
- Provide web services, computer security, e-mail, or services necessary for the operation of the site and delivery of services
- Individuals who provide assistance and advice on accounting, administrative, legal, tax, financial and debt collection matters related to the provision of services. Data are shared to the extent necessary, and individuals are bound by professional obligations of confidentiality to the extent necessary to carry out their duties.
- Competent authorities. Personal data may be shared with law enforcement agencies to the extent required by law or if absolutely necessary for the detection, prevention or conduct of legal proceedings in cases of fraud or crime or if otherwise required to do so by law.
When data are transferred to third-party service providers, Travu applies appropriate contractual, organizational, and technical measures with those providers.
The full list of the aforementioned subjects, in addition to what is indicated in the different sections of this policy, can be requested directly from the Holder. Personal data collected is not disseminated unless specifically authorized.
PLACE OF DATA PROCESSING
Processing related to the web services of this site takes place at the offices of Tramontana srl, which uses external providers for the web site hosting service, and is handled by technical personnel authorized to process the data and, occasionally, by external and internal appointees for maintenance operations.
Personal data will be stored on servers of Travu’s suppliers located within the territory of the European Union.
TRANSFER TO THIRD COUNTRIES
Some of your personal data may be are transferred to recipients located outside the European Union, as indicated in the different purposes of processing. Travu ensures that the processing of personal data by these recipients is done in accordance with the requirements of the applicable legislation, i.e., basing the transfer on an adequacy decision or, alternatively, on the standard contractual clauses approved by the European Commission.
RIGHTS OF INTERESTED PARTIES
The users of the site to whom the personal data refer, in their capacity as data subjects and within the limits of the legislation in force, are recognized the rights referred to in Articles 15 to 22 of EU Regulation 2016/679, that is, in summary, the right to ask Tramontana srl, at any time:
- Access to personal data, as well as further information about their processing
- The rectification or updating of data
- deletion of data
The user can also:
- object to the processing,
- request restriction of processing
- if applicable in relation to the processing, obtain in a structured, commonly used, machine-readable format the data concerning you
- Withdraw consent for the processing purposes that require it
Pursuant to and within the limits of current legislation, you have the right to lodge a complaint with the competent supervisory authority (for Italy: Garante per la Protezione dei Dati Personali, email firstname.lastname@example.org) if you believe that the processing of your personal data is carried out in violation of the law or your rights.
The rights listed above may be exercised at any time by the interested party by contacting Tramontana srl, Piazzale Anna Ciabotti, 8, Jesi (AN), email email@example.com
Please also note that registered users of the site may at any time view and change their personal data by accessing the data change mask within their personal account, as well as to grant or revoke any previously given consent for sending commercial communications.
CHANGES AND UPDATES