Information on the processing of personal data
This Privacy Policy aims to describe the management methods of the website www.visitvaldichiana.it (hereinafter: the "Site") with reference to the processing of users' personal data.
This is a general information provided in compliance with the art. 13 of Regulation (EU) 2016/679 relating to the protection of natural persons with regard to the processing of personal data, as well as the free circulation of such data (hereinafter the "Regulation") to all users who consult and, more generally, interact with the services provided through the Site by the Municipality of Cortona - Piazza della Repubblica, 13 Cortona (AR) (hereinafter: the "Owner" or "Body").
This information will illustrate the purposes and methods with which the Data Controller may collect and process your personal data, which categories of data are being processed, what are the rights of those interested in the processing and how they can be exercised.
The information is provided exclusively for this Site, therefore the Owner assumes no responsibility for other websites that may be consulted via hyperlinks on the site itself. The data processing will take place using IT and manual tools.
Users, by using this Site, accept this information and are therefore invited to read it before providing personal information of any kind.
Data Controller
Municipality of Cortona - Piazza della Repubblica 13, 52044 – Cortona (AR)
Contact details of the Data Protection Officer
The Data Protection Officer of the Municipality of Cortona can be contacted at the following addresses:
Dr. Marco Marcellini (Data Protection Manager)
Telephone: 0575 62524, 339 2758634
Email: privacy@next20.it PEC: marco.marcellini@postecert.it
Types of data processed
Navigation data
The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes the IP addresses or domain names of the computers used by users who connect to the site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the IT environment of the user.
These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and are deleted immediately after processing. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the site.
Some personal data whose transmission is implicit in the use of internet communication protocols (e.g.: personal data acquired via site access log) are acquired by Web Analytics Italia. These data are processed for the technical management of the website and for the collection of analytical data on the related traffic. For further information, consult the specific WAI privacy policy at https://webanalytics.italia.it/privacy.
Data provided voluntarily by the user
Without prejudice to what is specified above in relation to navigation data, the entity will acquire any personal data provided by the user through the Site to make requests via e-mail, for subscribing to any newsletters, furthermore, it will acquire name, surname, e-mail address etc. only if you wish to come into contact with the Owner or make use of the services offered on this site via specific forms.
Through the Site, the Owner will not acquire data of a sensitive nature or in any case belonging to the particular categories referred to in the art. 9 of Regulation (EU) 2016/679 or data relating to criminal convictions or crimes.
The processing of the data provided by the user will take place in compliance with the purposes and methods indicated in this information and the specific information made available from time to time.
Treatment methods
Personal data are processed with manual and IT tools in order to achieve the purposes for which they were collected. Specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access.
The data processing will be carried out by personnel directly employed by the Data Controller and/or by natural or legal persons specifically identified by the latter as persons in charge, appropriately appointed managers and their data processors.
Legal basis and purpose of the processing for the provision of the requested services
The data provided referred to in the paragraph "Data provided voluntarily by the user" will be processed by the Data Controller exclusively to respond to requests and follow up on the services which the user intends to use. The data will be processed only for these purposes. The provision of such data is necessary.
Recipients of the processing
The recipients of the processing are all users of the website or the services made available through it in terms of the laws in force and as defined by Regulation (EU) 2016/679.
Optional nature of providing data
The user is free to decide whether or not to provide their personal data to the Data Controller through this website and/or the services connected to it. Failure to provide data may make it impossible for the Data Controller to provide the requested service.
Communication and data transfer
The data provided will in no case be disclosed or communicated to third parties, without prejudice to the subjects whose right to access the data is recognized by legal provisions or by orders of the authorities, as well as the subjects, including external and/or foreign, of which the Data Controller uses for the performance of instrumental and/or ancillary activities, including suppliers of software solutions, web applications and storage services provided.
Further information can be found by the interested party by sending a request to the Data Controller. The Data Controller may communicate, for the purposes described, some personal data collected also to third parties, who will process the personal data as Data Controllers.
The list of data controllers can be requested from the Data Controller by writing to
Municipality of Cortona – Piazza della Repubblica 13, 52044 – Cortona (AR)
Duration of treatment
The data will be stored to follow up on the requests and services chosen, requests formulated through the Site. The data will be stored for the period strictly necessary.
Rights of interested parties
It is highlighted that, in compliance with current regulations, the interested party has the following rights:
request and obtain information regarding the existence of their data in the availability of the Data Controller and access to such data; for data processed with automated systems, request communication of your data and/or transfer to another owner; request and obtain the modification and/or correction of your personal data if you believe they are inaccurate or incomplete; request and obtain the cancellation - and/or limitation of processing - of your personal data if it is data or information that is not necessary - or no longer necessary - for the aforementioned purposes, therefore after the retention period indicated in the previous paragraph has elapsed.
In particular, you are granted the following rights: articles. 15 – “Right of access of the interested party”, 16 – “Right of rectification”, 17 – “Right to cancellation”, 18 – “Right to limit processing”, 20 – “Right to data portability” of EU Regulation 2016/679 within the limits and conditions established by the art. 12 of the Regulation itself.
Such requests may be addressed to the Municipality of Cortona - Piazza della Repubblica 13, 52044 – Cortona (AR) We also inform you that pursuant to current legislation it is possible to submit any complaints regarding the processing of your personal data to the Guarantor for the protection of personal data.
Cookies
The user has the possibility, depending on the web browser in use, to disable or selectively accept the use of cookies. In this case navigation may not be equally easy, some functions of the site may not be available and some web pages may be displayed incorrectly.
The site uses Web Analytics Italia (WAI) cookies to collect information, in aggregate form, on the number of users and how they use the site, for the sole purpose of producing anonymous statistics and verifying its correct functioning.
For further information, consult the specific WAI privacy policy at https://webanalytics.italia.it/privacy.
You can access the complete information on cookies via the link available at the bottom of this site or by clicking here.
Types of Data collected
Among the Personal Data collected by this site, independently or through third parties, there are: postcode, email, province, geographical position, usage data, cookies and various types of data indicated here by way of example, but not exhaustively. Complete details on each type of data collected are provided in the dedicated sections of this privacy policy or through specific information texts displayed before the data is collected.
Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically during navigation.
Unless otherwise specified, all requested Data is mandatory. In cases where some Data is indicated as optional, Users are free to refrain from communicating such Data, without this having any consequence on the availability of the Service or its operation.
Users who have doubts about which Data is mandatory are encouraged to contact the Owner.
Any use of tracking tools by this site or by the owners of the third-party services used, unless otherwise specified, has the purpose of providing the Service requested by the User, in addition to the additional purposes described in this document.
The User assumes responsibility for the Personal Data of third parties obtained, published or shared and guarantees that he or she has the right to communicate or disseminate them, freeing the Owner from any liability towards third parties.
Treatment methods
The Data Controller adopts appropriate security measures aimed at preventing unauthorized access, disclosure, modification or destruction of Personal Data. The processing is carried out using IT and/or telematic tools, with organizational methods and with logic strictly related to the purposes indicated.
In addition to the Owner, in some cases, other parties involved in the management of this site (administrative, commercial, marketing, legal, system administrators) or external parties (such as third-party technical service providers, postal couriers, hosting providers, IT companies, communications agencies) may also have access to the Data, if necessary, also appointed, if necessary, as Data Processors by the Owner.
The updated list of Managers can always be requested from the Data Controller.
Legal basis of processing
The Data Controller processes the user's data exclusively following a specific registration of the same within an area reserved for services offered by the data controller.
The data are processed exclusively following a request and/or subscription to a service provided by the owner and which may also have as its realization a legitimate interest of the owner, a public interest or precisely the performance of a service directed to the user himself.
Location
The Data is processed at the operational offices of the Owner and in any other place where the parties involved in the processing are located. For further information, contact the Owner.
The User's Personal Data may be transferred to a country other than the one in which the User is located. To obtain further information on the place of processing, the User can refer to the section relating to the details on the processing of Personal Data.
The User has the right to obtain information regarding the legal basis of the transfer of Data outside the European Union or to an international organization governed by public international law or constituted by two or more countries, such as the UN, as well as regarding the security measures adopted by the Owner to protect the Data.
If one of the transfers just described takes place, the User can refer to the respective sections of this document or request information from the Owner by contacting him at the details indicated at the beginning.
Transfer of data abroad
The data is not transferred to third countries outside the European Economic Area.
Retention period
The Data is processed and stored for the time required by the purposes for which it was collected. Therefore:
- Personal Data collected for purposes related to the execution of a contract between the Owner and the User will be retained until the execution of this contract is completed.
- Personal Data collected for purposes attributable to the legitimate interest of the Owner will be retained until such interest is satisfied. The User can obtain further information regarding the legitimate interest pursued by the Owner in the relevant sections of this document or by contacting the Owner.
When the processing is based on the User's consent, the Owner may retain the Personal Data for longer until such consent is revoked. Furthermore, the Data Controller may be obliged to retain Personal Data for a longer period in compliance with a legal obligation or by order of an authority.
At the end of the retention period, the Personal Data will be deleted. Therefore, upon expiry of this deadline the right of access, cancellation, rectification and the right to data portability can no longer be exercised.
Purpose of the Processing of Collected Data
The User's Data is collected to allow the Owner to provide its Services, as well as for the following purposes: registration and authentication limited to specific services offered by the site, contacting the user, interactions based on location, statistics, display of content from external platforms, payment session, infrastructure monitoring, management of support and contact requests.
To obtain further detailed information on the purposes of the processing and on the Personal Data concretely relevant for each purpose, the User can refer to the relevant sections of this document.
Data controllers
The Organization may make use of third parties to carry out activities and related processing of personal data of which it is the owner. In accordance with the provisions of the law, these subjects ensure levels of experience, ability and reliability such as to guarantee compliance with the current provisions on processing, including the data security profile.
Instructions, tasks and obligations for these third parties are formalized by the Organization with the designation of the same as "Data Processors". These subjects are subjected to periodic checks in order to verify the maintenance of the guarantee levels recorded when the initial assignment was assigned.
User Rights
Users can exercise certain rights with reference to the Data processed by the Owner.
In particular, the User has the rights listed below.
- Revoke your consent at any time. The User may revoke the previously expressed consent to the processing of their Personal Data.
- Object to the processing of your Data. The User can object to the processing of their Data when it occurs on a legal basis other than consent. Further details on the right to object are set out in the section below.
- Access your Data. The User has the right to obtain information on the Data processed by the Owner, on certain aspects of the processing and to receive a copy of the Data processed.
- Check and request rectification. The User can verify the correctness of their Data and request its updating or correction.
- Obtain treatment limitation. When certain conditions are met, the User can request the limitation of the processing of their Data. In this case the Owner will not process the Data for any purpose other than their conservation.
- Obtain the deletion or removal of your Personal Data. When certain conditions are met, the User can request the deletion of their Data by the Owner.
- Receive your Data or have it transferred to another owner. The User has the right to receive their Data in a structured, commonly used and machine-readable format and, where technically feasible, to obtain its transfer without obstacles to another owner. This provision is applicable when the Data is processed with automated tools and the processing is based on the User's consent, on a contract of which the User is a party or on contractual measures connected to it.
- Submit a complaint. The User can lodge a complaint with the competent personal data protection supervisory authority or take legal action.
Details on the right to object
When Personal Data is processed in the public interest, in the exercise of public powers vested in the Owner or to pursue a legitimate interest of the Owner, Users have the right to object to the processing for reasons related to their particular situation.
Users are reminded that, if their Data is processed for direct marketing purposes, they can object to the processing without providing any reason. To find out whether the Owner processes data for direct marketing purposes, Users can refer to the respective sections of this document.
How to exercise your rights
To exercise the User's rights, Users can direct a request to the contact details of the Owner indicated in this document. Requests are filed free of charge and processed by the Data Controller as quickly as possible, in any case within one month.
Changes to this privacy policy
The Data Controller reserves the right to make changes to this privacy policy at any time by informing Users on this page. Please therefore consult this page regularly, referring to the date of last modification indicated.
If the changes affect processing whose legal basis is consent, the Owner will collect the User's consent again, if necessary.
Defense in court
The User's Personal Data may be used by the Owner in court or in the preparatory stages of its possible establishment for the defense against abuse in the use of this site or related Services by the User.
The User declares to be aware that the Owner may be obliged to reveal the Data by order of public authorities.
Specific information
Upon request of the User, in addition to the information contained in this privacy policy, additional and contextual information may be provided regarding specific Services, or the collection and processing of Personal Data.
System and maintenance logs
For needs related to operation and maintenance, this site and any third-party services used by it may collect system logs, i.e. files that record interactions and which may also contain Personal Data, such as the User IP address.
Information not contained in this policy
Further information in relation to the processing of Personal Data may be requested at any time from the Data Controller using the contact details.
Details on the processing of Personal Data
Personal Data is collected for the following purposes and using the following services:
- Mailing List or Newsletter. By joining and optionally registering for the services offered by the site in the specific sections, you may be required to subscribe to any mailing lists or newsletters; this registration linked to the individual service offered in the specific section will be subject to specific information and a request for consent in accordance with the provisions of current legislation.
- Management of support and contact requests. This type of service allows the site to manage support and contact requests received via email or other tools, such as the contact form. The Personal Data processed depends on the information provided by the User in the messages and on the tool used for communication (for example the email address).
- Registration for access to site services. Personal Data collected: various types of Data as specified in the privacy policy of the service. The User registers for the requested service exclusively by completing the registration form for the chosen service by directly providing their Personal Data. Personal Data collected: email and other personal data that varies with the service proposed and/or requested.
- Statistics. Used to collect information, in aggregate form, on the number of users and how they visit the site. The site as suggested by the AgID Web Analytics guidelines.
The data is collected only to process anonymous statistical information on the use of the site and to verify its correct functioning; the navigation data could be used to identify the user only if this was necessary to ascertain computer crimes.
- Viewing content from external platforms. This type of service allows you to view content hosted on external platforms directly from the pages of this site and interact with them.
Technical and organizational security measures for data protection
Adequate technical and organizational safety measures have been adopted pursuant to art. 32 of the GDPR capable of guaranteeing:
- The ability to ensure the confidentiality, integrity, availability and resilience of processing systems and services on a permanent basis;
- The ability to promptly restore the availability and access of personal data in the event of a physical or technical incident;
- The adoption of procedures capable of testing, verifying and regularly evaluating the effectiveness of the technical and organizational measures adopted in order to guarantee the safety of the processing also based on a risk assessment.