PRIVACY NOTICE PURSUANT TO SEC. 13 OF EU REGULATION NO. 679/2016 (“GDPR”)

1. Gremigna (hereinafter, “Gremigna” or the “Data controller”), with registered office in Podere Campo La Casa, 16 58040 Tatti, Massa Marittima, (GR) ITALY – Reg No. 01647790532, in its quality of data controller, processes the personal data of the subjects involved in the processing (hereinafter, “Data subject”) and in particular of the users that use the services available on the website www.docudonna.it (hereinafter, the “Website”). The Data are provided directly by the Data subject and may be processed for the following purposes: a) management of the registration to the website; b) provision of the search engine service that provides information on activities/tours, tickets and offers, parks and museums, cultural institutions, hotels, villas, etc (hereinafter, jointly, the “Suppliers”); c) sale of tickets, or vouchers to redeem tickets, issued by Suppliers or other third parties in order to access the related premises and exhibitions and/or to use leisure/travel services offered by Suppliers (hereinafter, the “Supplier Services”); d) sale of activities, events and other services offered directly by Gremigna and additional services with respect to Supplier Services; e) publication of and access to reviews written by the Data subjects in relation to services, attractions and trips offered on the Website; f) service communications with Suppliers in relation to the Supplier Services; g) statistical purposes on anonymized data; h) delivery by Gremigna of promotional communications about discounts, offers, events or services similar to those previously purchased by the Data subject; i) delivery by Gremigna of promotional communications about discounts, offers, events or services different from those previously purchased by the Data subject, only with his/her explicit consent; l) profiling activities, that is evaluating the tastes, preferences and consumption habits of the Data subject, including by inviting him/her to participate in market surveys, only with his/her explicit consent; m) communication of the personal data of the Data subject to Gremigna third-party partners for the purpose of delivery of commercial and promotional communications by the aforementioned companies, only with the explicit consent of the Data subject. The legal basis for data processing is the execution of a contract and the provision of the requested service (for the purposes under letters a), b), c), d), e), f) above), the legitimate interest of Gremigna (for the purpose under letter h)) and the Data subject’s consent (for the purposes under letters i), l), m)).
2. Gremigna hereby informs you that: a) for the above mentioned purposes the Data of Data subject shall be processed also by computer, telematic, paper and manual instruments, in compliance with the confidentiality and safety rules provided by the law; b) in case of expressed consent to the profiling activity, this will entail an automated activity in order to allocate the Data subject into a category of subjects with homogeneous characteristics on the basis of the services previously used, any market surveys that may have been completed and the relevant demographic class.
3. The provision of the Data is optional. However, any refusal to provide the Data for the purposes referred to under letters a), b), d) of paragraph 1, shall lead to the impossibility to enjoy the related services offered by Gremigna. Instead, the refuse to provide the Data for the purposes referred to under letters c) and f) of paragraph 1 shall prevent the provision of Supplier Services. Also a subsequent possible opposition or revocation of consent to the processing of personal data for the aforementioned purposes shall result in the immediate blocking of the supply of the affected services. The possible refusal to provide consent to the data processing for the further purposes referred to under letters h), i), l), m) of paragraph 1, shall not lead to any consequences, subject to the impossibility for the Data subject to be informed about: about Gremigna discounts, offers, services or events and any initiatives to detect the satisfaction of Gremigna’s customers, to receive commercial communications of interest from Gremigna and to receive promotional communications from the partner companies of Gremigna.
4. The Data shall not be disseminated, except for the possible dissemination, at the discretion of the Data subject, of his/her Data for the purposes referred to under paragraph 1 letter e). Within the organization of Gremigna, the Data may be processed by the relevant offices entrusted with the execution of certain processing activities (i.e. Administration, Commercial, Marketing, IT). In case of purchase of Supplier Services, Gremigna may communicate to the Supplier the Data strictly necessary to ensure the provision of Supplier Services in Italy and abroad (such as, the name of user, email address and other booking information required by Supplier). In the event that the Supplier is located in a country outside the European Union, Gremigna will have to transfer the personal data of the Data subject outside the European Union for the purposes of the execution of the contract. The Supplier will act as an independent Data controller in relation to the personal data. The Supplier shall deliver its own privacy policy, which we invite you to read carefully. The Supplier may contact the Data subject to obtain further information, so as to facilitate the use of the Supplier Service, make the Supplier Service available or respond to a request transmitted by the Data subject. In order to provide its services or for the other purposes for which the Data subject has given his consent, Gremigna may communicate the personal data to third parties that carry out consultancy activities, to its affiliated companies and to its suppliers based within the European Union, in order to perform certain functions that are necessary for the provision of Gremigna’s services (such as executing orders, sending mail and e-mails, providing commercial assistance, processing credit card payments and providing services to customers). Such subjects will have access to the personal data necessary to perform these functions (and may not use them for different purposes), and will be required to process the data in accordance with applicable law. The aforementioned suppliers will act as data processors appointed by Gremigna and will be included in an updated list, which can be easily known at no charge by sending a request to the email address indicated under paragraph 7 of this Privacy Notice.
5. The Data shall be stored on servers located within the European Union. Any Data collected for the purposes indicated under paragraph 1 letters (a) and (b) shall be retained for the entire duration of the Data subject’s registration to Gremigna’s Website or until the Data subject requests the deletion of his/her Data. Any Data collected for the purposes indicated under paragraph 1 letters (c), (d) and (f) shall be retained for the period of time that is necessary to the provision of the purchased or requested services, and subsequently for no longer than the statutory limitation period. Any Data collected for the purposes of processing indicated under paragraph 1 letter (e) shall be retained until the Data subject withdraws his/her consent to publication of reviews or requests the deletion of his/her Data. Any Data collected for the purposes of processing indicated under paragraph 1 letter (h), (i), (l), (m) shall be retained until the Data subject withdraws consent to the marketing activities from Gremigna or to the profiling activities, or withdraws consent to marketing activities from Gremigna’s partners or presents a request for deletion of the Data, except for cases where the Data controller needs to retain such Data to defend its rights in relation to any disputes that are on-going at the time of the request, or upon formal request from public authorities.
6. The Data subject has the right to: a) obtain the termination of processing for direct marketing purposes, also in relation to services identical to those already provided by our company; b) obtain information in relation to the purposes for which Data are processed, to the period of processing and to the subjects to whom the data are communicated (right of access); c) obtain the rectification or integration of incorrect Data concerning the Data subject (right to rectification); d) obtain the deletion of Data concerning the Data subject in the following cases (i) the data are no longer necessary for the purposes for which they were collected; (ii) the Data subject has withdrawn his/her consent to the processing of Data, if these are processed on the basis of his consent; (iii) the Data subject has opposed the processing of Data concerning him/her, in case these are processed for our legitimate interest; or (iv) the processing of Data does not comply with the law. However, it is to be noted that the retention of Data by Inter is also lawful if it is necessary in order to fulfill a legal obligation or to ascertain, exercise or defend a right in Court (cancellation right); e) to obtain that the Data concerning the Data subject are only stored without any further use in the following cases: (i) the Data subject disputes the accuracy of the Data, for the period that is necessary for allowing Inter to verify the accuracy of such Data; (ii) the processing is unlawful but the Data subject objects to the deletion of the Data; (iii) the Data are necessary for ascertaining, exercising or defending a right in Court; (iv) the Data subject has opposed the processing and is awaiting the verification of the possible prevalence of Inter’s legitimate interest to the processing (limitation right); f) receive in a common, structured, commonly used and machine-readable format, all Data concerning the Data subject, if these are processed under a contract or on the basis of the Data subject’s consent (portability right). Please also note that the Data subject has the right to contact the Data Protection Authority (Piazza di Monte Citorio n. 121, 00186 ROMA) in order to enforce his/her rights with regard to the data processing.
7. The Data controller pursuant to art. 24 of the GDPR is Gremigna with registered office in Podere Campo La Casa, 16 58040 Tatti, Massa Marittima, (GR) ITALY – Reg No. 01647790532 . The Data controller can be contacted for sending requests or exercising the rights established by the law by sending an email to the email address admin@docudonna.it.
8. The Data controller has appointed a Data Protection Officer which is domiciled for the position at the registered address of Gremigna and can be contacted at the email address admin@docudonna.it  for any matter concerning the Data processing
9. Notwithstanding that Gremigna in any case shall not proceed to processing operations other than those expressly authorized and/or requested by each Data subject, this Privacy Notice may be amended from time to time in order to comply with new provisions of law, the modification of Gremigna’s Data processing policies and/or following changes to the features of the Website and/or Gremigna’s services. Each updated version of this Privacy Notice shall be made available on the Website in the dedicated section: Gremigna therefore invites all users to periodically consult the aforementioned section in order to be always informed on the latest published version.