PRIVACY STATEMENT
pursuant to Article 13 of European Regulation 2016/679 (General Data Protection Regulation or GDPR)

1. Introduction

The processing of your personal data will take place in compliance with the current regulations for the protection of personal data pursuant to European Regulation 2016/679 (General Data Protection Regulation or GDPR) as well as Italian Legislative Decree no. 196 of 30 June 2003 (Personal Data Protection Code), as subsequently amended, as well as the Measures, Authorisations, Guidelines of the Supervisory Authority, currently in force, and, in any case, all supplementary national and community regulations that are applicable on this issue.

2. Controller

The Controller of personal data processing is the Company Florida srl, having its registered office at Galleria Borromeo no. 3 – postcode 35137 Padua – VAT no. 01887910287;

e-mail addresses: info@campingmalibubeach.com and privacy@campingmalibubeach.com, telephone 00390421362212 and fax 00390421961338

3. Subject of the processing – categories of personal data

The processing may concern common personal data (for example, personal information, tax codes, contact details, telephone numbers and/or e-mail addresses).

4. Purposes and legal basis for processing of data

The processing of your personal data will be carried out for the following purposes:

a) to acquire and confirm your service reservation (accommodation and ancillary services), as well as to provide the requested services, thus allowing for the performance of a contract to which the data subject is party and/or in order to take steps at the request of the data subject prior to entering into a contract;

b) to comply with the obligations set out in the ‘Testo unico delle leggi di pubblica sicurezza’ (‘Consolidated Text of Italian Public Safety Laws’) and the related legal notices; in this case, the legal basis for the processing is compliance with a legal obligation to which the Controller is subject; in particular, it is now specified that the data of the members of the group associated with the group-leader (name, surname and date of birth, photocopy of the identity cards of the members of the group) will be collected and treated exclusively to fulfil these legal obligations;

c) to comply with applicable administrative, accounting and tax obligations; in this case, the legal basis for the processing is compliance with a legal obligation to which the Controller is subject;

d) after obtaining your consent, which can be revoked at any time, to speed up the registration procedures in the event of your subsequent stays at our establishment; in this case, the legal basis of the processing is the consent of the data subject;

e) for legal protection purposes; in this case, the legal basis of the processing may be a legitimate interest of the controller or of third parties;

f) after obtaining your consent, which can be revoked at any time, for commercial communication purposes – to be carried out using traditional communication methods, such as physical mail and/or operator-assisted calls, or through automated systems (e-mails, newsletters, fax, SMS, MMS); in this case, the legal basis of the processing is the consent of the data subject.

5. Methods for processing and storing data

The processing of personal data will be carried out using computerised and physical methods and the data will be stored in the physical and electronic filing systems of the Controller.

The processing of personal data will be carried out in order to guarantee adequate security and confidentiality and to prevent unauthorised access to or use of personal data. Therefore, personal data will be processed and stored in full compliance with the principles of necessity, data minimisation and limited storage period, through the adoption of technical and organisational measures appropriate to the level of risk of the processing and for a period of time not exceeding the achievement of the purposes for which they are processed, however for the period required by law.

In particular, the Controller will store the personal data provided as follows:

• in relation to the purposes referred to in point 4, letter (a), the processing will cease at your departure, except for the data that are processed for the further purposes indicated in point 4 (for example, compliance with a legal obligation);
• in relation to the purposes referred to in point 4, letter (b), the data will not be stored, unless you provide consent for the purpose referred to in point 4, letter (d);
• in relation to the purposes referred to in point 4, letter (c), for the entire duration of the contractual relationship, as well as, once the latter has ended, for the times established by the current accounting and tax laws and, in any case, according to the limitation period for the rights arising from the contract (and, therefore, in general, no later than ten years after the termination of the relationship itself);
• in relation to the purposes referred to in point 4, letter (d), the data will be stored for a maximum period of 10 years and will be used when you are our guest again;
• in relation to the purposes referred to in point 4, letter (f), the data will be stored for as long as deemed useful for the marketing purposes indicated above, and in any case until consent is revoked, without prejudice to the exercise of the rights of the data subject referred to in point 10 of this statement, inter alia, to object to the processing of data, also for the aforementioned purposes, and to obtain their erasure, and without prejudice to the withdrawal of consent. Regarding the sending of information via email, the data controller utilizes a third-party service provider acting as a data processor; the data subject may always unsubscribe from the newsletter via the link provided at the bottom of each email containing commercial information.

6. Subjects or categories of subjects to whom personal data may be communicated or who can learn about them and process them as processors or persons authorised to process them

The subjects or categories of subjects to whom your personal data may be communicated or who can obtain them and process them for the above purposes are:

• the internal authorised personnel of the Controller, to whom specific instructions containing the methods of processing personal data in the context of their activities have been given in writing;
• the (internal and external) processors, specifically identified by the Controller and to whom specific instructions have been given in writing, also belonging to the categories indicated below;
• professionals and companies with which the Controller collaborates for the provision of administrative, accounting, tax and employment services that carry out these activities on behalf of the Controller;
• the tax authority (Agenzia delle Entrate – Italian Revenue Agency) and entities, funds, including those for social security and assistance (INPS – Italian National Institute for Social Security, INAIL – Italian National Institute for Insurance against Workplace Accidents), as well as private insurance institutions;
• banking and insurance institutions, also for the purposes of legal and insurance protection;
• trade union organisations to which employees or collaborators have given specific mandates;
• trade associations or business organisations of which the Controller is a member;
• IT consultants and service companies;
• lawyers and legal advisors;
• as well as all other external processors.

There is an absolute ban on the disclosure of data.

To obtain more information about the lists of subjects to whom the above data will be communicated, please contact the Controller at the email privacy@campingmalibubeach.com

7. Transfer of data outside the EU and automated decision-making processes

The data processed are not subject to transfer outside the EU/EEA, nor are they subject to automated decision-making processes.

8. Mandatory or optional nature of data communication and consequences in the event of a refusal to communicate data

The communication of your common personal data is:

• optional for the purposes referred to in point 4, letter (a), and in particular to receive and/or confirm your reservation; however, because it is essential and necessary, for the aforementioned purposes, any refusal to communicate the aforementioned data necessarily entails the impossibility of receiving and/or confirming the reservation;
• mandatory as regards the purposes referred to in point 4, letter (a), and in particular to provide you with the requested services and perform the contract; any refusal to communicate the aforementioned data necessarily entails the impossibility of providing the services referred to in the contract and of properly performing the contractual obligations;
• mandatory as regards the purposes referred to in point 4, letter (b); if you refuse, our establishment will not be able to host you;
• mandatory as regards the purposes referred to in point 4, letter (c); if you refuse, we will not be able to provide you with the requested services;
• optional for the purposes referred to in point 4, letters (d) and (e); if you refuse, we will not be able to proceed with what is indicated in the aforementioned point 4, letters (d) and (e);
• optional for the purposes referred to in point 4, letter (f) (commercial communication purposes); however, any refusal to provide data for this specific processing is of no consequence to the obligation and the fulfilment of the other purposes indicated at point 4, and in particular in relation to all that is related to the fulfilment of the contract for the supply of services, but only entails the impossibility of proceeding with the aforementioned commercial communications.

9. Rights of the data subject

In accordance with Articles 15-22 of European Regulation 2016/679 (GDPR), each Data Subject has also the right to request access to personal data concerning him or her, the rectification of inaccurate data and, if the case may be, to have his or her incomplete personal data completed, the erasure thereof or restriction of processing where the conditions for such restriction are met, as well as to object to the processing thereof in the scenario provided therein, including the right to object to the processing of data for direct marketing purposes, including profiling to the extent that it is connected to such direct marketing, as well as the right to data portability concerning his or her data only if subject to automated processing based on a contract or consent.

The right to withdraw the consent given for the processing purposes requiring it, is also provided, without prejudice to the lawfulness of the processing carried out up to the time of the withdrawal. For requests to exercise his or her rights, each Data Subject can contact the Controller at the contact details indicated above.

Lastly, we remind you that each Data Subject has also the right to lodge a complaint with the Personal Data Protection Supervisor (www.garanteprivacy.it). Data Protection Officer’s details: dpocampingmalibu@mailfence.com