Dear User, in accordance with Article 12 and subsequent articles of the EU Regulation 2016/679 of the European Parliament and Council of the 27th April 2016 (General Data Protection Regulation, “Regulation” or “GDPR”), and in general in accordance with the principle of transparency foreseen in the same Regulation, we are to provide the following information on the processing of personal data (that is, any information concerning an identified or identifiable natural person: “interested party”) made in connection with the browsing on the website “www.merano2000.com” (“website”) and on the related interaction by the User (it is noted that this statement does not therefore concern other websites that may be visited by the user through links on the website).
DATA CONTROLLER
The Data Controller (i.e. the person who determines the purpose and means of processing of personal data, “Controller”) is Merano 2000 Funivie SpA , based in a Merano, I-39012, via Val di Nova, 37, C.F. IT00124390212, tel. +39 0473 234821.
For contacts specifically relating to the protection of personal data, we indicate in particular the e-mail address privacy@merano2000.com to which you may address any requests.
BROWSING DATA OF THE USER
The IT systems and computer programs used for the operation of the website collect some personal data whose transmission is implied in the use of Internet communication protocols (e.g. the IP addresses or the domain names of computers used by users who connect to the website, the URI -Uniform resource Identifier- addresses of the requested resources, the time of the request, the method used to submit the request to the server, the dimension of the file obtained, the numerical code indicating the status of the response sent by the server (successful, error, etc.), and other parameters related to the operating system and the user's computing environment). Although the information is not collected in order to associate it to specific users, by their nature and through processing and association with further data held by third parties, such data may permit to identify users.
Such data shall only be used for statistical purposes, without associating them to any identifier of the users, to ensure the correct operation of the website and are deleted immediately after processing. Such data may also be used for the purposes of investigating liabilities in the event of information crimes committed against the website.
The legal basis of the processing is therefore the legitimate interest in the operation and security of the website.
COOKIES
The website uses cookies for which there is a reference to the specific information.
COMMUNICATIONS WITH THE CONTROLLER
No provision of personal data by the user is required in order to consult the site. However, any contact with the Data Controller, or the optional, explicit and spontaneous sending of messages, by electronic or traditional mail, to the addresses of the Data Controller indicated on the site entails the subsequent acquisition of the address, including e-mail, of the sender, necessary to respond to requests, as well as any other personal data included in the relative communications. Such data will be used for the sole purpose of responding to the user's request and may be communicated to third parties only if necessary for that purpose.
The processing of personal data will be done by personnel trained and authorized by the Controller with procedures, technical and information tools suitable to protect the confidentiality and security of the data.
Such personal data are stored for the time strictly necessary to provide the Data Subject with answers to his/her requests, without prejudice to further storage obligations provided for by law.
Personal data will not be disseminated.
NEWSLETTER
The user can subscribe to our newsletter, via the specific section of the Website, by indicating his/her email address to receive periodic information concerning the products and services of the company; in that case, the processing of personal data for this purpose will take place based on the consent of the concerned person, who can withdraw it at any time.
It should be noted that consent (with the right to revoke it) is also a necessary legal basis in relation to legal persons. The data will be processed for this purpose until the consent is revoked (deletion from the newsletter) and in any case no later than 48 months after the consent has been given or renewed.
“SHOP ONLINE” PAGE
The user, if desired, can access the Purchases area after registering the required personal data and signing the contract.
By registering on the site it will be possible to purchase products through the e SHOP section.
In this case, the following data are processed, all belonging to the category of common data:
surname, first name, date and place of birth, residence;
tax code and/or VAT number;
telephone number/e-mail address;
destination address;
description of the order and product purchased.
The data subject to processing are provided by the customer or are the result of public registers (such as the Chamber of Commerce or the registry office).
The data are processed for purposes strictly related to the management of the pre-contractual and contractual relationship, including administrative, accounting and tax formalities and obligations (for example: acquisition of preliminary information at the conclusion of the contract; execution of activities on the basis of the obligations derived from the contract concluded) and the management of litigation (contractual purposes).
There is no obligation to provide data in the pre-contractual phase, but failure to provide it will make it impossible to formulate a quote or conclude the contract; once the contract has been stipulated, the provision of further necessary data, or the updating of those already provided, is mandatory for all that is required by legal and contractual obligations and, therefore, any refusal to provide them in whole or in part may make it impossible for the Data Controller to execute the contract and could in any case constitute a breach of contract or violation of the law (if such data are necessary for the fulfilment of obligations regulatory or regulatory provisions) by the supplier.
The legitimacy to process the data in question derives from the fact that it is necessary to execute the contract to which the Data Subject is a party or the pre-contractual measures adopted at the request of the same, as well as for the fulfilment of a legal obligation to which the Data Controller is subject.
The data provided by the data subject may also be processed for the sending of e-mail information relating to the direct sale of products or services similar to those already provided, under the conditions provided for in paragraph 4 of art. 130 of Legislative Decree 196/2003 (Privacy Code) and subsequent amendments. The Data Controller may therefore transmit, through the e-mail coordinates provided in the context of a previous purchase, communications relating to the direct sale of products or services similar to those already purchased on that occasion, which is permitted unless the recipient, adequately informed, refuses such use, initially or on the occasion of subsequent communications; in the latter case, the processing has as its legal basis the legitimate interest of the Data Controller in e-mail communications to its Customers, concerning products or services similar to those already provided.
As regards the contractual purpose, the data will be stored for the entire duration of the contractual relationship, and, after the termination of the relationship – limited to the data necessary at that point – for the extinction of the contractual obligations assumed and for the fulfilment of all possible legal obligations and for the protection needs, including contractual ones, connected or deriving from it. As regards the marketing purpose, the processing may last until the recipient objects, but in any case no later than 36 months from the last purchase.
The processing of personal data will be carried out by personnel trained and authorised by the Data Controller with procedures, technical and IT tools suitable for protecting the confidentiality and security of the same.
WORK WITH US
The “Work with us” of the Website allows those interested to apply for possible job positions. The processing of personal data takes place as part of the application management process aimed at identifying the people to be included in the company's staff and assessing that they are in line with the company's needs, to then proceed with any contact for the purpose of a selection interview.
For the needs of the application management process through the form of the dedicated website, the following categories of data may be processed:
Name, surname, residential address, e-mail, telephone, Curriculum Vitae, free information left by the candidate.
The provision of the requested data is optional, however failure to provide the data will make it impossible for the Data Subject to participate in the personnel selection process carried out by the Data Controller.
The legal basis for the processing of data is that it is necessary to implement the pre-contractual measures in the context of the selection procedure in which the Data Subject participates by spontaneously sending his or her information.
At the first useful contact, the Data Subject will be provided with specific information regarding the processing of data relating to the selection of personnel.
PROCESSING MODALITIES AND COMMUNICATION OF THE DATA TO THIRD PARTIES
The data are not subject to dissemination and may be communicated to collaborators, suppliers of the Controller, in the context of their duties and/or contractual obligations relating to the execution of the contractual relationship with the interested parties; among the suppliers of the Controller there are, for example, banking and credit institutions, insurance companies, legal advisors; software providers and related assistance, subjects carrying out shipments and delivery; financial administration and other entities for which mandatory communications are foreseen. Processing will be carried out:
Through the use of manual and automated systems;
by entities or categories of authorized people in order to fulfil their duties,
with the use of appropriate measures to ensure the confidentiality of data and to avoid access to them by unauthorised third parties.
Without prejudice to what indicated in the specific sections above, in the context of your activity and for the above-mentioned purposes, the Controller may make use of services rendered by third parties operating either as independent Controllers or on behalf of and in accordance with the instructions of the Controller, as Data Processors pursuant to Article 28 of the Regulation. These are subjects that provide the Controller with processing or instrumental services.
The person concerned may request a complete and updated list of the appointed Data Processors by contacting one of the contacts of the Controller.
All the subjects to which the faculty of access to such data is recognized by virtue of normative measures can have access to such data.
TRANSFER OF DATA ABROAD
It is not intended to transfer personal data to non-EU countries or to International Organisations. If, for specific technical reasons, the Controller transfers the data to third countries in order to ensure an adequate level of data protection, this is done in accordance with the following conditions: transfer on the basis of an adequacy decision, transfer subject to adequate safeguards, binding corporate rules or application of exemptions provided for specific situations.
RIGHTS OF THE INTERESTED PARTIES
The GDPR gives the person concerned the exercise of the following rights with reference to the personal data concerning him/her (the summary description is indicative, the complete statement of the rights can be found in the Regulation, in particular in Artt. 15-22):
Access to personal data (the concerned person will therefore have the right to have free information about the personal data held by the Controller and about the related processing, and to obtain a copy in an accessible format);
Rectification of data (we will provide, on recommendation of the concerned person, the correction or integration of your data – which are not an expression of evaluative elements – incorrect or inaccurate, even if they have become so, because they have not been updated);
Erasure (right to be forgotten) (for example, data are no longer needed with regard to the purposes for which they were collected or processed; they have been illegally processed; they must be deleted in order to fulfil a legal obligation; the concerned person has withdrawn the consent and there is no other legal basis for processing the data; the person objects to processing, if there are the conditions);
Right to restrict processing (in certain cases – objecting the accuracy of the data, during the time required for verification; objecting the lawfulness of processing with opposition to the erasure; need of use for the rights of defence of the concerned person, while they are no longer useful for processing; if there is objection to processing, while the necessary verifications are carried out – the data will be stored in such a way in order to be able to be restored, but, in the meantime, they are not available to the Controller except in relation to the validity of the restriction request of the concerned person, or with the consent of the person or for the assessment, exercise or defence of a right in court or to protect the rights of another natural or legal persons or for reasons of relevant public interest of the Union or of a member State);
Right to object to processing carried out on the base of legitimate interest, in full or in part for legitimate reasons, (in certain circumstances the concerned person may however object to processing of his/her data, in particular, if the personal data is processed for direct marketing purposes, he/she have the right to object to processing at any time, including profiling to the extent that it is connected to such direct marketing);
Data portability (if processing is based on consent or on a contract and is carried out by automated means, on request, the concerned person will receive his/her personal data in a structured format, in common use and readable by an automatic device, and he/she may transmit them to another Controller, unimpeded by the Controller which has provided them and, if technically feasible, the concerned person can obtain that such transmission is made directly by the latter);
Withdrawal of consent (if the processing takes place by virtue of the consent expressed by the person concerned, he/she may withdraw the consent at any time without prejudice to the lawfulness of the processing provided before the withdrawal);
Complaint to the supervisory authority (Garante per la protezione dei dati personali – Garante Privacy). The Garante per la protezione dei dati personali can be contacted via the contacts indicated in the website of the Authortity “www.garanteprivacy.it”).
EXCERCISE OF RIGHTS
The Data Subject may exercise the rights by making a request to the Controller at the following e-mail addresse: privacy@merano2000.com
The Controller may modify or update the content in whole or in part, also considering any changes in the rules on the protection of personal data. We therefore invite the persons concerned to consult this page regularly so that they are aware of the processing processes.