Information pursuant to Articles 13 and 14 of EU Regulation 2016/679

Dear Data subject,

Pursuant to Articles 13 and 14 of the European Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter, "GDPR"), the 3 Tre Committee and Madonna di Campiglio Azienda per il Turismo S.p.A., in their capacity as Joint Data Controllers, intend to provide you with the following information:

Joint Data Controllers

Committee 3 Three
Via Pradalago, 4 - 38086 Madonna di Campiglio TN
VAT 02043920228
tel. +39046544072
Mail: info@3trecampiglio.it

Contact details of the Data Protection Officer: dpo@3trecampiglio.it
Madonna di Campiglio Azienda per il Turismo S.p.A.
Via Pradalago 4
38086 - Madonna di Campiglio (TN)
Tel.: +39 0465 931015
Mail: info@campigliodolomiti.it
VAT 01854660220

Contact details of the Data Protection Officer: dpo@campigliodolomiti.it

An internal Joint Data Controllership agreement was concluded between the aforementioned Joint Data Controllers outlining their respective responsibilities, pursuant to Article 26 of the GDPR.

Purpose and legal basis of the data processing

The user's personal data will be processed for the following purposes and on the following legal bases:

1. to conclude and properly perform the contract to which you are a party, for participation in events organised by Contitolari and/or for the services/products requested and/or purchased; the legal basis for the processing operations listed is Art. 6 par. 1 lett. b) of EU Regulation 2016/679;

2. send e-mails and/or newsletters and communications relating to the services and activities offered and promoted by the Joint Data Controllers, of the same type as those previously used by the data subject, unless the data subject refuses to do so, which may be opposed at any time; the legal basis for this type of processing is the legitimate interest of the Joint Data Controllers as provided for in Article 6(1)(f) of the GDPR;

3. to send periodically, via remote communication technologies (mail, telephone, sms, whatsapp), newsletters and communications about services, products and activities offered by the Contractors; to carry out market research to develop and improve our range of products, services and activities; the legal basis is represented by consent as provided for in Article 6 par. 1 letter a) of EU Regulation 2016/679;

4. to send periodically, via remote communication technologies (mail, telephone, sms, whatsapp), newsletters and communications about services, products and activities offered by the partners and sponsors of the Joint Owners, which we believe may be of your interest; the legal basis is represented by your consent as provided for in Article 6 par. 1 letter a) of the EU Regulation 2016/679;

5. to ascertain, exercise or defend a right in court; the legal basis for this type of processing is the legitimate interest of the Data Controllers as provided for in Article 6(1)(f) of EU Regulation 2016/679;

6. to comply with obligations under the law, a regulation, EU legislation or an order of the Authority; the legal basis for this type of processing is represented by the legitimate interest of the Data Controllers as provided for in Art.6 par.1 lett.c) of the EU Regulation 2016/679.

Type of data.

Data necessary for the conclusion and fulfilment of the contract to which you are a party will be collected and processed.

Data may also be collected and processed for the purpose of periodically informing you about the activities of the Contractors and their partners.

Data processed (hereinafter, the 'Data'):

Refusal to provide data

The provision of the Data is necessary because, any refusal to provide it, could result in the impossibility of establishing the contractual relationship or the incorrect fulfilment of the contract to which the Data Subject is party and/or the failure to comply with the legal obligations to which the Data Subject is subject.

The provision of Data for the processing that requires your consent is optional; failure to provide such Data will not result in the impossibility of being able to take advantage of the services offered by the Joint Data Controllers. Even in the event of consent, the Data subject shall in any case have the right to object subsequently, in whole or in part, to the processing of his/her Personal Data for the purposes set out above, by making a simple request to the Data Controllers at the addresses indicated above.

Data source

Data will be provided by you or collected from third parties.

Data processing methods

In accordance with the provisions of Article 5 of the Regulation, the Personal Data to be processed will be:

(i) processed lawfully, fairly and transparently in respect of the Data Subject;

(ii) collected and recorded for specified, explicit and legitimate purposes, and subsequently processed in terms compatible with those purposes;

(iii) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

(iv) accurate and, if necessary, updated;

(v) processed in a manner that ensures an adequate level of security;

(vi) kept in a form which permits identification of the Data Subject for a period of time not exceeding the fulfilment of the purposes for which they are processed.

The processing will be carried out using manual and/or computerised and telematic tools with organisational and processing logics strictly related to the purposes themselves and in any case in such a way as to guarantee the security, integrity and confidentiality of the data themselves in compliance with the organisational, physical and logical measures laid down by the provisions in force.

Communication of data.

Personal data may be communicated to the subjects authorised to process the data, as well as to the external data processors appointed by the Joint Data Controllers (the complete list of external data processors is available from the Joint Data Controllers), who are in charge of managing the purposes set out above. In the pursuit of the above-mentioned purposes, the data may be communicated to other subjects acting as autonomous data controllers.

The data may be communicated to:

The information may also be disclosed whenever it may be necessary to comply with requests from the Judicial or Public Security Authorities.

Data Dissemination

The data will not be disseminated.

Data transfer abroad

For the above purposes, Personal Data will be processed within the European Economic Area (EEA). Should Personal Data be transferred to Third Countries, in the absence of an adequacy decision by the European Commission, the requirements of the applicable legislation on the transfer of Personal Data to Third Countries, such as the Standard Contractual Clauses provided by the European Commission, will still be respected.

Data retention.

In general, Personal Data shall be kept for the time strictly necessary for the purposes for which it was collected and processed, including the retention period required by applicable legislation and, in any case, for a maximum period of 10 years after the termination of our relationship in relation to the purposes of contractual fulfilment and for a maximum period of 2 years for the purposes for which your consent is required, except where the Data Controller needs to defend its own right in court.

Rights of the data subject.

Pursuant to EU Regulation 2016/679 Articles 15 et seq. and the national legislation in force, the Data Subject may, in the manner and within the limits provided for by the legislation in force, exercise the following rights:

Right	Description	Prerequisites	How to exercise it
Art. 15 The data subject's right of access	The data subject has the right to obtain from the controller confirmation as to whether or not personal data relating to him are being processed and, if so, to obtain access to the personal data and the following information: the purposes of the processing;the categories of personal data in question;the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organisations;where possible, the intended period of retention of personal data or, if this is not possible, the criteria used to determine that period;the existence of the data subject's right to request from the controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning him or her or to object to their processing;the right to lodge a complaint with a supervisory authority;where the data are not collected from the data subject, all available information on their origin;the existence of an automated decision-making process, including profiling as referred to in Article 22(1) and (4), and, at least in such cases, meaningful information on the logic used, as well as the importance of such processing for the data subject and the envisaged consequences thereof. Where personal data are transferred to a third country or international organisation, the data subject has the right to be informed of the existence of appropriate safeguards within the meaning of Article 46 relating to the transfer. The data controller shall provide a copy of the personal data undergoing processing. In case of further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. If the data subject makes the request by electronic means, and unless otherwise specified by the data subject, the information shall be provided in a commonly used electronic format.	The right to obtain a copy of one's personal data must not infringe the rights and freedoms of others.	The data subject may exercise the right by sending a request to the contact details of the Joint Data Controllers. In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the person concerned. Before providing a reply, the holder may need to identify the data subject, since the right can only be exercised by the data subject or his/her delegate.
Art. 16 Right of rectification	The data subject shall have the right to obtain from the controller the rectification of inaccurate personal data concerning him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, also by providing a supplementary declaration.	Processing of inaccurate and/or incomplete data	The data subject may exercise the right by sending a request to the contact details of the Joint Data Controllers. In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the person concerned. Before providing a reply, the holder may need to identify the data subject, since the right can only be exercised by the data subject or his/her delegate.
Art. 17 Right to erasure ('right to be forgotten')	The data subject shall have the right to obtain from the controller the erasure of personal data concerning him/her without undue delay and the controller shall be obliged to erase the personal data without undue delay. Where the controller has made personal data public and is obliged under the preceding paragraph to erase them, the controller shall, taking into account available technology and the costs of implementation, take reasonable measures, including technical measures, to inform the controllers who are processing the personal data of the data subject's request to erase any link, copy or reproduction of his or her personal data.	The right may be exercised if one of the following grounds exists: personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) and if there is no other legal basis for the processing;the data subject objects to the processing pursuant to Article 21(1) and there is no overriding legitimate ground for processing, or objects to the processing pursuant to Article 21(2);personal data have been unlawfully processed;personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the data controller is subject;the personal data have been collected in connection with the offering of information society services as referred to in Article 8(1) (Where Article 6(1)(a) applies, as regards the direct offering of information society services to children, the processing of personal data relating to a child is lawful where the child is at least 16 years old. Where the child is below 16 years of age, such processing shall be lawful only if and to the extent that such consent is given or authorised by the holder of parental responsibility. Member States may lay down by law a lower age for these purposes provided that it is not less than 13 years of age). The right to erasure does not apply to the extent that the processing is necessary: for the exercise of the right to freedom of expression and information;for compliance with a legal obligation to which the processing is subject under Union or Member State law or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;for reasons of public interest in the field of public health in accordance with Article 9(2)(h) and (i) and Article 9(3);for archiving purposes in the public interest or for scientific or historical research or statistical purposes in accordance with Article 89(1), insofar as the right referred to in paragraph 1 is likely to render impossible or seriously jeopardise the attainment of the objectives of such processing; orfor the establishment, exercise or defence of legal claims.	The data subject may exercise the right by sending a request to the contact details of the Joint Data Controllers. In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the person concerned. Before providing a reply, the holder may need to identify the data subject, since the right can only be exercised by the data subject or his/her delegate.
Art. 18 Right to restriction of processing	The data subject has the right to obtain from the data controller the restriction of processing Where processing is restricted pursuant to the preceding paragraph, such personal data shall, except for storage, only be processed with the consent of the data subject or for the establishment, exercise or defence of legal claims or the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State. A data subject who has obtained a restriction of processing pursuant to the initial paragraph shall be informed by the controller before that restriction is lifted.	The right may be exercised if one of the following grounds exists: the data subject contests the accuracy of the personal data, for the period necessary for the controller to verify the accuracy of such personal data;the processing is unlawful and the data subject objects to the deletion of the personal data and requests instead that their use be restricted;although the data controller no longer needs them for the purposes of processing, the personal data are necessary for the establishment, exercise or defence of a legal claim;(d) the data subject has objected to the processing pursuant to Article 21(1), pending verification as to whether the legitimate reasons of the Data Controller prevail over those of the data subject.	The data subject may exercise the right by sending a request to the contact details of the Joint Data Controllers. In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the person concerned. Before providing a reply, the holder may need to identify the data subject, since the right can only be exercised by the data subject or his/her delegate.
Art. 19 Obligation to notify in case of rectification or erasure of personal data or restriction of processing	The controller shall communicate to each recipient to whom the personal data have been transmitted any rectification or erasure or restriction of processing carried out pursuant to Article 16, Article 17(1) and Article 18, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject of such recipients if the data subject so requests.		The data subject may exercise the right by sending a request to the contact details of the Joint Data Controllers. In order to be able to provide a positive response to the request, it is necessary to provide the information required to identify the person concerned. Before providing a reply, the holder may need to identify the data subject, since the right can only be exercised by the data subject or his/her delegate.
Art. 20 Right to data portability	The data subject has the right to receive in a structured, commonly used and machine-readable format the personal data concerning him/her that he/she has provided to a data controller and he/she has the right to transmit these data to another data controller without hindrance from the data controller to whom he/she has provided them. When exercising his or her data portability rights under the preceding paragraph, the data subject has the right to obtain direct transmission of personal data from one controller to another, if technically feasible The exercise of the right referred to in the opening paragraph is without prejudice to Article 17 - Right to erasure ("right to be forgotten").	The right may be exercised if one of the following grounds exists: the processing is based on consent within the meaning of Article 6(1)(a) or Article 9(2)(a) or on a contract within the meaning of Article 6(1)(b); andthe processing is carried out by automated means This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The exercise of the right must not infringe the rights and freedoms of others.	The data subject may exercise the right by sending a request to the contact details of the Joint Data Controllers. In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the person concerned. Before providing a reply, the holder may need to identify the data subject, since the right can only be exercised by the data subject or his/her delegate.
Art. 21 Right of objection	The data subject has the right to object at any time. The data controller shall refrain from any further processing of personal data unless he can demonstrate compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him/her carried out for such purposes, including profiling insofar as it is related to such direct marketing. If the data subject objects to processing for direct marketing purposes, the personal data are no longer processed for those purposes. Where personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1), the data subject shall have the right, on grounds relating to his or her particular situation, to object to the processing of personal data relating to him or her, except where the processing is necessary for the performance of a task carried out in the public interest.	The right may be exercised if one of the following grounds exists: reasons related to its particular situation, the processing of personal data concerning him or her in accordance with Article 6(1)(e) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller) or (f) (processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or a third party, provided that the interests or the fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child, are not overridden), including profiling on the basis of those provisions	The data subject may exercise the right by sending a request to the contact details of the Joint Data Controllers. In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the person concerned. In the context of the use of information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using specific techniques. Before providing a reply, the holder may need to identify the data subject, since the right can only be exercised by the data subject or his/her delegate.

In general, in order to exercise their rights, the data subject may contact the Joint Data Controllers by writing to the above-mentioned addresses.

Before providing a response, the Joint Data Controllers may need to identify the data subject.

Written feedback will be provided without undue delay and, in any case, no later than one month after receipt of the request.

Complaint

In the event that the data subject considers that the processing of his or her personal data violates the provisions of EU Regulation 2016/679, he or she has the right to lodge a complaint with the Italian Data Protection Authority based in Rome, pursuant to Article 77 of the Regulation itself, as well as to appeal to the judicial authorities.

Website credits