GDPR – Information on the processing of personal data and consent to their acquisition

 

Introduction
The Travel Agency TheWowFactor (High End Leisure srl, hereinafter also “ADV”), as data controller, pursuant to art. 13 of the General European Regulation on the Protection of Personal Data 679/2016 (hereinafter the “GDPR”), provides the following information about the processing of personal data that you, as an interested party, has communicated to us:
a. for the organization of a tourist package;
b. to facilitate the purchase of related tourist services;
c. for intermediation in the purchase of a tourist package organized by third parties or individual tourism services provided by third-party suppliers (eg hoteliers, carriers);
d. for intermediation in the purchase of ancillary financial services/insurance and linked to packages/tourist services facilitated or purchased individually (medical policies – baggage, cancellation, assistance to the traveler in difficulty, financing consumer credit);
e. to fulfill the task of issuing visas;
f. to register on our website and/or the app or fill out the forms on the website or in the app.

 

Purpose and legal basis of the processing
Furthermore, among the data provided by you there could also be some personal data defined by the GDPR and by the Italian harmonization legislation as “particular” (eg health, judicial). Sensitive/particular data will be processed according to the purposes indicated below and only with your express consent.
a) Purpose relating to contractual performance.
Your personal data will be processed for the fulfillment of the obligations arising from the negotiation and the contract relating to the organization of the tourist package, or the mandate to facilitate the purchase of related tourist services or the brokerage mandate for the purchase of individuals tourist services or anyway for the performance of obligations arising from all contractual relationships, including the phase of negotiations, indicated in the previous letters a) to f), in order to allow the ADV to provide optimal performance, in particular for:
i. the conclusion, management and execution of contractual relations between you and the ADV;
ii. answer your requests;
iii. the communication of notices, relating to the package or services purchased tourists or other additional services and accessories (eg. information on the purchased tourist services, modification of the contractual conditions, cancellations);
b) Law purposes.
Your personal data will also be processed for:
i. execute legal obligations, regulations, national, EU and international regulations or deriving from provisions issued by Authorities legitimated by the law;
ii. ascertain, exercise and/or defend in litigation, including judicial, a right of ADV;
iii. fulfill the obligations foreseen in the fiscal and accounting fields;
iv. fulfill the obligations related to the legislation on the safety and health of travelers;
v. fulfill the obligations related to passenger and freight transport regulations.
c) Purposes related to business and statistics.
Your personal data will also be processed for purposes relevant or pertinent to the activity carried out by the ADV and for the anonymous processing of statistics and market research.
d) Marketing purposes.
Furthermore, if you expressly consent to it, your personal data will be processed for marketing purposes, which include:
a. Promotional activities of the ADV, and/or commercial partners, realized both with automated methods (eg email, text messages, instant messaging applications, etc.) and with non-automated methods (eg. postal mail, telephone with operator, etc.) In particular, the ADV may use your email address, provided at the time of purchase of packages or tourist services, to transmit information and promotional communications related to the services and products similar and offered by the ADV and/or commercial partners even without your consent, provided you do not object to such use.
The business partners belong to the following product categories:
a. accommodation activities;
b. airlines / shipping companies; railway carriers; vectors on rubber;
c. travel agencies and travel agency networks;
d. insurance.
b. Profiling activity, that is, analysis of your travel preferences and market research in order to improve the services offered and the commercial information presented by us, making them more compliant with your interests. This activity may also take place through the administration of satisfaction questionnaires and / or the use of profiling cookies used during navigation on our sites and apps.
The processing for Marketing Purposes (ie both for promotional and profiling activities) can only take place with your consent.

 

Nature of the provision of data and consequences of any refusal
The provision of your personal data is optional, however, in the absence of the data required for the purposes indicated in points a) and b) (purposes related to the contractual and legal performance) the requested performance or part of it can not be performed and you do not will be able to take advantage of the opportunities mentioned above. The provision of optional data will allow ADV to improve the services offered in order to make them increasingly respond to the personal interests of its customers. The provision of sensitive / particular personal data is voluntary; however, in the absence of such consent, the ADV may not be able to fulfill certain contractual obligations related to the processing of such data.

 

Categories of recipients of personal data
Your information will not be disseminated. Your data may be communicated, exclusively for the purposes mentioned above, to the following categories of subjects:
i. the internal staff of the ADV, as the person in charge and / or in charge of the processing;
ii. to the suppliers of tourist services included in the packages sold, or who lend the connected or individual services purchased at the ADV;
iii. to insurance companies that provide ancillary coverage and associated with the packages and tourist services purchased;
iv. individuals, companies, associations or professional firms that provide services or assistance and counseling activities in favor of the ADV in order to protect their own right (for example, accountants, lawyers, tax consultants, auditors, consultants in the field of auditing operations o due diligence, etc.);
v. people, companies, or agencies that provide marketing and analysis services or consultancy services in favor of the ADV;
vi. subjects whose right to access your data is recognized by provisions of the law and secondary legislation or by provisions issued by Authorities legitimated by the law, including airport, port, customs and border authorities.

 

Transfer of personal data outside the European Union
Your personal data may be transferred abroad to third party companies belonging to the European Union or not, always for the purposes indicated above.
In case of data transfer to countries outside the European Union, these countries will guarantee an adequate level of protection based on a specific decision of the European Commission or alternatively the recipient will be contractually obliged to the data protection with an appropriate level and comparable to the protection provided by the GDPR.

 

Storage of personal data
Personal data will be stored for a period not exceeding that necessary to achieve the purposes for which they were collected and subsequently processed. Personal data will be kept for the entire duration of the contract you have concluded and also for a subsequent period:
i. within the terms established by current legislation;
ii. within the terms established by the secondary legislation that require data retention (for example, tax returns);
iii. within the period necessary to protect the rights of the data owner in the event of any disputes related to the provision of the service.
Personal data collected and processed for profiling purposes will be kept for a maximum period of ten (10) years after which they will be automatically deleted or permanently anonymised.

 

Owner and manager of the treatment
The Data Controller is the Travel Agency TheWowFactor based in 20123 Milan, Corso Magenta No. 82, with legal representative Mr. Roberto Stagnetti.

 

Data Protection Officer
The appointed Data Protection Officer is Mr. Roberto Stagnetti contacted at the following addresses: mail info@thewowfactor.it  PEC highendleisure@legalmail.it  or by registered mail at the registered office in 20123 Milan, Corso Magenta no. 82.

 

Rights of the interested party
At any time, pursuant to articles 15 to 22 of the GDPR You have the right, also in relation to the profiling activity, of:
i. ask the holder for access to your personal data and information relating to them; the correction of inaccurate data or the integration of incomplete data; the cancellation of personal data concerning you (upon the occurrence of one of the conditions indicated in article 17, paragraph 1 of the GDPR and in compliance with the exceptions provided for in paragraph 3 of the same article); the limitation of the processing of your personal data (on the use of one of the hypotheses indicated in Article 18, paragraph 1 of the GDPR);
ii. request and obtain from the owner – in the cases in which the legal basis of the treatment is the contract or consent, and the same is done by automated means – your personal data in a structured and readable format by automatic device, also in order to communicate such data to another data controller (so-called portability of personal data);
oppose at any time the processing of your personal data to the occurrence of particular situations that affect you;
iii. withdraw consent at any time, limited to the cases in which the processing is based on your consent for one or more specific purposes and concerns common personal data (for example date and place of birth or place of residence), or particular categories of data (for example, data revealing your racial origin, your political opinions, your religious beliefs, your health status or your sex life). The treatment based on consent and carried out prior to the revocation of the same preserves, however, its lawfulness;
iv. propose a complaint to a supervisory authority (Authority for the protection of personal data – www.garanteprivacy.it).

 

Consent to treatment
NOTE: The Customer have the right to express his/her consent choice about all the options described. Please see the downloadable pdf form.