Information in accordance with articles 13 & 14 of the EU Regulation 679/2016

On this page you will find the privacy policy of this website and the way that we treat personal data. Information is also supplied in accordance with articles 13 & 14 of the EU Regulation 679/2016.

The information supplied applies to this website only and not to any sites that may be visited the links provided.

EU Regulation 679/2016 with regard to personal data protection (hereafter referred to as the “Regulation”) states the rules for the protection of the natural person with regard to the processing of personal data, including the rules regarding the free movement of such data and protects the fundamental rights and freedom of the natural person regarding in particular the right to personal data protection.

Article 4 n.1 of the Regulation states that by the term “personal data” it intends any information about an identified or identifiable natural person (hereafter referred to as “the interested party”)

By “treatment” we intend any operation or series of operations carried out, with or without automated systems, on personal data such as collection, registration, organization, storage, adaptation or alteration, extraction, consultation, use, transfer, distribution or any other form of disclosure, comparison or interlinking, restriction, disposal or destruction (art. 2 of Regulation)

In accordance with art. 12 and ss of the Regulation, it is also envisaged that the interested party must be given the appropriate information relating to the processing activities that are carried out by the data controller and of the rights of the interested parties.

Data controller

Molveno Holiday S.cons.r.l.
3, Piazza Marconi
Italy, 38018 Molveno - TN
P.IVA - C.F IT01901050227

Email: info@molveno.it

Purposes of processing and legal basis for processing

The user’s personal data will be processed in pursuit of purposes and on the legal basis indicated below:

1. for the conclusion and correct execution of the contract in which the Data Subject is one of the Parties, or the execution of precontractual measures adopted on their request, for requested information and/or services/products, including subscriptions to newsletters; the legal basis for the processing listed is represented by Article 6 paragraph 1 letter b) of EU Regulation 679/2016;
2. to respond to requests sent by the user by mail and/or forms present on the website; the legal basis for the listed processing is represented by Article 6 paragraph 1 letter b) of EU Regulation 679/2016;
3. to send, periodically, commercial communications concerning services, products and activities offered by the Data Controller using remote technologies (mail, telephone, SMS, WhatsApp); the legal basis is represented by consent as provided for by Article 6 paragraph 1 letter a) of EU Regulation 679/2016;
4. to make navigating the site functional and possible, as well as ensuring that it has an adequate degree of availability; the legal basis for this type of processing in represented by the legitimate interests of the Controller as provided for by Article 6 paragraph 1 letter f);
5. the analysis of statistical data on aggregated or anonymous data for the purpose of monitoring that the site, traffic usability and interest is functioning correctly; the legal basis for this type of processing is represented by the legitimate interest of the Controller, as stipulated by Article 6, paragraph 1 letter f);
6. to ascertain, exercise or defend a right in court; the legal basis for this type of processing is represented by the legitimate interests of the Controller, as provided for by Article 6 paragraph 1, letter f);
7. to fulfill the obligations stipulated by law, regulations or EU legislation or by an order of the Authority to which the Data Controller is subject; the legal basis for this type of treatment is the fulfillment of the legal obligation as provided for by art.6, paragraph 1, letter c);

Type of Data

Data will be collected and processed for the above mentioned purposes:

• identification data
• contact data
• data relative to contractual relationship
• data relative to the preferences and interests of the interested party

Navigation Data

The computer system and software procedures used to operate this website, while they are functioning, collect some personal information, the processing of which is implicitly connected with internet protocols. This kind of information is not acquired for purposes linked to identifiable data subjects but could, by virtue of its very nature, be processed and aggregated with the data held by third parties in such a way as to make user identification possible. IP addresses fall under this category as well as domain names relating to the computer used by persons logging onto the website, URI addresses (Uniform Resource Identifier) of the resource requested, time of the request, method used to submit the request to the server, dimension of the file obtained in response, numerical code indicating the state of the response given by the server (successful, error etc) and other parameters relating to the operating system and the user’s computer environment. This data is only used to obtain anonymous statistical information on the use of the website and to check the correct functioning of the website. The thus acquired data is deleted immediately after processing.

Data could also be used to determine liability should a cyber offence be committed damaging the website.

Refusal to provide personal data

Apart from what has been stated for navigation data, users/visitors are free to provide their personal data. The provision of data is necessary in certain cases, in so much as a refusal to provide data could result in an inconclusive result or the failure to fulfill

a contract in which the interested party is a party and/or a failure to fulfill the legalities to which the controller is bound. Provision of data for processing that requires consent is optional, a refusal in this case will not result in the impossibility to use a product or service offered by the controller. Also where permission is given, the interested party will have the subsequent opportunity in whole or in part to refuse the processing of his/her personal data for the above mentioned purposes, simply by making the request to the controller at the above contact details.

Data Source

Data provided by the interested person or collected by third parties.

Processing Method

In accordance with art.5 of the Regulation, the personal data being processed will be:

1. treated in a lawful, correct and transparent manner towards the interested party
2. collected and registered for a defined, explicit and legitimate purpose and subsequently processed for that precise purpose.
3. appropriate, pertinent and limited to that which is necessary for the purpose for which it is processed.
4. exact and updated as necessary
5. processed in a manner that guarantees an adequate level of security
6. conserved in a form that allows identification of the interested party for a period of time no longer than that strictly needed to complete the purpose for which they are processed.

The processing will be carried out using manual and/or computer and telecommunications methods with logical organizational modalities and strictly connected with and limited to the specified purposes and in all cases, in a way that guarantees the security, integrity and confidentiality of the data in compliance with the organizational, physical and logical measures required by current regulations.

Communication of data

Personal data may be communicated to duly authorized persons as well as external suppliers appointed by the controller for the management of above mentioned processing (the complete list of external data processors is available from the controller). Subject to his consent, data may also be communicated to third sponsor/partner parties of the controller who will be authorized to use such data for purposes set out in n. 3) of the section “Purpose of Processing” above.

In the context of pursuing the purposes stated above, the data may be communicated to other parties acting as autonomous controllers.

Disclosure of data

Personal data will not be disclosed.

Transfer of data abroad

For the above mentioned purposes, personal data will be processed within the European Economic Area (EEA). If they were to be transferred to third countries, in the absence of a decision of appropriateness by the European commission, they will still comply with the requirements of the applicable legislation on the transfer of Personal Data to third countries, such as the Standard Contractual Clauses provided by the European Commission.

Storage of Data

In general, data will be stored for the time strictly necessary for the pursuit of the purposes for which they were collected and subjected to Processing, including the retention period required by relevant legislation and, in any case, for a maximum period of 10 years from the end of the relationship with the Data Controller and for a maximum period of 2 years for the purposes for which your consent is requested, except for the possible need of the Data Controller to defend his rights in court.

Rights of the interested party

In accordance with the EU Regulations 679/2016 art. 15 and ss and current national legislation, the interested party may, in the manner and within the limits stated by current legislation, exercise the following rights:

• Art 15 The Right to be informed

  Description
  The interested party has the right to be informed by the processing controller whether or not his/her data is currently being processed and, if so, has the right of access to the personal data and the following information:

  • The purpose of the processing
  • The type of personal data in question
  The recipients or type of recipients to whom the data has been or will be communicated, in particular where recipients are in third
  • countries or international organisations
  • Where possible, the length of time the data will be stored, where not possible, the criteria used to establish the length of time
  The existence of the interested party’s right to ask the data controller to rectify or delete the personal data or to restrict the
  • processing of personal data concerning him or her or to oppose their processing
  • The right to lodge a complaint with data protection regulators
  • Where the data was not collected directly from the interested party, whatever information is available on the origin of the data

  The existence of an automated decision-making process, including profiling as referred to in Article 22 para. 1 and 4 and at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party. Where personal data are transferred to a third country or an international organization, the data subject shall have the right to be informed of the existence of adequate safeguards under Article 46 relating to the transfer. The data controller shall provide a copy of the personal data processed. Where additional copies are requested by the interested party, the controller may charge a reasonable fee based on administrative costs. Where the interested party makes the request by electronic means, and unless otherwise indicated by the interested party, the information shall be provided in a commonly used electronic format

  Assumptions
  The right to obtain a copy of your personal data must not infringe the rights and freedoms of others.

  How to exercise it
  The interested party can exercise this right by written request to email address

  To be able to provide a positive response to the request, the interested party must provide the information necessary to identify the interested party

  Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

• Art 16 Right to rectification

  Description
  The interested party has the right to request the data controller to rectify incorrect data without unjustified delay. Taking into account the purposes of the processing, the interested party has the right to obtain the integration of incomplete personal data, including by providing a supplementary statement.

  Assumptions
  Processing of incorrect and/or incomplete data

  How to exercise it
  The interested party can exercise this right by written request to email address

  To be able to provide a positive response to the request, the interested party must provide the information necessary to identify the interested party

  Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

• Art 17 Right to erasure

  Description
  The interested party has the right to request the data controller to cancel personal data without unjustified delay and the data controller has the duty to cancel the personal data without undue delay Where the controller has made personal data public and is obliged, in accordance with the preceding paragraph, to delete them, taking into account the available technology and the costs of implementation, he shall take reasonable steps, also technical, to inform the controllers who are processing the personal data of the interested party’s request to delete any link, copy or reproduction of his personal data.

  Assumptions
  The right may be exercised if one of the following reasons exists:

  • personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
  • the interested party withdraws the consent on which the processing is based in accordance with Article 6 paragraph 1 letter a) or Article 9 paragraph 2 letter a), and if there is no other legal basis for the processing;
  • the interested party opposes the processing as stated in Article 21, paragraph 1, and there is no overriding legitimate reason for processing, or opposes the processing as stated in Article 21, paragraph 2;
  • the personal data has been unlawfully processed;
  • the personal data must be deleted in order to comply with a legal obligation under European Union or Member State law to which the controller is subject;
  • the personal data has been collected in relation to the offer of the information services company referenced in Article 8(1) (where Article 6 paragraph 1 letter a)applies), regarding the direct offer of the information services company to minors, the processing of personal data of the child is lawful where the child is at least 16 years old. Where the child is under the age of 16, such processing shall only be lawful if and to the extent that such consent is given or authorised by the holder of parental responsibility. Member States may establish by law a lower age for these purposes provided that it is not less than 13.

  The right of cancellation does not apply to the extent that processing is necessary for:

  • exercising the right to freedom of expression and information;
  • the fulfilment of a legal obligation regarding processing under European Union or Member State law to which the controller is subject, or for the performance of a task carried out in public interest or during exercise of official authority vested in the Controller;
  • reasons of public interest in the field of public health in accordance with Article 9, paragraph 2, paragraphs h) and i), and Article 9, paragraph 3;
  • archiving for reasons of public interest, scientific or historical research or for statistical purposes in accordance with Article 89, to the extent that the right referred to in paragraph 1 risks rendering impossible or seriously affecting the achievement of the objectives of such processing;
  • the establishment, exercise or defense of a right in court.

  How to exercise it
  The interested party can exercise this right by written request to email address

  In order to be able to provide a positive reply to the request, the necessary identification details of the data subject must be provided.

  Before providing a response, the controller may need to identify the data subject as the right may only be exercised by the data subject or their delegate.

• Art 18 Right to the limitation of processing

  Description
  The interested party has the right to insist that the data controller limits the processing.

  Where processing is restricted in accordance with the preceding paragraph, such personal data shall be processed, except for the purpose of storage, only with the consent of the interested party or for the purpose of verification, the exercise or defence of a right in court or to protect the rights of another natural or legal person or on grounds of a major public interest of the Union or a Member State.

  The interested party who has obtained the restriction of processing in accordance with the initial paragraph shall be informed by the controller before the restriction is lifted.

  Assumptions
  The right can be exercised if one of the following is true:

  • the interested party contests the accuracy of their personal data, for the time necessary for the data controller to verify the accuracy of such data;
  • the processing is illegal and the interested party opposes cancellation of personal data and requests instead that such data be limited;
  • even if the data controller no longer needs the data for processing purposes, the personal data is necessary to the interested party for verification, exercise or defence of a right in a court of law;
  • the interested party is opposed to the processing in accordance with art.21 para 1 pending the verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.

  How to exercise it
  The interested party can exercise this right by written request to email address

  In order to be able to provide a positive reply to the request, the necessary identification details of the data subject must be provided.

  Before providing a response, the controller may need to identify the data subject as the right may only be exercised by the data subject or their delegate.

• Art. 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing

  Description
  The controller shall communicate to each of the recipients to whom the personal data have been transmitted any corrections or cancellations or limitations of the processing carried out in accordance with Article 16 of Article 17, paragraph 1, and Article 18, unless this proves impossible or involves a disproportionate effort. The controller shall notify the interested party of such recipients if the data subject so requests.

  How to exercise it
  The interested party can exercise this right by written request to email address

  To be able to provide a positive response to the request, the interested party must provide the information necessary to identify the interested party

  Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

• Art 20 Right of data on demand

  Description
  The interested party has the right to receive in a structured format, of common use and readable by automatic device the personal data relating to him/her provided to a data controller and has the right to transmit such data to another data controller without hindrance by the data controller to whom he/she has provided them.

  In exercising his/her data portability rights under the previous paragraph, the interested party shall have the right to obtain the direct transmission of personal data from one controller to another, if technically feasible.

  The exercise of the right referred to in the initial paragraph shall not affect Article 17 - Right to erasure («right to be forgotten»).

  Assumptions

  The right cannot be exercised if one of the following applies:

  • processing is based on consent under Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), or a contract under Article 6, paragraph 1, letter b);
  • the processing is carried out using automated procedures.

  This right shall not apply to the processing necessary for the performance of a task in the public interest or relating to the exercise of official authority by the controller.

  The exercising of the right must not affect the rights and freedoms of others.

  How to exercise it
  The interested party can exercise this right by written request to email address

  To be able to provide a positive response to the request, the interested party must provide the information necessary to identify the interested party

  Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

• Art. 21 Right to object

  Description
  The interested party has the right to object at any time

  The data controller shall refrain from further processing of personal data unless he demonstrates the existence of compelling legitimate grounds for processing that outweigh the interests, rights and freedoms of the interested party or for verification, the exercise or defence of a right in court.

  Where personal data are processed for direct marketing purposes, the interested party has the right to object at any time to the processing of personal data concerning him/her carried out for such purposes, including profiling to the extent that it is related to such direct marketing.

  Where the interested party objects to processing of personal data for direct marketing, personal data are no longer processed for these purposes.

  Where personal data are processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89, paragraph 1, the interested party for reasons related to his/her particular situation, has the right to object to the processing of personal data concerning him/her, except where processing is necessary for the performance of a task of public interest.

  Assumptions

  The right can be exercised if one of the following is true:

  • reasons relating to his particular situation,
  • processing of personal data concerning him/her in accordance with Article 6(1) letter e) and processing is necessary for the performance of a task in the interest of the public or in connection with the exercise of official authority by the controller (the processing is necessary for the pursuit of the legitimate interest of the controller or third parties, provided that the interests or fundamental rights and freedoms of the interested party that require the protection of personal data do not prevail, in particular if the person concerned is a minor.), including profiling on the basis of such provisions

  How to exercise it
  The interested party can exercise this right by written request to email address

  To be able to provide a positive response to the request, the interested party must provide the information necessary to identify the interested party Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

  In the context of the use of information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise his right of objection by automated means using technical specifications

  Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

In general, to exercise his/her rights, the interested party can contact the Data Controller by writing to him at the aforementioned contact address. Before replying the Data Controller may need to identify the interested party by requesting a copy of a document of identity. A written reply will be produced without unjustified delay, and in any case, no later than one month after receipt of the query.

Template version: 4.1

Last update: 22/02/2023