Source: https://www.thespa-bergamo.it/en/privacy-policy/
Timestamp: 2019-04-22 12:51:02+00:00

Document:
The Data Controller processes personal data, (such as name, surname, company name, address, telephone number, e-mail, bank and payment details) – hereinafter, “personal data” or even “data” you have communicated at the conclusion of contracts for the services of the Owner – in order to optimize the service provided to you. According to the legislation, this treatment will be based on principles of correctness, lawfulness, transparency and protection of your privacy and your rights.
Your personal data are necessary for purposes strictly connected and instrumental to the management of business relationships, for administrative and accounting purposes and for purposes related to legal obligations.
to send via e-mail, mails and / or sms and / or telephone contacts commercial and / or promotional communications of third parties (for example, business partners).
Please note that, if you are already our customer, we can send you commercial communications concerning services and products of the owner similar to those you have already used, exercising our legitimate interest, under art. 6 of the GDPR, except your expressed dissent through the modalities indicated in the art. 9 of this Information.
The processing of your personal data is carried out by means of the operations indicated in art. 4 n. 2) GDPR and more precisely: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data. Your personal data are subjected to both paper and electronic and / or automated processing. The Data Controller will process the personal data for the time necessary to fulfill the after mentioned purposes and in any case for no more than 10 years from the cessation of the service relationship and no later than 2 years from the collection of data for the Marketing Purposes.
to third-party companies or other subjects (for indicative purposes, professional offices, consultants, etc.) who carry out outsourcing activities on behalf of the Data Controller, in their capacity as external data controllers, or to other autonomous owners (indicative, institutes banking, mailing services, etc.), who will provide directly their information for the purposes and means of their own.
Without the need for express consent (Article 6 letters b) and c) of the GDPR), the Data Controller may communicate your data for the purposes referred to in art. 2.a) to Judicial Authorities, as well as to those subjects to whom the communication is mandatory by law for the accomplishment of said purposes. These subjects will process the data in their capacity as independent data controllers.
Personal data may also be stored on servers located within the European Union. In any case, it is understood that the Data Controller, if necessary, will have the right to move the data on servers even outside the EU. In this case, the Data Controller hereby ensures that the transfer of non-EU data will take place in accordance with the applicable legal provisions, subject to the assessment of the existence of adequate guarantees under art. 46 of the GDPR related to the transfer. If such guarantees are not present, the Holder cannot make any transfer without customer’s explicit consent.
In any case, your data will not be disclosed.
The provision of data for the purposes referred to in art. 2.A) is mandatory. In its absence, we cannot guarantee the proposed Services.
The provision of data for the purposes referred to in art. 2.B) and for the possible transfer of your personal data in non-EU countries in the absence of adequate guarantees, as specified in art. 6, is optional. You can therefore decide not to give any data or to subsequently deny the possibility of processing data already provided: in this case, you will not be able to receive newsletters, commercial communications and advertising material concerning the Services offered by the Data Controller.
d) the right to data portability, namely to receive the personal data supplied in a structured format that is commonly and automatically readable by automatic means and to transmit them to another Data Controller without hindrance.
Although not expressly provided for by the provisions referred to above, reference should be made to the legislation in force on the subject of Privacy and specifically to articles 15, 16, 17, 18, 20 and 21 of the GDPR.
Or they can also file a complaint with the National Data Protection Authorities (APD).
We also inform you that, if you now use our website for reservations or for the simple visit you can get in touch with cookies (a “cookie” is a small piece of data that is stored in the browser of your computer or your mobile device).
In the event that we authorize other parties to release cookies through the site, those cookies are called “third-party”.
Technical cookies in order to offer our visitors a state-of-the-art and user-friendly website, which automatically adapts to their needs and wishes. To make this happen, we use technical cookies to allow you to view our website, to make it work properly and manage your reservations. Technical cookies are essential for the proper functioning of our site.
Commercial cookies and marketing; we use our and third-party cookies to insert personalized advertising on our website.
Updated on 25th May 2018, under EU Regulations 2016/679.

References: art. 6
 art. 9
 art. 4
 art. 2
 art. 46
 art. 2
 art. 2
 art. 6