Privacy Policy and Data Processing Information
(Pursuant to EU Regulation no. 679/2016 - General Data Protection Regulation - of the European Parliament and of the Council)
**1. Why this notice**
This page describes the methods of processing personal data of users who interact with the booking panel on the website (hereinafter referred to as the "booking engine").
This is an information notice pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 (General Data Protection Regulation).
**2. Data Controller**
The Data Controller is Davide Aldrighetti, in the person of the legal representative of the business LUNALO Dolomiti DESIGN Eco Apartment, located at Via Stenico 47, 38095 TRE VILLE TN.
**3. External Data Processor**
The company Kross Booking Solution Plus Srl has been appointed as the external data processor for the processing of personal data, pursuant to Article 28 of EU Regulation no. 679/2016 - General Data Protection Regulation of the European Parliament and of the Council, as it is responsible for providing the booking system in use.
**4. Location of Data Processing**
The processing related to the web services of this site takes place at the Data Controller's office and at the data centers used by the external data processor. The data centers of the company are located in Europe, and therefore, no data transfer occurs outside of the European Union.
**5. Types of Data Processed**
A) Data Provided by the User
These are data voluntarily provided by the Customer at the time of booking. In particular, the following categories of personal data may be processed:
- Personal data of the booking party: name; surname; email addresses; phone numbers; gender; language; place of birth; place of residence; identification document details; tax code;
- Payment data.
B) Automatically Collected Data
The computer systems and software procedures responsible for the operation of the website acquire, during their normal operation, certain personal data, the transmission of which is implicit in the use of Internet communication protocols. This category of data includes:
- IP addresses or domain names of the computers used by users connecting to the site;
- URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.), and other parameters related to the user's operating system and computer environment;
- Log files of site access.
This data is used solely for the purpose of obtaining anonymous statistical information about the use of the site and to check its proper functioning. The data may be used to ascertain liability in case of hypothetical computer crimes against the site.
**6. Purpose of Processing**
The processing of personal data will be carried out for the following purposes:
A) Fulfillment of Legal Obligations:
LUNALO may use your personal data to fulfill any obligations required by laws, regulations, EU legislation, as well as orders or requests from authorities authorized by law and supervisory and control bodies. These include the communication of data to the competent authorities as required by law or as part of administrative or judicial proceedings.
B) Fulfillment of Contractual Obligations related to the service provision:
The personal data provided by the Customer is essential for the proper execution of the contract between the Customer and LUNALO. In particular, the Customer's data will be processed for booking fulfillment and related operations.
C) Analysis of Website Usage:
The information and data provided by the Customer may be used to obtain anonymous statistical information about the use of the site and to monitor its proper functioning.
D) Direct Marketing:
The data provided may also be used by LUNALO for promotional activities related to goods or services similar to those covered by the present contract. Consent for this processing is optional.
The provision of data as per letters A), B), and C) is mandatory for the signing of the contract and the use of the service.
E) Details on Data Processing:
- Facebook Pixel (Facebook, Inc.): Facebook Pixel is a statistical service provided by Facebook, Inc. that links data from the Facebook ad network with actions taken within this site.
- Facebook Remarketing (Facebook, Inc.): Facebook Remarketing is a remarketing and behavioral targeting service provided by Facebook, Inc. that links the activity of this Site with the Facebook advertising network.
- Google Ads Remarketing: This website uses Google Ads remarketing service to show sponsored ads on third-party websites (including Google) to previous visitors of this site. These ads may be displayed to those who have not previously completed a specific action on this website, such as requesting a demo. This may take the form of an advertisement in Google search results or a site in the Google Display Network. Third-party services, including Google, use cookies to serve ads based on past visits to the Slope website. Of course, any data collected will be used in accordance with our cookie policy and Google's.
- Bing Ads Remarketing: This website uses Bing Ads Universal Event Tracking ("UET") to create remarketing lists based on end-user activity on this website and to subsequently show sponsored ads on third-party websites (including Bing and Yahoo!). These ads may be displayed to those who have not previously completed a specific action on this website, such as requesting a demo. This may take the form of an advertisement in Bing search results or on a Bing partner site, such as Yahoo!. Third-party services, including Bing, use cookies to serve ads based on past visits to the Slope website. Any data collected will be used in accordance with our cookie policy and Microsoft Bing Ads'.
- Google Analytics (Google Inc.): Google Analytics is a web analysis service provided by Google Inc. ("Google"). Google uses Personal Data collected for the purpose of tracking and examining the use of this Site, compiling reports, and sharing them with other Google services. Google may use the Personal Data to contextualize and personalize the ads of its advertising network.
**7. Methods of Processing**
Personal data is processed using automated tools, with the help of modern computer systems, or manually/paper-based. Specific security measures are observed to prevent data loss, unlawful or incorrect use, and unauthorized access.
**8. Data Retention Period**
Customer data will be retained for the time strictly necessary to achieve the purposes for which they were collected. In particular, the following are the main retention periods for your personal data:
A) Personal data of the booking party:
These data will be kept for the time strictly necessary to fulfill contractual obligations related to the stay, as well as legal obligations. In particular, such data will not be retained beyond the terms imposed by public security regulations and accounting provisions.
B) Payment data:
Payment data used during booking will be deleted within 15 days from the conclusion of the booked stay.
C) Automatically collected data:
Data acquired automatically by the system (Article 5, letter B) will be retained for a maximum of 7 days from the time of acquisition.
**9. Communication and Disclosure of Data**
In addition to the Data Controller, in some cases, other categories of employees involved in the organization of the site (e.g., administrative and commercial staff) or external subjects (such as technical service providers, communication agencies, postal couriers, hosting providers, IT companies) may have access to data and be appointed as Data Processors. LUNALO will appoint its authorized
employees to access the data as data processors.
In particular, the Data Controller uses the following external providers:
1. Solution Plus Srl: External data processor, appointed through a contract pursuant to Article 28 of EU Regulation no. 679/2016;
2. Amazon Web Services Inc.: cloud computing service provider with which Solution Plus Srl - External data processor - has signed a specific contract. The privacy policy of Amazon Web Services Inc. is available at the following link: [Amazon Web Services Privacy Policy](https://aws.amazon.com/it/privacy/).
The complete and updated list of Data Processors and those in charge of processing can always be requested from the Data Controller.
Payment data is hosted on a dedicated server that ensures the highest level of PCI DSS compliance, Payment Card Industry Data Security Standard ([PCI DSS](https://www.pcisecuritystandards.org/)).
**10. Changes to this Privacy Notice**
LUNALO reserves the right to change this privacy notice at any time to comply with applicable laws and regulations and in response to suggestions from employees, customers, collaborators, and users. In case of changes to this privacy notice, users will be adequately informed of the changes made.
**11. Rights of Data Subjects**
In accordance with current regulations, the Customer has the right to:
- request and obtain information about the processing of personal data and a copy of such personal data; for data subject to automated processing, it is possible to request their transfer to another data controller;
- request and obtain the modification and/or correction of personal data considered inaccurate or incomplete;
- request and obtain the deletion – and/or limitation of processing – of personal data if they are not necessary – or no longer necessary – for the purposes outlined above;
- request and obtain the cessation of all personal data processing for direct marketing purposes.
Under Regulation no. 679/2016, the Customer has the possibility to lodge any complaints with the Data Protection Authority.
Requests should be sent to:
- via email, to the address: [email protected]
