Terme Antica Querciolaia SpA, with registered offices at Via Trieste, 22 – 53040 Rapolano Terme (SI) (hereinafter, “TermeAQ”) is committed to protecting the online privacy of the users of its websites.
This means, in particular, that any personal data processing carried out by TermeAQ will respect the principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimization, accuracy, integrity and confidentiality.
1. Data controller
2. Personal Data processed
a. Browsing data
b. Special categories of Personal Data
c. Data provided voluntarily by the data subject
3. Purpose of the processing
4. Legal bases and mandatory / discretionary nature of the processing
5. Recipients of Personal Data
6. Transfers of Personal Data
7. Retention of Personal Data
8. Data subjects’ rights
The Data Protecton Officer (hereinafter referred to as “DPO”) pursuant to art. 37 and ss. of the Rugulation can be reached at the e-mail address [email protected] and by ordinary mail at the address Terme Antica Querciolaia spa, in Via Trieste, 22 – 53040 Rapolano Terme (SI) Attn. Data Protection Officer.
Personal Data processed
As you use the Website, we inform you that TermeAQ may collect and process information related to you as an individual and which allows you to be identified (either directly, or together with additional information), or which is related to other individuals (“Personal Data”), such as your name, an identification number, an online ID or one or more characteristic elements of your physical, physiological, mental, economic, cultural or social identity.
Personal Data which may be processed by TermeAQ through the Website are as follows:
The Website’s operation, as is standard with any website on the Internet, involves the use of computer systems and software procedures, which collect information about the Website’s users as part of their routine operation. While TermeAQ does not collect this information in order to link it to specific users, it is still possible to identify those users either directly via that information, or by using other information collected – as such, this information is also considered Personal Data.
This information includes several parameters related to your operating system and IT environment, including your IP address, location (country), the domain names of your computer, the URI (Uniform Resource Identifier) addresses of resources you request on the Website, the time of requests made, the method used to submit requests to the server, the dimensions of the file obtained in response to a request, the numerical code indicating the status of the response sent by the server (successful, error, etc.), and so on.
These data are used exclusively to compile anonymous, statistical information on the use of the Website, as well as to ensure its correct operation and identify any faults and/or abuse of the Website – the data is deleted immediately after processing, unless it must be used to identify responsible parties in the event of cybercrime committed which harms the Website or third parties, in which case information on web contacts may be kept for a period of 7 (seven) days.
Special categories of Personal Data
Data provided voluntarily by the data subject
When using some of the Website’s Services you are allowed to submit Personal Data related to other persons.
In any situation where you decide to share Personal Data related to other persons through the Website, you will be considered as an independent data controller regarding that Personal Data and must assume all inherent legal obligations and responsibilities. This means that you must also must make sure that you have these third parties’ consent to their Personal Data being used in this manner before providing them to TermeAQ, or another appropriate legal basis which may allow for lawful processing of this information.
Purpose of the processing
TermeAQ intends to use your Personal Data, collected through the Website, for the following purposes:
- Allow site’s usage;
- To respond to any of your requests for assistance or information;
- For compliance with laws which impose upon TermeAQ the collection and/or further processing of certain kinds of Personal Data.
Legal basis and mandatory / discretionary nature of the processing
TermeAQ’s legal bases to process your personal data, according to the purposes identified in Section 3, (a-b) is art. 6 (1) (b) of the Regulations as the processing is necessary for the provision of the Services or for the response of requests. Giving Personal Data for these purposes is optional but if you won’t provide those datas it would make it impossible to activate the Services provided by the Site. The purpose set out in section 3.c represents a legitimate processing of Personal Data pursuant to art. 6 (1) (c) of the Regulation. Once the Personal Data has been provided, the processing is indeed necessary to fulfil a legal obligation to which TermeAQ is subject.
The legal basis of processing for the purpose d) is art. 6.1.a) of the Regulation. The provision of your Personal Data for the purposes referred in letter d) is optional; there are no consequences in case of your refusal.
Recipients of Personal Data
Your Personal Data may be shared, for the purposes listed in Section 3, with different persons / entities (hereinafter and collectively, “Recipients”):
- Entities acting as data processors on TermeAQ’s behalf, in particular:
- Persons, companies or professional firms providing TermeAQ with advice and consultancy regarding accounting, administrative, legal, tax, financial and debt collection matters related to the provision of the Services;
- Entities engaged in order to provide the Services (e.g., hosting providers or e-mail platform providers); and
- Persons authorised to perform technical maintenance (including maintenance of network equipment and electronic communications networks).
- Public entities, bodies or authorities to whom your Personal Data may be disclosed, in accordance with the applicable law or binding orders of those entities, bodies or authorities;
- Persons authorised by TermeAQ to process Personal Data needed to carry out activities strictly related to the provision of the Services, who have undertaken an obligation of confidentiality or are subject to an appropriate legal obligation of confidentiality (e.g., employees of TermeAQ).
Transfers of personal data
Retention of Personal Data
Personal Data processed for the purposes set out in Section 3(a-b-c-d) will be kept by TermeAQ for the period deemed strictly necessary to fulfil such purposes – in any case, as these Personal Data are processed for the provision of the Services, TermeAQ will keep them for as long as the statute of limitations on liability related to the provision of the Services (as determined by the applicable law) lasts, so as to protect its interests.
Personal Data contained within CVs sent via the Website, as mentioned in Section 3(c), will be kept as long as the position for which the CV was sent remains open. As for spontaneous applications, this Personal Data may be kept for up to 1 (one) year. TermeAQ may contact candidates before the mentioned periods end, in order to request an extension of this retention period.
Personal Data processed for the purposes set out in Section 3(d) will be kept by TermeAQ for the period required by the specific legal obligation or by the applicable law.
For more information on TermeAQ’s Personal Data retention periods and the criteria adopted in determining these periods, please contact: TermeAQ
Data subject rights
Under Articles 15 and following of the Regulation, you, as a data subject, are entitled to request from TermeAQ, at any time, access to your Personal Data, the correction and erasure of your Personal Data, as well as to object to its processing. You are also entitled to request the restriction of the processing of your Personal Data in the cases set out in Article 18 of the Regulation, as well as to obtain the Personal Data you have provided to TermeAQ in a structured, commonly used and machine-readable format, in the cases set out in Article 20 of the Regulation.
Requests should be made in writing to TermeAQ at the address specified above.
In any case, please note that, as a data subject, you are entitled to file a complaint with the competent supervisory authorities for the protection of Personal Data, if you believe that the processing of your Personal Data carried out through this Website violates applicable law.