Information on the processing of personal data
Ex art. 13 EU Reg. 679/2016
Information on the processing of personal data
The travel agency TUO TRAVEL by T.U.O. srl (hereinafter also “TRAVEL COMPANY”), as data controller, pursuant to art. 13 of the General European Regulation on the Protection of Personal Data 679/2016 (hereinafter the “GDPR”), provides the following information about the processing of personal data that you, the purchaser and/or traveler (“customer” and “passenger” and “you/your”), as an interested party, have communicated to us:
a) for the organization of a tourist package;
b) to facilitate the purchase of linked tourist services;
c) for intermediation in the purchase of a tourist package organized by third parties or individual tourist services provided by third-party suppliers (eg hoteliers, carriers);
d) for intermediation in the purchase of ancillary financial services / insurance and linked to packages / tourist services facilitated or purchased individually (medical policies – baggage, cancellation, assistance to the traveler in difficulty, financing consumer credit);
e) to fulfill the task of issuing visas;
f) to register on our website and / or the app or fill out the forms on the website or in the app;
Purpose and legal basis of the processing.
In addition, among the data provided by you there could also be some personal data defined by the GDPR and by the Italian harmonization legislation as “particular” (eg health, judicial). The sensitive/ particular data will be processed according to the purposes indicated below and only with your express consent.
a) Purposes relating to contractual performance. Your personal data will be processed for the purpose of fulfilling the obligations arising from the negotiation and the contract relating to the organization of the tourist package, or the mandate to facilitate the purchase of related tourist services or the brokerage mandate for the purchase of individuals tourist services or anyway for the performance of obligations arising from all contractual relationships, including the phase of negotiations, indicated in the previous letters. a) to f), in order to allow the TRAVEL COMPANY to provide optimal performance, in particular for:
i. the conclusion, management and execution of the contractual relationships between you and the TRAVEL COMPANY;
ii. answer your requests;
iii. the communication of notices, relating to the package or services purchased tourists or other additional services and accessories (eg information on the purchased tourist services, modification of the contractual conditions, cancellations);
b) Purposes of the law. Your personal data will also be processed for:
i. execute legal obligations, regulations, national, EU and international regulations or deriving from provisions issued by Authorities legitimated by the law;
ii. ascertain, exercise and / or defend in litigation, including judicial, a right to TRAVEL COMPANY;
iii. fulfill the obligations envisaged in the fiscal and accounting fields;
iv. fulfill obligations related to the safety and health regulations of travelers;
v. fulfill obligations related to passenger and freight transport regulations.
c) Purposes related to the business and statistics. Your personal data will also be processed for purposes relevant or pertinent to the activity carried out by the TRAVEL COMPANY and for the anonymous processing of statistics and market research.
d) Additional purposes. Furthermore, if you expressly consent to it, your personal data will be processed for the following purposes:
Marketing purposes, which include:
A) promotional activities of the TRAVEL COMPANY, and / or commercial partners, realized both with automated methods (eg email, text messages, instant messaging applications, etc.) and with non-automated methods (eg postal mail, telephone with operator, etc.). In particular, the TRAVEL COMPANY may use your email address, provided at the time of purchase of packages or tourist services, to transmit information and promotional communications related to the services and products similar and offered by the TRAVEL COMPANY and / or commercial partners also without your consent, provided you do not object to such use.
The business partners belong to the following product categories:
a) accommodation activities;
b) airlines / shipping companies; railway carriers; vectors on rubber;
c) travel agencies and travel agency networks, foreign tour operators;
B) profiling activity, ie analysis of your travel preferences and market research in order to improve the services offered and the commercial information presented by us, making them more adaptive to your interests. This activity may also take place through the administration of satisfaction questionnaires and / or the use of profiling cookies used during navigation on our sites and apps.
The treatment for marketing purposes (therefore both for promotional and profiling activities) can only take place with your consent.
Nature of the provision of data and consequences of any refusal.
The provision of your personal data is optional, however, in the absence of the data required for the purposes indicated in points a) and b) (purposes related to contractual and legal performance) the requested performance or part of it cannot be performed and you do not will be able to take advantage of the opportunities mentioned above.
The provision of optional data will allow TRAVEL COMPANY to improve the services offered in order to make them more and more responsive to the personal interests of its customers.
The provision of sensitive/ particular personal data is voluntary; however, in the absence of such consent, the TRAVEL COMPANY may not be able to comply with some contractual obligations related to the processing of such data.
Categories of recipients of personal data.
Your information will not be disseminated. Your data may be communicated, exclusively for the purposes mentioned above, to the following categories of subjects:
• the internal staff of the TRAVEL COMPANY, as the person in charge and / or in charge of the processing;
• to the suppliers of tourist services included in the packages sold, or who lend the connected or individual services purchased at the TRAVEL COMPANY;
• to insurance companies that lend the accessory covers and connected with the packages and tourist services purchased;
• persons, companies, associations or professional firms that provide services or activities of assistance and advice in favor of the TRAVEL COMPANY in order to protect their own right (for example, accountants, lawyers, tax advisors, auditors, consultants in the field of operations of auditing or due diligence, etc.);
• persons, companies, or agencies that provide marketing and analysis services or consultancy services in favor of the TRAVEL COMPANY;
• subjects to whom the right to access your data is recognized by provisions of law and secondary legislation or by provisions issued by Authorities legitimated by the law, including airport, port, customs and border authorities.
Transfer of personal data outside the European Union.
Your personal data may be transferred abroad to third party companies belonging to the European Union or not, always for the purposes indicated above.
In case of data transfer to countries outside the European Union, these countries will guarantee an adequate level of protection based on a specific decision of the European Commission or alternatively the recipient will be contractually obliged to the data protection with an appropriate level and comparable to the protection provided by the GDPR.
Storage of personal data.
Personal data will be stored for a period not exceeding the necessary one to achieve the purposes for which they were collected and subsequently processed. Personal data will be kept for the duration of the contract you have concluded and also for a subsequent period:
i. within the terms established by the current legislation;
ii. within the terms established by the secondary legislation that require data retention (for example, tax returns);
iii. within the period necessary to protect the rights of the data owner in the event of any disputes related to the provision of the service.
Personal data collected and processed for profiling purposes will be kept for a maximum period of ten (10) years after which they will be automatically deleted or permanently anonymised.
Data Controller and Data Processors.
The data controller is the Travel Agency TUO TRAVEL by T.U.O. SRL, with registered office in Via Nomentana, 257 – 00161 Rome
Legal representative Francesco Rastelli.
Data Protection Officer (RPD or DPO)
The Data Protection Officer appointed is the Avv. Federico Lucarelli and he can be contacted at the following e-mail address: firstname.lastname@example.org
Rights of the interested party.
At any time, pursuant to arts. 15 to 22 of the GDPR You have the right, also in relation to the profiling activity, of:
• ask the holder for access to your personal data and information relating to them; the correction of inaccurate data or the integration of incomplete data; the cancellation of personal data concerning you (upon the occurrence of one of the conditions indicated in article 17, paragraph 1 of the GDPR and in compliance with the exceptions provided for in paragraph 3 of the same article); the limitation of the processing of your personal data (upon the use of one of the hypotheses indicated in Article 18, paragraph 1 of the GDPR);
• request and obtain from the holder – in the cases in which the legal basis of the treatment is the contract or consent, and the same is done by automated means – your personal data in a structured and readable format by automatic device, also in order to communicate such data to another data controller (so-called right to the portability of personal data);
• oppose at any time the processing of your personal data to the occurrence of particular situations that affect you;
• revoke the consent at any time, limited to the cases in which the processing is based on your consent for one or more specific purposes and concerns common personal data (for example date and place of birth or place of residence), or particular categories of data (eg data revealing your racial origin, your political opinions, your religious beliefs, your health status or your sex life). The treatment based on consent and carried out prior to the revocation of the same preserves, however, its lawfulness;
• propose a complaint to a supervisory authority (Authority for the protection of personal data – www.garanteprivacy.it).