PRIVACY POLICY

This document sets out the methods and purposes of the processing of personal data (hereinafter also referred to as "data") carried out by the Data Controller (hereinafter also referred to as "Controller"), as well as any further information required by law, including information regarding the rights of the Data Subject and how to exercise them. 
Regulation (EU) 2016/679 on the protection of personal data (hereinafter the "Regulation") lays down rules relating to the protection of natural persons with regard to the processing of personal data, as well as rules relating to the free movement of such data, protecting fundamental rights and freedoms of natural persons, with particular regard to the right to the protection of personal data. 
Article 4, no. 1 of the Regulation provides that "PERSONAL DATA" means any information relating to an identified or identifiable natural person (hereinafter "Data Subject"). "PROCESSING" means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Article 4, no. 2 of the Regulation).
Pursuant to Articles 12 et seq. of the Regulation, the Data Subject must also be provided with appropriate information regarding the processing activities carried out by the Data Controller and the rights of Data Subjects. 

1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER AND DATA PROTECTION OFFICER
   The Data Controller is Azienda per il turismo delle Valli di Sole, Peio e Rabbi S.c.p.A., with registered office in Via Marconi no. 7 - 38027, Malè (TN), Italy The Controller can be contacted using the following details:
   Phone: +39 0463-901280
   Email: info@visitvaldisole.it
   Certified Email (PEC): valdisole@pec.it
   The Data Controller has appointed a Data Protection Officer (DPO), who can be reached at: dpo@apttrentino.it.
    
2. METHODS OF COLLECTION AND CATEGORIES OF PROCESSED DATA
   The data subject to processing are collected through specifically designated channels and methods, such as receiving emails sent to the addresses indicated on the website, filling out and submitting forms, and newsletter subscriptions.
   The following data may be processed:
   • Browsing data: Acquired by the computer systems and software procedures used to operate this website during their normal operation. This involves certain personal data whose transmission is implicit in the use of internet communication protocols, such as IP addresses or domain names of computers used by users connecting to the site, time of the request, method used to submit the request to the server, and other parameters relating to the user’s IT environment.
     These data are necessary for the use of the web service and are also processed to:
     • Obtain statistical information on the use of services (most visited pages, number of visitors per hourly or daily slot, geographic origin, etc.);
     • Monitor the proper functioning of the offered services. 
     (Browsing data may also be used to ascertain liability in the event of hypothetical cybercrimes against the site by the Judicial Authority).
   • Common data / personal data (pursuant to Art. 4.1 GDPR): For example, first name, last name, contact details, address, and data necessary to deliver the requested service.  In the event that the processing of special categories of personal data (pursuant to Art. 9 GDPR) is required for a specific service requested, explicit consent will be obtained. The provided data may be processed using both automated and paper-based means. All records are appropriately maintained and secured to ensure data security and confidentiality.
      
3. PURPOSES OF PROCESSING
   Data are processed for the purposes for which the Data Subject gave consent and which are necessary to fulfil a service request from the site user, specifically:
    
   • Information and support requests: We inform you that the data provided will be used exclusively to follow up on your request. The collected data will be retained solely for the time necessary to provide you with a response. This processing is based on your consent. Any refusal to provide data will make it impossible to respond to your inquiry. Any additional purposes relating to marketing activities (sending advertising and/or promotional material) will be subject to specific and separate consent.
   • Newsletter: Subject to the data subject's consent, the collected data will be used to send newsletters and informative communications. The data will be processed for this purpose until consent is withdrawn or until a request for cancellation/unsubscription is made through the established channels. If the communications are promotional or commercial in nature, the provisions set out in the following MARKETING section shall apply.
   • Marketing: Subject to the data subject's consent, the collected data may be used to send promotional or advertising material and marketing communications, including by automated means. Within the scope of these communications, tracking technologies may be used—such as tracking pixels or equivalent tools—which allow the collection of certain information regarding interactions with the message (e.g., whether the email was opened and links contained within it were clicked). This information is used exclusively within email marketing activities to evaluate campaign performance and improve the content, methods, and frequency of sent communications; it is not combined with data from other sources. Consent can be revoked at any time. Furthermore, the data subject can choose to continue receiving communications without tracking technologies enabled by clicking the "Manage preferences" link included in the emails.
      
4. MANDATORY OR OPTIONAL NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL
   Providing data to the Controller is mandatory only for data strictly necessary to fulfill the purposes listed under section 3. Refusal to provide data and consent will result in the inability to properly carry out the services and activities requested.
     
5. AUTOMATED DECISION-MAKING
   Data are not used to make decisions based solely on automated processing that produce legal effects concerning the Data Subject or similarly significantly affect them. Information regarding interactions with email communications is not combined with data from other sources and is not used for individual profiling activities.
    
6. RECIPIENTS OF DATA AND DISCLOSURE
   Data may be shared with:
   • Internal offices and personnel designated to manage requests;
   • Technical service providers, IT managers, software platforms, and hosting providers;
   • Supervisory and regulatory authorities.
   Data will not be disseminated to third parties without prior and explicit consent from the Data Subject.
    
7. DATA TRANSFERS OUTSIDE THE EUROPEAN UNION
   Data are not transferred outside the European Union unless strictly necessary due to IT and technological solutions provided by suppliers based outside the EU. In such cases, transfers take place in compliance with Regulation (EU) 2016/679, specifically based on Adequacy Decisions by the European Commission, including the EU-US Data Privacy Framework (Art. 45 GDPR). In the absence of an adequacy decision, transfers are based on appropriate safeguards adopted by the Controller under Articles 46 and 47 of the GDPR, or, failing that, on the explicit consent of the Data Subject or in accordance with Article 49 of the GDPR.
    
8. DATA RETENTION PERIOD
   Data will be retained for the time strictly necessary to fulfill the purposes set out in section 3 and, where applicable, in compliance with any further periods prescribed by law. Data used for sending newsletters and marketing communications are retained until consent is withdrawn or until an erasure/unsubscription request is made, without prejudice to what is necessary to document the choices expressed by the Data Subject and to comply with legal obligations. Data concerning interactions with emails are retained for the time strictly necessary to measure and optimize campaigns, and are subsequently deleted or aggregated in an anonymous form.
    
9. RIGHTS OF THE DATA SUBJECT
   The Data Subject may, at any time and in accordance with the procedures and limits established by applicable legislation, exercise the rights specifically provided for in Articles 15 to 22 of EU Regulation 2016/679, namely – in summary:
   • request confirmation as to whether or not personal data concerning them are being processed, and where applicable, obtain access to such data;
   • request the rectification and/or completion, erasure, or restriction of the processing of such data in the cases provided for by Art. 18 GDPR;
   • object to the processing of their data;
   • request data portability;
   • lodge a complaint with a supervisory authority;
   • obtain all available information regarding the origin and categories of data, if they were not collected directly from the Data Subject;
   • obtain information regarding the existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing;
   • not be subject to a decision based solely on automated processing, including profiling.

The exercise of these rights may be carried out by sending a request to the Data Controller using the contact details indicated in section 1. A response will be provided within 30 days in writing (unless oral feedback is specifically requested by the Data Subject), including by electronic means. With regard to marketing communications, the Data Subject may at any time withdraw consent, request to no longer receive communications, or continue to receive them while exclusively disabling tracking technologies via the 'Manage preferences' link provided in the emails.

The Data Subject has the right to lodge a complaint with the competent supervisory authority (Data Protection Authority) in the Member State of their habitual residence, place of work, or the place where the alleged infringement took place pursuant to Art. 77 of the Regulation, or to seek judicial remedy (Art. 79 of the Regulation).

Updated as of 21.10.2026