Privacy Policy EN

1 – Data Controller and Data Protection Officer

Continental Terme Srl (hereinafter, the “Controller”), with registered office at Via M. Cervantes de Savaedra 55, 80133 Naples (NA), VAT No. 03376570630 (telephone: +39 081/991588; email: continentaltermesrl@pec.it), hereby informs you that it is the Data Controller of personal data pursuant to Article 4, No. 7), of EU Regulation 2016/679. The company has appointed a Data Protection Officer, who may be contacted at the following email address: palmieri@aptconsulting.it.

2 – Data Subject to Processing

The data collected and processed by the Controller, either independently or through third parties, include: cookies (please refer to the specific cookie policy), usage data, first name, surname, email address and postal address. Personal data may be freely provided by the User or, in the case of usage data, collected automatically when accessing this website.

Any use of cookies or other tracking tools by this website or by third-party service providers used by the website, unless otherwise specified, is intended to provide the service requested by the User, in addition to the further purposes described in the following section.

In any case, this information is not collected for the purpose of being associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, make it possible to identify users. This category of data includes the IP addresses or domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment. These data are used solely for the purpose of obtaining anonymous statistical information regarding the use of the website and to check its proper functioning. The data may also be used to establish liability in the event of hypothetical cybercrimes against the website or requests by the competent authorities.

The User assumes responsibility for any third-party personal data obtained, published or shared through this website and guarantees that they have the right to communicate or disclose such data, releasing the Controller from any liability towards third parties.

For this type of data, please refer to the cookie policy.

3 – Purposes of Processing and Legal Basis

The Controller processes your personal data for the following purposes:

1. to respond to your requests for information and bookings; manage contacts; correctly fulfil obligations arising from an existing contract or carry out pre-contractual activities at your request. The legal basis for the processing is the performance of a contract with the User/data subject and/or pre-contractual measures (Art. 6, para. 1, letter b, EU Regulation 679/2016);
2. to comply with legal and regulatory obligations. The legal basis for the processing is compliance with a legal obligation (Art. 6, para. 1, letters c and f, EU Regulation 679/2016);
3. to protect the Controller’s legitimate interests (protection of the website and legal defence of its rights);
4. to periodically send advertising information and/or newsletters. The legal basis for the processing is consent (Art. 6, para. 1, letter a, EU Regulation 679/2016).

The provision of data is optional in relation to purposes a) and d). If such data are not provided, it may not be possible to achieve the intended purpose (e.g. being contacted by the Controller or receiving advertising communications).

The provision of data is mandatory in relation to purposes b) and c), and failure to provide such data will prevent compliance with legal obligations and the protection of the Controller’s legitimate interests.

4 – Methods of Data Processing

The data will be processed and stored exclusively for the purposes indicated above using electronic systems and will be handled with tools suitable for guaranteeing the integrity, security and confidentiality of the data, in accordance with EU Regulation 2016/679. All appropriate technical and organisational measures will be adopted to ensure a level of data protection compliant with the provisions of EU Regulation 2016/679. Access will be permitted only to persons authorised in writing to process personal data.

5 – Disclosure to Third Parties and/or Dissemination of Data – Transfer of Data Abroad

Recipients of personal data (i.e. the parties to whom personal data may be disclosed) include, in addition to the Controller and employees expressly authorised to process such data, third parties used by the Controller for the performance of the contract and compliance with legal obligations (e.g. communication agencies, IT companies, trade associations, servers [e.g. web hosting, storage hosting]). Such parties are appointed as external Data Processors and are provided with specific written instructions. Personal data may also be disclosed to judicial and/or government authorities to which the Controller is required to transmit personal data in order to comply with legal or regulatory obligations in general or to protect its own interests.

An updated list of Data Processors may be requested from the Controller.

The data will be transferred exclusively within Italy and the European Union.

6 – Data Retention Period

Personal data collected for the aforementioned purposes will be retained for the following periods:

1. data provided for the purpose referred to in point a), Art. 3, will be retained for the entire duration of the contractual relationship and subsequently for the applicable limitation period relating to any legal claims;
2. data provided for the purpose referred to in point b), Art. 3, will be retained for the period necessary to comply with legal and/or regulatory obligations;
3. data provided for the purpose referred to in point c), Art. 3, will be retained for the period necessary to protect the Controller’s legitimate interests;
4. data provided for the purpose referred to in point d), Art. 3, will be retained until consent is withdrawn.

Thereafter, the data will be deleted or anonymised, in full compliance with applicable legal requirements.

7 – Rights of the Data Subject

The data subject may, at any time, exercise the rights provided for under Art. 7, para. 3, and Arts. 15 et seq. of EU Regulation 2016/679: a) the right to access personal data; b) the right to obtain their rectification or erasure or restriction of the processing of personal data concerning them; c) the right to object to processing; d) the right to data portability; e) the right to withdraw consent, where applicable (withdrawal of consent shall not affect the lawfulness of processing based on consent given before its withdrawal); f) the right to lodge a complaint with the supervisory authority (Italian Data Protection Authority).

The above rights may be exercised by sending a communication to:

• Continental Terme Srl, Via M. Cervantes de Savaedra 55, 80133 Naples, or by email at: continentaltermesrl@pec.it),
• Ugo Palmieri, Vico Santo Spirito di Palazzo 35, 80132 Naples (NA), Tax Code PLMGUO67T26F839N, email: palmieri@aptconsulting.it.