Privacy policy - Golf Club Cavaglià

Golf Club Cavaglià (WEBSITE)

Privacy Policy (in accordance with the EU Regulation 2016/679 issued by the European Parliament and European Council on the 27th April 2016)

The confidentiality of the personal information of our clients is fundamental and a commitment of Golf Club Gest.Al. S.r.l.

A) General

1. User Data (Data Holder)

1.1. Collection and Handling of User Data

There are many circumstances in which we request “Personal Data” of a user (“User”) from the website www.golfclubcavaglia.it ("Site"). This may happen within the scope of availability of the website; while entering into any contracts (namely hotel services, booking of accommodation and golf), supply of information, content, including newsletters, login areas, or any other telephone contact, (hereinafter collectively referred to as “Services”), to its users and other entities related to it.

As a rule, Personal Data is collected and handled when the User registers with the Site, requests to be contacted and/or to receive our newsletter, subscribes a specific Service, supplies or requests information, purchases a product or establishes a contractual relationship with Gest.Al. S.r.l.

Personal Data is the information which allows for the identification or contact of the User when making a reservation, registers with our Site or subscribes our newsletter. The collected and handled Personal Data consists of information relating to name, nationality, date of birth, address, e-mail address, telephone, mobile phone, tax identification number, credit card details (only collected for invoicing purposes), however, other Personal Data may be collected which may prove necessary or useful for supply or charge of Services by Gest.Al. S.r.l. – Responsible Entity for the collection and handling of Personal Data – better identified below. After the collection of the Personal Data, more detailed information is given to the User in relation to the nature of the data collected, the purpose of the collection and the handling of the data, as well as the information referred to in paragraph 7 below.

It is also collected and handled, information relating to the characteristics of your hardware and browser/software characteristics, as well as information on the pages visited by the User within the Site. This information may include your IP (Internet Protocol) address, the operating system and the type of browser (“Usability Information”). We use this information only to improve the quality of your visit to our Site.

The Usability Information and the Personal Data are referred to in this Privacy Policy as “User Data”.

1.2. Handling Responsible Entity

The Responsible Entity for collection of the Personal Data is Gest.Al. S.r.l., a company with its registered office at Cavaglià Via Santhià 75 13881 (BI).

1.3. Subcontracted Entities

Within the scope of User Data handling, Gest.Al. S.r.l. may subcontract third parties to, on its behalf and in accordance with its instructions, handle User Data, in accordance with the law and this Privacy Policy.

These Subcontracted Entities will not be allowed to supply the User Data to other entities without Gest.Al. S.r.l. giving prior written authorization to this effect, being always prevented from contracting other entities without Gest.Al. S.r.l.’s prior authorization.

Gest.Al. S.r.l. commits to subcontract only entities who offer maximum security in the performance of technical and adequate organizational measures, for the purpose of ensuring the User rights protection. All Entities subcontracted by Gest.Al. S.r.l. are bound to the latter by a written contract regulating, specifically, the subject and duration of the handling, the nature and purpose of the handling, the type of personal data, the categories of the data holders and the rights and obligations of the parties.

Following the collection of the Personal Data, and if applicable, Gest.Al. S.r.l. provides the User, information about the Subcontracted Entities that in this specific instance might handle the data on behalf of Gest.Al. S.r.l.

1.4. Data Collection Channels

Gest.Al. S.r.l. may collect data in a direct way (i.e. directly from the user) or in an indirect way (i.e. through partner entities or third parties). The collection may be done through the following channels:

Direct collection: in person, by telephone, by e-mail or through the Site.

Indirect collection: through partners or group companies and official entities.

2. General Principles Applicable to the User Data Handling

2.1. Principles Relating to Personal Data Handling

Gest.Al. S.r.l. ensures the User Data collected is handled in accordance with the following general principles:

Are handled in accordance with the law, licit, loyal and transparent in relation to the data holder (“lawfulness, loyalty and transparency”);
Are collected for the specific, objective and legitimate purposes, set out in number 3. below, and are not subsequently handled in a manner incompatible with those purposes (“limitation of purpose”);
Are adequate, pertinent and limited to what is required in relation to the purpose for which are being handled (“data minimization”);
Are accurate and updated whenever necessary, with all adequate measures being adopted to delete or rectify without delay inaccurate data, considering the purpose for which they are handled (“accuracy”);
Are stored in a way which allows the identification of the User only during the timeframe required for the purpose the data is being handled (“storage limit”)
Are handled I a way which guarantees its safety, including protection against the unauthorized or unlawful use and against the loss, destruction or unforeseen damage, with the adequate technical and organizational measures being adopted (”integrity and confidentiality”).

2.2 Lawfulness of Handling

The data handling performed by Gest.Al. S.r.l. are permitted and legal when at least one of the following situations applies:

The handling is necessary for completion of a contract where the User is a party, or for pre-contract procedures at the request of the User;
The User has given without a doubt its consent for the handling of its Personal Data for one or more specific purposes:
The handling is necessary for fulfilment of a legal obligation which Gest.Al. S.r.l. might be subject to;
The handling is necessary for the protection of the vital interests of the User or other individual;
The handling is necessary for the purpose of Gest.Al. S.r.l. pursuing its legitimate interests or by third parties on its behalf, except if the interest or rights and fundamental liberties of the User which demand the protection of personal data prevail.

Gest.Al. S.r.l. undertakes to ensure the handling of the User data is only performed in the conditions set out above and respecting the principles above mentioned.

2.3. Applicable Conditions to Consent

When the processing of the User Data is performed by Gest.Al. S.r.l. based on the consent of the User, it has the right to withdraw its consent at any time. However, the withdrawal of consent does not compromise the lawfulness of the processing done by Gest.Al. S.r.l. based on the consent previously granted by the User.

2.4. Term of Data Storage

The period of time during which the data is stored and maintained varies in accordance with the purpose for which the information is processed.

Gest.Al. S.r.l. will comply with the legal requirements that oblige us to keep Personal Data for a minimum period of time. Where there is no specific legal obligation, the data will be stored only for the minimum period necessary for the purposes for which it was collected or subsequently processed, being deleted on its expiry.

3. Usage and Purpose of User Data Processing

The collected Personal Data will be used solely for the following purposes:

Provision of hotel and associated services (restaurants, bars, etc)
Effectiveness of hotel and golf bookings;
Management of contracts with the User;
Invoicing to and collection from the User;
Registration of the User on the Site;
Information to the User, who has given consent, of new products and services made available on the Site and/or premises where the services are provided; offers and special campaigns; information on promotions and information about Gest.Al. S.r.l. (if subscribed to our newsletter), and finally, for marketing statistical analysis of the exclusive use of Gest.Al. S.r.l.;
Allow access to restricted areas of the Site, in accordance with the terms previously established;
Guarantee the Site meets the User’s needs, through the development and publication of content adapted as much as possible to the preference, requests and type of User, improve the search capability and Site functionality and the collection of associated information or statistics relating to the User’s profile type (analysis of consumer profiles);
Provision of other services, such as newsletters, opinion surveys, or other information or products requested or purchased by the User;
Gest.Al. S.r.l. may combine Usability Information with anonymous demographic information for research purposes, and may use the result of this combination to supply more relevant content on the Site. In certain restricted areas of the Site, Gest.Al. S.r.l. may combine Personal Data with Usability Information to supply the User a more personalized content.
The User Data collected by Gest.Al. S.r.l. are not shared with third parties without consent from the User, with exception of the situations referred to in the next paragraph. However, in the event the User contracts with Gest.Al. S.r.l. for services which are supplied by other entities responsible for processing Personal Data, the Personal Data may be consulted or accessed by that entity, in so far as it may be necessary for the provision of the referred to services.
Under the applicable legal terms, Gest.Al. S.r.l. may transmit or communicate the User Data to other entities in the event that transmission or communication is necessary for the execution of the contract between the User and Gest.Al. S.r.l., or for pre-contract diligences at the request of the User, if required for a legal obligation compliance which Gest.Al. S.r.l. may be subject to or if necessary for the safeguarding of the legitimate interests of Gest.Al. S.r.l. or third parties. Should a transmission of User data to a third party occur, all reasonable efforts will be made to ensure the recipient of the User Data, uses the data supplied in a way consistent with this Privacy Policy.

4. Implemented Technical, Organizational and Security Measures

User Data Security

To guarantee the security of the User Data and maximum confidentiality, Gest.Al. S.r.l. processes the information supplied in a completely confidential manner, in accordance with its internal security and confidentiality procedures, which are periodically reviewed and updated in accordance with the needs and in accordance with the terms and conditions legally envisaged.

Considering the nature, scope, context and the purposes of the data processing, as well as the inherent risks for the rights and liberties of the User, arising from the processing of data, Gest.Al. S.r.l. commits itself to applying, not only at the time of defining the processing means, but also at the time of the actual processing, the necessary and adequate technical and organizational measures to the protection of User Data and to the compliance with the legal obligations.

Commits itself further to ensure that, by default, only the necessary data for each specific purpose is processed and that that data is not made available without human intervention and to an undetermined number of people.

The communication between the User device and the Site of Gest.Al. S.r.l. is made through secure communications channels which use the HTTPS protocol and the security standard SSL. Nevertheless, in terms of general measures, Gest.Al. S.r.l. adopts the following:

Regular audits in order to identify the competence of the implemented technical and organizational measures;
Raise awareness and training of the staff involved in data processing tasks.
Mechanisms capable of ensuring the confidentiality, availability and the permanent resilience of the information systems.
Mechanisms which ensure the fast recovery of the information systems and the access to Personal Data in case of a physical or technical incident.

5. Data transfer to outside the European Union

The Personal Data collected and used by Gest.Al. S.r.l. are not made available to third parties outside the European Union. If, in the future, this transfer comes to happen, Gest.Al. S.r.l. commits itself to ensure the transfer complies with the applicable legal terms, namely in terms of the determination of the suitability of such country for the protection of data and the requirements applicable to such transfers.

6. Use of Cookies

When visiting the Site of Gest.Al. S.r.l., consent will be requested from the User for the creation and saving on your computer of a text file (Cookie). This file, when recognizing you, will allow the User an easier and faster access to the Site, as well as a personalized use in accordance with your preferences.

The majority of browsers accept these files (Cookies), but the User may delete them or block them automatically. In the “Help” Menu of your browser you will find how to set up these configurations. You may also accept or not accept Cookies specifically on the Site. However, if you do not allow the use of Cookies there may be some functionalities on the Site which you may not be able to use. LINK

B) Users Rights (Data Holders)

7. Right to Information

7.1. Information provided by Gest.Al. S.r.l. to the User (when the Data is collected directly from the User):

Identification and contact details of Gest.Al. S.r.l. ,responsible for processing, and if applicable, of its representative.
The contact details of the Data Protection Officer, if applicable;
The purposes of the Personal Data processing, as well as, if applicable, the legal reasons for the processing;
If the Personal Data processing is based on the legitimate interests of Gest.Al. S.r.l. or a third party, indication of such interests;
If applicable, the recipients or categories of recipients of the Personal Data;
If applicable, indication that Personal Data will be transmitted to another country or an international organization, and whether or not there is a compliance decision adopted by the Commission or reference to appropriate or adequate transfer guarantees;
Personal Data storage period or the criteria used to define this term;
The right to request from Gest.Al. S.r.l. permission to access the Personal Data, as well as its correction, deletion or processing limitations, the right to object to the processing and the right to the Portability of Data;
If the processing of Data is based on the consent of the user, the right to withdraw it at any time, without compromising the lawfulness of the processing carried out on the basis of the consent previously given;
The right to lodge a complaint with the National Commission for the Protection of Data (CNPD) or other supervisory authority;
Indication as to whether or not the communication of personal data constitutes a legal or contractual obligation or a requirement to complete a contract, as well as whether the holder is obliged to provide Personal Data and the possible consequences of not providing such data;
If applicable, the existence of automatic decisions, including the definition of profiles and information relating to the basic concept, such as the importance and expected consequences of such processing for the Data Holder;

7.2. Information provided by Gest.Al. S.r.l. to the User (when the Data is not collected directly from the User):

In the event the Personal Data is not collected directly from the User by Gest.Al. S.r.l., besides the information referred to above, the User is also informed of the Personal Data categories subject to processing and, also, the origin of the Data and eventually, if the sources are available to the public.
In the event Gest.Al. S.r.l. intends to proceed to the later processing of the User Data for a purpose other than that for which the Data was collected, prior to such processing, it will provide the User with information about that purpose and any other information of interest, pursuant to the terms above.

7.3. Procedures and Implemented Measures for the Compliance with the Right to Information

The information set out in points 7.1 and 7.2 above shall be provided in writing (including by electronic means) by Gest.Al. S.r.l. prior to the processing of the Personal Data concerned. Under the applicable legislation, Gest.Al. S.r.l. has no obligation to provide the user the information mentioned in 7.1. and 7.2. above, when, and to the extent that the User is already aware of them.

The information is provided to the User by Gest.Al. S.r.l. at no cost.

8. Right of Access to Personal Data

Gest.Al. S.r.l. guarantees the means to enable the User to consult its personal data.

The User has the right to obtain confirmation from Gest.Al. S.r.l. whether its Personal Data is processed or not, and, as the case may be, the right to access its Personal Data and the following information:

The purpose of the Data processing;
The categories of the Personal Data in question;
The recipients or categories of recipients to whom the Personal Data has been or will be disclosed, in particular those domiciled in other countries or belonging to international organizations, where appropriate;
The expected Personal Data storage period or, if not possible, the criteria used to define this period;
The right to request from Gest.Al. S.r.l. the correction, deletion or processing limitations of the Personal Data, or the right to object to such processing;
The right to lodge a complaint with the National Commission for the Protection of Data (CNPD) or other supervisory authority;
If the data was not collected from the User, the information available about the origin of such data;
Where appropriate, the existence of automated decisions, including profiling, and information on the underlying logic, as well as the importance and expected consequences of such processing for the Data Holder;
Right to be informed of the appropriate safeguards for the transfer of data to other countries or international organizations, if applicable.

Upon request, Gest.Al. S.r.l. will provide the User, free of charge, a copy of the User Data that is being processed. The supply of other copies requested by the User may entail administrative costs.

9. Right of Correction of Personal Data

The User has the right to request at any given moment, the correction of inaccurate Personal Data that concerns him or her, as well as the right to have his or her incomplete Personal Data completed, including by means of an additional declaration.

In case of data correction Gest.Al. S.r.l. shall notify each recipient to whom the data has been forwarded of the correction, unless such communication is considered impossible or involves a disproportionate effort by "Morgado da Lameira".

10. Right to Deletion of Personal Data (“Right to be Forgotten”)

The User has the right to obtain, from Gest.Al. S.r.l., the deletion of his/her Personal Data when one of the following reasons applies:

The User Data is no longer necessary for the purpose which motivated its collection or processing;
The User withdraws the consent on which the Data processing is based and there being no other legal basis for such processing;
The User opposes to the processing under the right of opposition and there being no legitimate interests which justify the processing;
In the event the Personal Data is processed unlawfully;
In the event the Personal Data has to be deleted to comply with a legal obligation “Morgado da Lameira” may be subject to;

In accordance with the applicable legal provisions, Gest.Al. S.r.l. is under no obligation to delete the User Data to the extent that the treatment proves necessary to fulfill a legal obligation that "Morgado da Lameira" is subject to or for the purpose of declaring, exercising or defending a right of Gest.Al. S.r.l. in a legal proceeding. In the event of deletion of the Data, Gest.Al. S.r.l. communicates the deletion to each recipient/entity to whom the data has been transmitted, unless such communication proves impossible or involves a disproportionate effort by Gest.Al. S.r.l..

When Gest.Al. S.r.l. has made a User's Data publicly available and is obliged to delete it under the right to deletion, Gest.Al. S.r.l. undertakes to ensure that such measures as are reasonable, including taking into account the available technology and the costs of its application, to inform those responsible for the effective treatment of the Personal Data that the User has requested the deletion of the links to this Personal Data, as well as copies or reproductions thereof.

11. Right of Limitation of Personal Data Processing

The User has the right to obtain from Gest.Al. S.r.l. the limitation of the processing of its Personal Data if one of the following situations applies (the limitation consists of inserting a mark in the stored Personal Data with the objective of limiting processing in the future):

If contesting the accuracy of its Personal Data, during a period of time which will allow Gest.Al. S.r.l. to verify its accuracy;
If the processing is unlawful and the User opposes to the deletion of the Personal Data, and requests instead the limitation of its use;
If Gest.Al. S.r.l. no longer needs the User Data for processing purposes, but that data is requested by the User for the purpose of declaring, exercising or defending a right in a legal proceeding;
If the User has opposed to the processing, until it is verified that the legitimate motives of Gest.Al. S.r.l. prevail over those of the User.

When User Data is subject to limitation, it may only, with the exception of storage, be processed with the consent of the User for the purpose of declaration, exercise or defense of a right in a legal proceeding, to defend the rights of another person or company, or for reasons of public interest legally established.

The User who has attained the limitation of processing of its Personal Data in the above mentioned cases will be informed by Gest.Al. S.r.l. before the limitation to the processing is annulled.

In case of data processing limitation, Gest.Al. S.r.l. will communicate to each recipient to whom the data has been transmitted of the respective limitation, unless such communication proves impossible or involves a disproportionate effort by Gest.Al. S.r.l..

12. Right of Portability of Personal Data

The User has the right to receive its Personal Data, which it provided to Gest.Al. S.r.l. in a structured format, in current use and automatic reading, and the right to transmit this Data to another Responsible for Processing, if:

The processing is based on the consent or a contract which the User is a party to;
The processing was carried out by automated means.

The portability right does not include inferred data or derived data, i.e. personal data generated by Gest.Al. S.r.l. as a consequence or result of the analysis of the data being processed.

The User has the right to have its Personal Data transmitted directly between those responsible for the processing, whenever this is technically possible.

13. Right to Oppose Processing

The User has the right to oppose, at any time, for reasons relating to its particular situation, the processing of its personal data, for the purposes of the legitimate interests pursued by Gest.Al. S.r.l. or when the processing is carried out for purposes other than those for which the Personal Data has been collected, including the definition of profiles, or when Personal Data is processed for statistical purposes.

Gest.Al. S.r.l. will stop processing the User Data, unless it presents urgent and legitimate reasons for such processing that prevail over the interests, rights and freedoms of the User, or for the purposes of declaration, exercise or defense of a right in legal proceedings.

When the User Data is processed for the purpose of direct marketing, the User has the right to oppose at any time the processing of its Personal Data for the purposes of said marketing, which includes the definition of profiles, insofar as it is related to direct marketing.

If the User opposes the processing for the purposes of direct marketing, Gest.Al. S.r.l. will cease the processing of Personal Data for this purpose.

The User has also the right to not be subject to any decision solely based on automated processing, including profiling, which may affect its legal position or significantly affects it in a similar way, unless:

It is necessary for the completion of a contract between the User and Gest.Al. S.r.l.
It is authorized by legislation to which Gest.Al. S.r.l. is subject;
It is based on explicit consent by the User.

14. Procedure for the Exercise of Rights by the User

The right of access, right of correction, right of deletion, right of limitation, right of portability and right of opposition may be exercised by the User, in person, at the address of Gest.Al. S.r.l. specified in article 1.2 above, through the specific area of the Site, or by contacting the e-mail address golfclubcavaglia@pec.it, in accordance with the terms of this Privacy Policy.

Gest.Al. S.r.l. will respond in writing (including electronic media) to the request of the User within a maximum of one month from receipt of the request, except in cases of special complexity, where this period may be extended up to two months.

If the requests presented by the User are clearly unjustified or excessive, in particular due to their repetitive nature, Gest.Al. S.r.l. reserves the right to charge administrative costs or refuse to comply with the request.

15. Personal Data Breaches

In the event of a breach of Personal Data and to the extent that such breach is likely to pose a high risk to the User's rights, freedoms and warranties, Gest.Al. S.r.l. undertakes to notify the User in question of any Personal Data breach within 72 hours of becoming aware of the incident.

In legal terms, communication to the User is not required in the following cases:

If Gest.Al. S.r.l. has applied adequate technical and organizational protection measures, and these measures have been applied to the Personal Data affected by the breach of Personal Data, especially measures that make Personal Data incomprehensible to anyone not authorized to access such data, such as encryption;
If Gest.Al. S.r.l. has taken subsequent measures to ensure that the high risk to the rights and freedoms of the User is no longer likely to materialize or,
If the communication by Gest.Al. S.r.l. involves a disproportionate effort for Gest.Al. S.r.l. In this case, Gest.Al. S.r.l. will make a public communication or take a similar action through which the User will be informed.

C) Final Part

16. Changes to the Privacy Policy

Gest.Al. S.r.l. reserves the right to change the Privacy Policy at any time. In case of alteration of the Privacy Policy, the date of the last change, available at the end of this page, will also be updated.

17. Applicable Law and Forum

The Privacy Policy, as well as the collection, processing or transmission of User Data, is governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and European Council, dated 27 April 2016 and by the applicable laws and regulations in Italy.

Any litigation arising out of the validity, interpretation or execution of the Privacy Policy, or relating to the collection, processing or transmission of User Data, must be submitted exclusively to the jurisdiction of the courts of the county of Biella, without prejudice to the legal rules applicable.

18. Declaration of Consent

The User declares that it has understood all the provisions of this Privacy Policy and consents to the collection and processing of its Personal Data in accordance with the foregoing terms and conditions.