Thermal Bonus Privacy Policy

Privacy Policy pursuant to Article 13 of EU Regulation 27 April 2016 n. 679

In accordance with Articles 13 and 14 of Regulation EU 2016/679 (“GDPR” or “Regulation”), and in general in accordance with the principle of transparency set forth in the Regulation, we inform you as follows:

1. CONTROLLER OF THE PROCESSING AND CONTACT DETAILS OF THE PERSONAL DATA PROTECTION OFFICER

The data controller (i.e., the entity that determines the purposes and means of processing personal data) is Società Terme Dolomia srl, with registered office in San Giovanni di Fassa – Pozza di Fassa, Tax Code 01167750221, PEC termedolomia@legalmail.it, and e-mail info@termedolomia.it. For specific contacts related to personal data protection, including the exercise of rights under the following point 8, it is informed that the Data Protection Officer (DPO), Avv. Marco Berti, has been designated pursuant to Article 37 of the Regulation, who can be contacted through the following channels: tel. 0461 261842, e-mail marco.berti@avvocatomarcoberti.it.

2. PURPOSE OF THE PROCESSING

The processing of data may have the following purposes:

1) conclusion of contracts and fulfillment of contractual obligations (both in favor and against the controller), and thus for purposes strictly related to customer relations management, including administrative and accounting formalities and performance (e.g., acquisition of preliminary information for contract conclusion; execution of activities based on contractual obligations with the customer) and dispute resolution (contractual purposes);

2) promotion and sale of products and services via e-mail newsletters (marketing purposes).

3) provision of the “bonus terme” according to Law 126 of October 13, 2020 and subsequent provisions.

3. TYPE OF DATA PROCESSED

The following categories of data may be processed:

– surname, first name, place and date of birth;
– tax code and/or VAT number;
– phone number/e-mail address;
– identification document, including photograph and/or health card;
– billing address;
– payment data (including, if made via bank transfer, bank account number);
– economic data or data defining family/social situations for entitlement to exemptions;
– health data related to treatments and services agreed upon.

4. LEGAL BASIS OF THE PROCESSING AND OBLIGATORY NATURE OF THE DATA PROVISION

Regarding: 1) purpose 1) there is no obligation to provide data, but the lack of provision may prevent the conclusion of the contract and thus the performance. In particular, data whose provision is necessary for the conclusion of the contract and the provision of the service are those indicated in the form with an asterisk (*). Failure to provide data that would entitle you to exemptions will result in the inability to benefit from them. The legal basis for such processing is that it is necessary for the performance of the contract in place with you or pre-contractual measures adopted at your request and/or for compliance with a legal obligation to which the data controller is subject. With respect to the processing of health data, it is permitted only if the data subject provides explicit consent, without which it will not be possible to process such data, even for the execution of services. However, the prohibition on processing special categories of personal data does not apply if such processing is necessary to ascertain, exercise or defend a right in court, and therefore processing for such purposes may occur regardless of your consent or revocation thereof. In certain circumstances related to potential health emergencies, the processing of data may be based on the necessity to safeguard vital interests.

2) purpose 2) being a “marketing purpose,” the provision of data requested for such purpose is completely optional, and the lack of provision will have no consequence on your rights in relation to the service provision. The legal basis for processing is your consent.

5. SOURCE, MODALITIES OF PROCESSING, AND STORAGE

The data is collected from the data subject; they are the ones you provide and that result from the performance of services. The processing will be carried out:
1) using manual and automated systems;
2) by categories of authorized subjects for the performance of such tasks;
3) with appropriate measures to ensure confidentiality and data protection and to prevent access to the data by unauthorized third parties.

Regarding purpose 1), your data will be stored for the entire duration of the contractual relationship, for as long as necessary and, after termination of the relationship – always limited to the data that are necessary at that point – for the settlement of obligations assumed under the contract and for the fulfillment of all possible legal obligations and contractual requirements arising from or related to it.

Regarding purpose 2), the processing will last, if the consent is not revoked before (see the next point 8), for a period not exceeding 48 months from the release of your consent or its renewal. There are no automated decision-making processes.

6. DISCLOSURE OF DATA

The collected and processed data may be disclosed exclusively for the specified purposes to:
– all entities to whom access to such data is granted by legal provisions;
– employees, collaborators, and suppliers of the data controller, within their respective duties and/or contractual obligations related to the execution of the contractual relationship with the interested parties; among the suppliers of the data controller, the following are mentioned by way of example: banks and financial institutions, insurance companies, legal advisors, software providers, and related support;
– if necessary for the performance, data or reports may be sent to medical centers or laboratories for examinations requested or necessary to allow the provision of care;
– (with your consent), the Italian State, or its delegates, for data relevant to tax return pre-filling;
– (with your consent), the tax authority to benefit from the “bonus terme” according to Law 126 of October 13, 2020 and subsequent provisions.
The data is not subject to dissemination.

7. LOCATION OF DATA PROCESSING

The activity is carried out within the European territory. There is no intention to transfer data outside the territory of the European Union or to an international organization.

8. RIGHTS OF THE DATA SUBJECT

Here are the rights that you may exercise as a data subject under the GDPR, indicated regardless of the actual occurrence of individual situations in the case of interest:

1. Access to personal data (thus, you have the right to get free information about the personal data held by the Data Controller and the related processing, as well as to obtain a copy in an accessible format).
2. Rectification of data (we will, upon your notification, correct or integrate your data – not evaluative elements – that are incorrect or inaccurate, even if they have become such due to non-updated information).
3. Revocation of consent (if the processing is based on consent you have provided, you may revoke consent at any time without affecting the legality of the processing performed before the revocation).
4. Data deletion (right to be forgotten) (e.g., data are no longer necessary for the purposes for which they were collected or processed; they were processed unlawfully; they must be deleted to fulfill a legal obligation; you have revoked consent, and there is no other legal basis for processing; or you object to the processing).
5. Restriction of processing (in certain cases – contesting the accuracy of the data, pending verification; contesting the legality of the processing with objection to deletion; need for use for your defense rights, while they are no longer useful for processing; if there is opposition to processing, while necessary checks are carried out – data will be stored in a manner that can be restored if necessary, but not accessible to the Data Controller unless concerning the validity of your request for restriction).
6. Opposition in whole or in part to processing for legitimate reasons (in certain circumstances, you may object to the processing of your data, especially if personal data are processed for direct marketing purposes, you have the right to object at any time, including profiling where connected to such direct marketing. If personal data are processed for scientific or historical research or statistical purposes, for reasons related to your specific situation, you have the right to object to processing, except where processing is necessary for the performance of a task in the public interest).
7. Data portability (if processing is based on consent or contract and is performed by automated means, upon request, you will receive in a structured, commonly used, and machine-readable format, the personal data concerning you, and you can transmit them to another data controller without impediments from the Data Controller to whom they were provided and, if technically feasible, you can request that this transmission be carried out directly by the latter).
8. Right to lodge a complaint with the supervisory authority (Data Protection Authority – Garante Privacy).