Privacy Policy

With reference to EU Regulation 2016/679 (GDPR) and to italian Legislative Decree196 / 2003 (Privacy Code), Cala Serena s.r.l., based in Milan, Porta Ticinese 34, as Data Controller, will process your personal data for the execution of contractual or legal obligations. Pursuant to art. 13 Privacy Code and of art. 13 GDPR, the Data Controller gives the following information.

Processing
The Data Controller will process your personal data as for example name, surname, company name, address, telephone number, e-mail address, bank and payment details,  as for art. 4 GDPR and occasionally data of special categories as for art. 9 GDPR (for example related to health, ethnic origin, etc.).

Purpose

The data processing is necessary for the realization of the requested services, therefore without them we will not be able to satisfy your requests. The data controller operates pursuant to art. 24 a), b), c) Privacy Code and art. 6 b), e) GDPR for the following purposes: a) fulfill the pre-contractual, contractual and tax obligations; b) comply with laws, regulations, community legislation or an order of the Authority; c) exercise its rights, for example the right to defense in court.

Consequences of the refusal to provide data
The refusal to provide data necessary for us, such as personal details and payments, may make it impossible to establish or continue contractual relationships.

Marketing and newsletters

Your personal data will be processed only upon your specific consent pursuant to art. 23 and 130  Privacy Code and of art. 7 GDPR, for marketing purposes, in order to  send  by e-mail, mail,sms and by telephone commercial communications and advertising material  concerning our products or services and detect our customer’s satisfaction.

The consent for this purpouse is optional, can be revoked at any time and does not affect the provision of the requested services.

Profiling
Your personal data will be processed only upon your specific consent pursuant to art. 23 and 130 Privacy Code and to art. 7, 21 and 22 GDPR for profiling and direct marketing. We perform profiling of physical persons collecting and analyzing information relating to consumption habits and personal preferences, interests and other personal characteristics. Profiling makes it possible to adopt decisions, even automated ones, that conduct to personalized marketing. The consent for this purpouse is optional, can be revoked at any time and does not affect the provision of the requested services.

Method

The data will be processed on paper and with IT tools to perform the operations describe in art. 4  Privacy Code and art. 4 point 2 GDPR and more precisely: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction, in compliance with current legislation in relation to data protection.

Data communication

Without the need for an express consent pursuant to art. 24 a, b, d Privacy Code and art. 6 b, c GDPR, the Data Controller may communicate your data to subjects to whom the communication is mandatory for the execution of management, accounting, regulatory compliance, for example, subjects to whom the right to access the data is granted by laws or regulations, credit institutions, financial, insurance and auditing institutions, credit recovery companies, data processing and IT services companies, associated companies, subsidiaries or controlling companies. Data will not be disclosed.

Access to data

Your personal data will be processed by formed and appointed operators such as:  internal staff and management, hotels staff and management, receptionists,  accountability operators and staff in structures reffering to Cala Serena srl.  Data can also be processed by external managers, the list is kept by the data controller.

Data transfer
Personal data are stored on servers located in Italy.

Rights of the data subject

As data subject, you are granted the following rights as from art. 7 Privacy Code and art. 15 GDPR:

a) obtain confirmation of the existence of personal data concerning you, even if not yet registered, and their communication in an intelligible form; b) obtain the indication of the origin of personal data, of the purposes and methods of the processing, of the logic applied if electronic instruments are used, of the details of the owner, the managers and the designated representative pursuant to art. 5, point 2 of the Privacy Code and art. 3, point 1, GDPR, the subjects or categories of subjects to whom the personal data may be communicated ; c)  obtain: updating, rectification or integration of data, cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed, the attestation that the listed operations and their content have been brought to the attention of those to whom the data have been communicated , except in the case where such fulfillment is impossible or require an effort manifestly disproportionate to the protected right; d) to object, in whole or in part, for legitimate reasons, to the processing of personal data concerning you, even if pertinent to the purpose of the collection, to object to the processing concerning marketing and advertising, market research or commercial communication.

Where applicable you are also granted the rights as for art. 16-22 GDPR (rectification, oblivion,  limitation, portability of data, opposition, opposition to profiling), as well as the right of complaint to a supervisory authority.

How to exercise your rights
You may exercise your rights at any time by contacting the Data Controller Cala Serena srl, based in Milan, in Corso di Porta Ticinese 34.