INFORMATION ON THE PROCESSING OF PERSONAL DATA

This policy is addressed to all subjects visiting or interacting with our internet website FRIGERIO VIAGGI S.R.L. (hereafter also referred to as “FV” or the “Company“) and it relates only to this website and not to other sites the user can possibly connect to through links included in the above-mentioned website. The Company will be in no way responsible for the unlawful processing of Its data by third parties. Therefore, for exercising the rights as per the paragraph “Rights of the data subject”, it is necessary to make reference to the specific information provided each time by third parties as autonomous data controllers.

This policy is based on the Recommendation n. 2/2001 about the protection of online personal data, European authorities adopted on May 17, 2001 in order to identify some minimal requirements for collecting online personal data and, in particular, modalities, time frames and nature of the information the data Controllers should provide to users when they connect to websites, regardless of the purpose of this connection.

Specific information on the processing of personal data will be progressively provided or displayed on the website pages created for services on request.

The Company will process Its personal data in compliance with the provisions of the Regulation (UE) 2016/679 of April 27, 2016 (hereafter referred to as “Regulation” or “GDPR”).

Pursuant to article 13 of the Regulation, you can provide your personal data or third-party personal data in your lawful possession to FV for:

• Offering, organising and providing services to support business trips requiring the supply of personal data to airlines, car hire companies, hotels, insurance companies, tour operators and other third-party operators providing services or performing activities in accordance with their contract relations with FV.
• Making payments.
• The organisation of a tourist package or for the supply of individual tourism services.
• The purchase of related tourism services.
• Intermediation in the purchase of a tourist package organised by third parties or the purchase of individual tourism services provided by third-party suppliers (for example hotels, carriers, etc.).
• Intermediation in the purchase of ancillary financial/insurance services and/or of those related to the tourist packages/services at favourable terms and/or individually purchased (health/luggage insurance policies; cancellation policies; assistance to travellers in difficulty; consumer credit).
• Carrying out tasks relating to the issue of visas.
• Registration on our website and/or to our app for mobile devices.
• Registration to our newsletter.

Purpose and legal basis of data processing.

The data you provide and requested by FV, for having access to the several services offered on the site, will be processed according to the purposes and modalities indicated in the information sheet on the website pages created for the access to these services and the collection of the relating data. 

The voluntary sending of e-mails to the addresses reported on the site implies Our following collection of the sender’s address and of the possible personal data transmitted together with those emails. 

Whenever the user has the possibility to freely fill in his personal data (e-mail, free-form fields, etc.), our Company will process those data – if they are considered relevant or necessary – to fulfill the user’s requests.

Whenever the communicated personal data are not considered relevant or necessary for providing the required service or no consent has been expressed, if necessary, FV retains the right at Its sole discretion, to cancel these data.

The collected personal data are necessary to fulfill pre-contract and specific law obligations and to correctly perform a contract.

We can also collect and use the information relating to children, only if provided by a parent or tutor and with their consent, in order to fulfill pre-contract and law obligations and to correctly perform a contract. Shall we find out we have processed children’s data without the valid consent of a parent or a tutor, we will retain the right to cancel such information.

To fulfill pre-contract and specific laws obligations and correctly perform the contract, we can also collect data relating to the definition “particular categories of personal data” (art. 9 of the Regulation), in other words those data detecting “racial or ethnic origin, political opinions, religious or philosophical beliefs, Trade Union membership, as well as genetic information, biometric data to uniquely identify a person, data relating to health, sexual life or orientation of a person” or data relating to his habits and/or customs and traditions referring to travel needs or to the use of the tourism service . In this case, these particular data categories will be processed only after a specific and clear request by the user, if considered relevant and/or necessary for providing the service requested.

a) Purpose relating to the performance of the contract

Your personal data will be processed in order to comply with obligations connected to the negotiation and drafting of the contracts required for the provision of the services, or, anyway, for the fulfilment of the obligations arising from all the contract relations, including the negotiation stage, in order to allow FV to successfully provide the service. In details, the data processing will take place for:

• The conclusion, management and performance of all contract relations, including the aforementioned intermediation;
• Meeting your requests;
• The communication of notices relating to the services purchased or other additional and ancillary services (for example statement of information relating to the services purchased; variation to contract terms; cancellations, reimbursements, etc).

In order to carry out the on-line purchase, it is necessary to create a personal account, signing in through the relating procedure. As soon as the personal account is created, you will receive the relating information on the process of your personal data. As foreseen by the Recommendation n. 2/2001, you will always have the chance to log in to your personal account to modify, update, correct and cancel some of your data. We inform you that the right to modify some personal data (like, for example, name, surname, date of birth, sex, etc.) can be exercised only by sending a specific and reasoned request in writing to the data Collector, using the contact information reported on the present policy. Before carrying out the variations, the data Collector reserves the right to verify the compliance of these new data and the reliability of the reasons behind this request.

The transmission of personal data and, in case, of the data included in the definition “particular categories of personal data”

(art. 9 of the Regulation) is optional: in their absence, however, FVI will not provide, totally or partially, the service requested.

In this event, the processing will be based on the need to fulfill the pre-contract, contract and law obligations. 

The processing of particular categories of personal data will nonetheless rely on your explicit and free consent. Therefore, when sending such specific categories of data, you expressly authorize our Company to process these data for providing the requested services. Shall our Company not consider these data relevant and/or necessary to provide the services, FV will retain the right to cancel them. 

FV identifies the kind of payment used for online purchases (credit or debit card, etc.), but it does not show or retain any of the payment data (complete card number, expiry date, safety code, etc.). Just a few specific data (last four card digits, date and time of the transaction, etc.) are retained to carry out, when needed, refunds in your favour.

b) Legal purpose.

Your personal data shall also be processed to:

• ensure compliance with law obligations, regulations, national, European and International laws or obligations arising from provisions issued by entitled authorities.
• ascertain, exercise and/or defend one of FV’s rights in case of disputes, even judicial ones.
• comply with obligations relating to fiscal and accounting matters;
• comply with obligations relating to laws governing travellers’ safety and health;
• comply with obligations relating to laws governing the transport of passengers and goods.

In this event, the processing will rely on the need to comply with the provisions of any law, regulation, or, generally speaking, legislation, including the European one, which is applicable from time to time to the relation with our Company’s explicit consent.

c) Purposes relating to business and statistics.

Your personal data shall also be anonymously processed for statistics and market research.

d)Purposes relating to Marketing and newsletters.

The personal data you will provide through the different site services, excluding the data relating to the definition “particular categories of personal data” (art.9 of the Regulation), can be processed – only with your prior, free and explicit consent – to send newsletters, marketing and/or promotional materials and free products, or invitations to shows and/or events , or to carry out a market research, or to indicate special initiatives dedicated to FV’s clients, as well as to offer promotions, discounts, incentives and other services.

This activity can take place according to different modalities: e-mails, text messages, apps for instant messaging, ordinary mail, phone provider, etc.

In this case the law foundation will be exclusively your prior, free and explicit consent. 

The user will give his consent at the bottom of the specific information page, from time to time, so to have access to each service on the website or signing it in original or in e-format.

You can modify and/or withdraw the consent and the authorization already given for performing the marketing and newsletter activity, by writing to the contact info indicated in the present policy. You can also withdraw your consent choosing the “opt-out” option at the bottom of each newsletter, clicking on “cancel me”.

In no case, however, the withdrawal of the consent can affect the lawfulness of the processing based on the consent given prior to the withdrawal.

e) Profiling purposes.

The personal data you will provide through the different services of the website, with the exclusion of all data relating to the definition “particular categories of personal data” (art.9 of the Regulation) can be processed – only with your prior, free and explicit consent – for analysis activities relating to your travel preference and market research, so to improve the service range and the marketing material offered by FV, making them more suitable to your interests.

This activity can be also carried out through satisfaction surveys and/or the use of profiling cookies used when browsing the websites and apps for mobile devices.

In this case the law foundation will be exclusively your prior, free and explicit consent.

The user will give his consent at the bottom of the specific information page, from time to time, so to have access to each service on the website or signing it in original or in e-format.

You can modify and/or withdraw the consent and the authorization already given for performing the profiling activity, by writing to the contact info indicated in the present policy.

f) Marketing from third parties.

The personal data you will provide through the different services of the website are not communicated and/or given by FV to his trade partners for marketing purposes. 

Apps for mobile devices

If you mean to download and use our app for mobile services, it is important for you to know we always collect some technical information from your mobile device so to let the app work properly and to improve it.

In more details, we collect the following info from your mobile device:

• The model;
• The actual operating system and its version;
• Connection modalities (like: provider, type of net, etc.);
• The selected and/or activated settings (for example: Wi-Fi, GPS, etc.);
• Some usage data (for example: access dates and times, used functions, downloaded files and data, etc.);
• Any other technical info necessary for the proper functioning of the app (for example: version of the installed app).

A specific authorization will be requested to you to activate all services based on tracking through GPS, Wi-Fi, Bluetooth or else.

The authorization to tracking is optional and can be provided both when downloading the app and later on; in absence of this authorization, it will be possible to download and use the app, but it will not be possible to use the services in the app based on tracking.

To deactivate the tracking function of the app after having given the authorization, it will be necessary to modify the settings of your mobile device.

In no case, however, the withdrawal of the consent can affect the lawfulness of the processing based on the consent given prior to this withdrawal.

For all the other personal data possibly communicated through the app for mobile devices, everything indicated in this policy is applicable.

Browsing data and cookies.

The IT systems and software procedures allowing the site functioning acquire some personal data during their standard activity. Their transmission is implied in the use of internet communication protocols.

They are data (like for example: IP addresses, domain names of the computers used, etc.) which are not collected to be associated to identified interests, but which could allow the detection of a specific subject, because of their own nature or because of the processing and association with third parties’ data. These data are used to get anonymous statistics on the use of the website or to check its proper functioning and they are promptly cancelled after the processing. The data could be also useful to ascertain responsibilities in case of possible computer crimes against the website. With the exception of this event, the data on the site will not be there for more than 15 days.

Regarding cookies, please see the section cookies policy on the website.

Processing methods

The data processing will be performed using paper, electronic and computer tools.

The processing will rely on the principles of accuracy, legitimacy, openness and of protection and confidentiality of your rights.

The data will be processed so to minimize the risk of destruction, loss, unauthorized access or processing not complying with the collection purposes.

Categories of recipients of personal data.

Your data shall not be released.

Your data may be forwarded solely for the purposes foreseen by this policy to the following categories of subjects:

• FV’s in-house personnel as the operator in charge of the processing or the one responsible for it.
• Suppliers of the tourism services included in the packages sold or those providing related services or individual services purchased from FV.
• Suppliers and third parties, even in non-EU countries, carrying out the travel booking (hotels, airline companies, sales operation areas, back office, negotiation of charter flights and distribution lines, assistance and administration).
• External processors and third parties who have been correctly hired and trained on the processing of personal data and authorised to process data and manage travel files.
• Insurance and financial companies providing coverage and ancillary services which are connected to the tourist packages and services purchased;
• People, companies, associations or professional firms providing services or assistance and consultancy services to FV, in order to protect any of its rights (for example, certified public accountants, lawyers, tax consultants, auditors, consultants on auditing or due diligence operations etc).
• Third parties in charge of maintaining/developing our computer system for the time ranges necessary to provide the service.
• Third parties providing marketing, analysis or consultancy services to FV.
• All those whose entitlement to access your data have been acknowledged by legal provisions and secondary laws or by provisions from entitled Authorities, including airport, port, customs and border authorities.

Transfer of personal data outside the European Union.

Your personal data may be transferred abroad to other companies which may or may not be European Union member states, for the aforementioned purposes.

Should your data be transferred to countries which are outside the European Union, FV shall check in advance whether the rules applicable to the data processing are respected and whether there are guarantees allowing to keep a suitable level of protection of individuals, on the basis of the assessments carried out by the European Union Commission (art. 45 of the Regulation). As an alternative, the recipient is under a contract obligation to protect data, offering a suitable level, comparable to that foreseen by GDPR (art. 46 of the Regulation).

Retention of personal data.

The personal data shall be retained for a time length no longer than the one necessary for achieving the purposes for which they are collected and then processed.

Your personal data and those relating to the definition “particular categories of personal data” will be retained throughout the period of time foreseen by the laws in force and/or for the necessary time to claim a right of the Holder in court. Whereas you have not given explicit consent to collect and process your personal data even for marketing and/or profiling purposes, they will be automatically cancelled or made permanently anonymous at the end of that period of time.

We remind you that the consent given to the personal data processing for marketing purposes can be withdrawn at any time according to the modalities reported into this policy. 

Whereas you have given the consent to process your data for profiling purposes as well, they will be processed for maximum 5 years. At the end of them they will be automatically cancelled or made permanently anonymous.

Data Controller and Data Protection Officer

The data controller is FRIGERIO VIAGGI S.r.l.,Fiscal Code 07215280152 e VAT Number 00851420968, whose registered office is in (20833) Giussano (MB) Via Ambrogio Viganò n° 5.

With regard to processing travellers’ data, FV has designated a Data Protection Officer, in order to allow travellers to exercise their rights arising under the provision of law governing the processing of personal data. His contact info are the following:

• E-mail: dpo@frigerioviaggi.com
• Ordinary mail address: Frigerio Viaggi S.r.l., Via A. Viganò 5, 20833 Giussano (MB)

Rights of data subject.

At any time, pursuant to articles 15 -22 of the GDPR, you are entitled, also with regard to profiling activity, to:

• ask the data controller:

• the access to your personal data and to the information relating to it;

• the correction of imprecise data or the integration of incomplete data;

• the cancellation of personal data pertaining to you (upon occurrence of one of the conditions indicated in article 17, paragraph 1 of the GDPR and in accordance with the exceptions provided for in paragraph 3 of such article);

• the limitation on the processing of your personal data (upon occurrence of one of the situations indicated in article 18, paragraph 1, of the GDPR);
  
• ask and obtain from the data controller – should the legal basis of processing be the contract or consent, and should this be made using automated means – your personal data in a structured machine-readable format, also for purposes of forwarding your data to another data controller (known as the right to data portability);
  
• raise objection at any time to the processing of your personal data whenever particular situations regarding yourself occur (art. 21 GDPR);
  
• withdraw consent at any time, solely with regard to the eventuality that processing is based on your consent for one or more specific purposes and concerns common personal data (for example date and place of birth or place of residence) or otherwise particular categories of data (for example data showing your racial origin, political opinions, religious beliefs, or sex life). Processing based on consent which is granted prior to its withdrawal nevertheless remains lawful;

• file complaints with a supervisory Authority for data protection.

***

Frigerio Viaggi S.r.l.