The personal data you provide will be processed by Vestal Srl – Via Josip Ressel 2/7 – 34018 San Dorligo della Valle (TS) – +39 040 231158, acting as Data Controller, for purposes related to the provision of the services you have requested (for example: requesting information, registering on the site to receive benefits and offers, obtaining quotes, making payments, purchasing goods and having them delivered to an address specified by you, making a reservation, exchanging documents).

PERSONAL DATA PROCESSED AND PURPOSE OF PROCESSING

Browsing data

The computer systems and software procedures used to operate this site acquire some personal data, the transmission of which is implicit in the use of Internet communication protocols. This category of data includes the IP addresses or domain names of the computers and terminals used by users, the URI/URL (Uniform Resource Identifier/Locator) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.), and other parameters relating to the user’s operating system and IT environment.

This data, necessary for the use of web services, is also processed for the following purposes:

– Obtain statistical information on the use of services (most visited pages, number of visitors per time slot or day, geographical areas of origin, etc.);

– Verify the correct functioning of the services offered.

Browsing data is not retained for more than seven days and is deleted immediately after its aggregation (except where judicial authorities need it to investigate criminal offenses).

Data Provided by the User

The optional, explicit, and voluntary sending of messages to the contact addresses published on the website, as well as the completion and submission of forms on the website, entails the acquisition of the sender’s contact details, which are necessary to respond, as well as all personal data included in the communications.

Specific information is published on the website pages dedicated to the provision of certain services, with requests for consent to their processing.

Cookies

A specific notice on cookies (not profiling cookies) is displayed on the website’s home page.

LEGAL BASIS FOR PROCESSING

The company may process the aforementioned personal data even without specific consent, as the legal basis for the lawfulness of the processing derives from the implementation of pre-contractual measures adopted at the request of the data subject (e.g., requesting information via email), as well as the pursuit of the company’s legitimate interest in promoting and achieving its statutory objectives.

The provision of data for the aforementioned purposes is free and optional; However, any refusal will make it impossible for the company to pursue the aforementioned purpose.

PROCESSING METHODS

The data is entered into an electronic database and/or stored in paper archives.

The data is not subject to an automated decision-making process, nor is any type of profiling carried out.

DATA RECIPIENTS

Personal data may be accessed by the company’s collaborators and employees, who are

authorized to process the data and specifically trained.

The data may be disclosed to external parties (e.g., companies that manage web platforms, affiliated agencies or agencies belonging to other local entities, etc.) for the purposes outlined above, if their involvement is necessary. These parties will act as independent Data Controllers or will be designated as Data Processors.

DATA RETENTION PERIOD

The company will retain the data for the time strictly necessary to achieve the purposes stated above and also to respond to any need for data access and recovery. After 24 months from the date of collection (7 days for browsing data), if there is no further need for contact or retention obligations, the data will be deleted.

DATA SUBJECT RIGHTS

The rights recognized include the following:

• request access to your personal data and related information; rectification of inaccurate data or completion of incomplete data; erasure of personal data (if one of the conditions set out in Article 17, paragraph 1 of the GDPR applies and subject to the exceptions set out in paragraph 3 of the same article); restriction of processing of personal data (if one of the conditions set out in Article 18, paragraph 1 of the GDPR applies);
• request and obtain—where the legal basis for processing is a contract or consent, and processing is carried out by automated means—your personal data in a structured, commonly used, machine-readable format, including for the purpose of communicating such data to another data controller (so-called right to data portability);
• object at any time to the processing of your personal data in specific circumstances;
• withdraw consent at any time, limited to cases in which the processing is based on consent for one or more specific purposes and concerns common personal data (e.g., date and place of birth or place of residence), or particular categories of data (e.g., data revealing health or sex life). Processing based on consent and carried out prior to its withdrawal remains lawful.

With regard to the purposes indicated above, the data subject has the right, at any time, to request cessation of processing and to receive email communications from the company, with a request to be submitted to the contact details indicated above.

RIGHT TO LODGE A COMPLAINT

The data subject, if he or she believes that his or her rights have been compromised, has the right to lodge a complaint with the Italian Data Protection Authority, located at Piazza Venezia 11, 00187 Rome.