Introduction
Our organization offers its clients and partners (collectively, the “Data Subjects”) the highest standards of hospitality and welcome.
However, Dimora Ghirlandaio could not carry out the activities of welcoming its customers and managing it with its partners and other interested parties, without acquiring and processing the personal data that the Data Subjects themselves freely decide to provide to it.
That said, the privacy and security of the personal data of each individual Data Subject is a priority for our organization; for this reason, it is very important to explain, in a clear, understandable and transparent way, how and why our organization collects, stores, shares and uses the personal data of the Data Subject, and to explain the controls and choices that the Data Subject can exercise. In this way, the Data Subject himself will be able to decide whether and what data to share our organization, in an informed, free and informed way.
This is the purpose of this privacy policy (hereinafter, the “Policy”).
Purpose of the policy
This Policy illustrates the essential details relating to the collection and processing of the Data Subject’s personal data by Società Agricola Indaco S.r.l. a socio unico – Dimora Ghirlandaio.
The provisions of this Policy refer to all the services offered by our organization, both during hospitality at our facility, and through the https://www.dimoraghirlandaio.it/ website and in general during any relations between the Data Subject and Società Agricola Indaco S.r.l.
This Policy contains the information necessary for Data Subjects to understand:
- What personal data is collected about them;
- The purposes for which they are collected, used and shared;
- To whom these data are or may be transferred;
- The legal bases on which the processing of Società Agricola Indaco S.r.l. is based;
- The way in which the personal data that the Data Subject shares with Società Agricola Indaco S.r.l. are used and protected;
- Your rights in relation to your personal data and how your privacy is protected.
Società Agricola Indaco S.r.l. hopes that this will help to unequivocally express its constant commitment to the protection of your personal data. For further clarification on the terms used in this Policy and, in general, for any information, questions or concerns, you can send an e-mail to info@dimoraghirlandaio.it.
Data Controller
The data controller, as described in detail below, (hereinafter, respectively, the “Data Controller” and the “Data”) is: Società Agricola Indaco S.r.l. a socio unico – a company subject to the management and coordination of Le Cipresse S.r.l with registered office in Piazza Vittorio Veneto, 1 – 50123 Firenze (FI) Italy and operational headquarters in via Colleramole 59 Impruneta (FI)
Email address of the Data Controller: info@dimoraghirlandaio.it
DATA PROTECTION OFFICER
The Data Protection Officer (DPO), as described in detail below, (hereinafter, the “DPO”) is: Sicures S.r.l. – which can be contacted at the email privacy@sicures.it
General principles and commitment to the protection of personal data
Our organization is committed to protecting all personal data it processes, adhering to the following general principles:
- All data are processed in a lawful, correct and transparent manner towards the data subject, in compliance with the general principles provided for by EU Reg. no. 2016/679 and by the current legislation on the protection of personal data:
- All data are processed and collected only for the purposes indicated in this Policy or for the specific purposes already shared with the data subject, with the aim of collecting, processing and using as little personal data as possible;
- When the personal data collected is no longer necessary for any purpose provided for in this policy or emerged from agreements subsequently undertaken or to comply with the legal obligations of the Data Controller and/or the data subject, it will be done as reasonably possible to delete, destroy or anonymize them;
- Specific security measures are observed to prevent the loss of data, illicit or incorrect use and unauthorized access;
- The personal data covered by this policy will not be shared, sold, made available or communicated to parties other than those indicated in the Policy without your express consent.
Purpose of the processing and legal basis of the processing
Our organization undertakes to process the data you voluntarily provide or acquire on online hotel booking platforms exclusively for the activities necessary for the execution of the requested services of which the Data Subject is a party or for the execution of pre-contractual measures adopted at the request of the same (Art. 6 GDPR).
The processing of Users’ personal data is carried out for the following purposes:
- to guarantee access to the above-mentioned website, navigation, and use of the online services made available in connection to the site itself;
- for needs relating to the use of the services offered by Dimora Ghirlandaio with reference to the provision of all services related to hospitality at our facility;
- for all operations envisaged on the basis of service or contractual agreements undertaken between the Data Controller and the data subject;
- where the activity is envisaged and subject to the express consent of the User, for the sending of information and promotional communications via e-mail, as well as newsletters by the Data Controller in relation to its own initiatives;
- to ascertain responsibility in the event of hypothetical computer crimes against the site;
- to fulfil its obligations regarding the communication of data on guests’ stay at our facility to the public control bodies.
The legal basis of the processing is:
- for the purposes referred to in points a), b) and c), the execution of the contract to which you are a party or the execution of pre-contractual measures, or other legal obligations;
- for the purposes referred to in point d), by the consent freely expressed by the data subject;
- for the purposes referred to in point e), by the legitimate interest of the Data Controller.
- for the purposes referred to in point f), by the Consolidated Law on Public Security
Data collected
The personal data that will be collected and processed may concern:
- identification data: surname and first name, residence, domicile, birth, nationality and citizenship, online identifier (username, password, customer ID, other), tax and bank data, contact data, identity documents.
- Other data: data referring to particular needs, food preferences, need for services or access.
Data retention period
Personal data will be processed in accordance with the principles set out in Art. 5 Regulation (EU) 2016/679 for the period necessary to carry out the activities covered by this consent or for the durations imposed by specific legal obligations. Computer connection log files are retained for 60 days.
Data categories | Retention period | Regulatory references |
Personal data (name, surname, identity documents, addresses) | 10 years | Art. 2220 Civil Code Art. 22 Presidential Decree 600/1973 Retention period of accounting and tax records R.D. 773/1931 TULPS |
Tax documents (e.g. invoices) | 10 years | |
Telephone and email contact details | 5 years from the conclusion of the relationship * | |
bank details and payment systems used | 2 years from the conclusion of the relationship | EU Reg. 2016/679 art. 6 b) the processing is necessary for the performance of a contract to which the data subject is a party or for the execution of pre-contractual measures adopted at the request of the same |
Other data relating to the service offered | 5 years from the conclusion of the relationship |
* If you subscribe to our mailing and information services, your contact details and your name will be stored until you revoke your consent.
Methods and duration of processing
The personal data you provide are processed mainly but not exclusively with IT and/or telematic tools. The processing is carried out using organizational methods and logics strictly related to the purposes indicated. The Data Controller has implemented technical, procedural and organizational measures to provide an adequate level of security, confidentiality, integrity and availability of personal data. These measures take into account the state of the art of the technology, the costs of its implementation, the nature of the data and the risks associated with their processing. The purpose is to protect data against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure, disclosure or access, and other forms of unlawful processing.
In addition, when handling your personal data, the Data Controller collects and processes personal data that is adequate, relevant and not excessive, as required to fulfill the above purposes and ensures that such personal data remains up-to-date and accurate.
The data are processed at the operational offices according to which the Data Controller is organized, and at companies appointed and duly appointed as Data Processors ex. Art. 28 del GDPR.
Data transfer
The data will not be transferred outside the European Union in the absence of Adequacy Decisions by the Data Protection Authority or Binding Corporate Rules. In any case, it is understood that the Data Controller, if necessary, will have the right to move the location of the servers to non-EU countries or to the cloud. In this case, the Data Controller hereby ensures that the transfer of data will take place in accordance with the applicable legal provisions by stipulating, if necessary, agreements that guarantee an adequate level of protection.
Categories of subjects to whom the data may be communicated
The data collected by the Data Controller will be shared only for the purposes mentioned above; we will not share or transfer your personal data to third parties other than those indicated in this Policy. In the course of our activities and exclusively for the same purposes as those listed in this Policy, your personal data may be transferred to the following categories of recipients:
- business partners of the Data Controller, to whom the Data Controller communicates the data exclusively to ensure the provision of services;
- hosting providers, IT companies, communication agencies, third-party technical services, consultants with professional assignments, shipping companies and couriers, credit institutions;
- persons, companies or professional firms that provide assistance and advice to the Data Controller, in accounting, administrative, legal, tax and financial matters;
- subjects who have the right to access the data by law or by orders of public authorities and supervisory bodies;
- Public bodies and authorities for the performance of their institutional tasks and for the activities of supervision and protection of the regulations in force.
With these subjects, if necessary, agreements may be signed by the Data Controller that identify them as Data Processors pursuant to art. 28 of EU Reg. 2016/679. The updated list of Data Processors can always be requested from the Data Controller.
In any case, the disclosure of your personal data is completely excluded.
Existence of automated decision-making, including profiling
Società Agricola Indaco S.r.l. does not adopt any automated decision-making process, including profiling, referred to in Article 22, paragraphs 1 and 4, of EU Regulation 2016/679.
Types of data collected when browsing our website
The website offers informative and sometimes interactive content. During navigation, the Site may, therefore, acquire information about the visitor, in the following ways:
BROWSING DATA
The computer systems and software procedures used to operate our website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, successful, error, etc.) and other parameters related to the user’s operating system and computer environment. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and are deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the site.
COOKIES
In order to make our services as efficient and user-friendly as possible, our website uses cookies. Therefore, when visiting the Site, a minimal amount of information is placed on the User’s device, such as small text files called “cookies”, which are saved in the directory of the User’s web browser. There are different types of cookies, but basically the main purpose of a cookie is to make the Site work more effectively and to enable certain features.
The Site uses “technical” cookies, such as navigation or session cookies, functionality cookies and analytical cookies.
NAVIGATION OR SESSION COOKIES
Specifically, navigation or session cookies are used, aimed at ensuring normal navigation and use of the website, and therefore aimed at making functional and optimizing the same navigation within the site.
FUNCTIONALITY COOKIES
In addition, functionality cookies are installed, which are strictly necessary to provide services explicitly requested by the user.
ANALYTICAL COOKIES
There are analytical cookies, used exclusively by the Site manager alone, to collect information, in aggregate and anonymous form, on the number of users and how users visit the site.
PROFILING COOKIES
Finally, profiling cookies may be used; these tools are used to create profiles relating to the user who encounters them during his navigation, this profile is then used for commercial purposes, through the sending of advertising messages tailored to the tastes and preferences expressed on the web by the user.
Tag management
This type of service is functional to the centralized management of the tags or scripts used on the website.
The use of these services involves the flow of the user’s personal data, such as browser used, IP address, date and time of connection, through them and, where applicable, their management.
Google Tag Manager: Google Tag Manager is a tag management service provided by Google Ireland Limited.
Personal Data processed: Usage Data; Tracking Tool.
Place of processing: Ireland – Privacy Policy.
Improving the experience
Some of the services listed below may use Trackers to identify you, or use behavioral retargeting, i.e. display advertisements tailored to your interests and behavior, or measure ad performance. For more information on this, we suggest you check the privacy policies of the respective services. Generally, services of this type offer the possibility of disabling such tracking. In addition to any opt-out features provided by any of the services listed in this document, you can read more about how to opt out of interest-based advertising in the appropriate section “How to opt out of interest-based advertising” in this document.
Anonymized statistics services
The services in this section allow the Data Controller to process and manage statistics anonymously thanks to the use of first-party Trackers.
Google Analytics with anonymized IP (Google Ireland Limited)
Google Analytics is a web analytics service provided by Google Ireland Limited (“Google”). Google uses the Personal Data collected for the purpose of tracking and examining the use of this Application, compiling reports and sharing them with other services developed by Google.
Google may use Personal Data to contextualize and personalize ads from its advertising network.
This integration of Google Analytics anonymizes your IP address. Anonymization works by shortening the IP address of Users within the borders of the member states of the European Union or in other countries that are parties to the Agreement on the European Economic Area. Only in exceptional cases will the IP address be sent to Google servers and shortened within the United States.
Personal Data processed: Usage Data and Tracking Tool.
Place of processing: Ireland – Privacy Policy – Opt Out.
Storage duration:
- AMP_TOKEN: 1 hour
- _ga: 2 years
- _gac*: 3 months
- _gat: 1 minute
- _gid: 1 day
Statistics
The services contained in this section allow the Data Controller to monitor and analyze traffic data and are used to keep track of the User’s behavior.
Google Analytics (Google Ireland Limited)
Google Analytics is a web analytics service provided by Google Ireland Limited (“Google”). Google uses the Personal Data collected for the purpose of tracking and examining the use of this Application, compiling reports and sharing them with other services developed by Google.
Google may use Personal Data to contextualize and personalize ads from its advertising network.
Personal Data processed: Usage Data and Tracking Tool.
Place of processing: Ireland – Privacy Policy – Opt Out.
Meta Ads Conversion Tracking (Meta Pixel) (Meta Patforms Ireland Ltd)
Meta Ads Conversion Tracking (Meta Pixel) is a statistics service provided by Meta Platforms Ireland Limited that links data from the Meta ad network with actions taken within this Application. The Meta pixel tracks conversions that can be attributed to Facebook, Instagram and Audience Network ads.
Personal Data processed: Usage Data; Tracking Tools.
Place of processing: Ireland – Privacy Policy – Opt out.
Category of Personal Information Collected Under the CCPA: Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
Facebook Lookalike Audiences (Facebook Ireland Ltd)
Facebook Lookalike Audiences is an advertising and behavioral targeting service provided by Facebook Ireland Ltd that uses Data collected through Facebook’s Custom Audiences service in order to show advertisements to Users with similar behaviors to Users who are already on a Custom Audiences list based on their previous use of this Application or their interaction with relevant content through Facebook’s applications and services. Based on this data, personalized ads will be shown to users suggested by Facebook lookalike audiences.
Users may opt out of using Facebook Trackers for ad personalization by visiting this opt-out page.
Personal Data processed: Usage Data; Tracking Tool.
Place of processing: Ireland – Privacy Policy – Opt Out.
Category of Personal Information Collected Under the CCPA: Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
- Sharing in California
Advertising reporting capabilities in Google Analytics (Google Ireland Limited)
Google Analytics on this Application has enabled advertising reporting features, which collect additional information from the DoubleClick cookie (web activity) and device advertising IDs (application activity). This allows the Data Controller to analyze specific Data relating to the behavior and interests of Users (Traffic Data and Ad Interaction Data by Users) and, if enabled, Demographic Data (information on age and gender).
Users may opt out of Google’s use of cookies by visiting Google’s [Ads Settings] (https://adssettings.google.com/authenticated).
Personal Data processed: unique identifiers of devices for advertising (Google Advertiser ID or IDFA identifier, for example), Tracking Tool and various types of Data as specified in the privacy policy of the service.
Place of processing: Ireland – Privacy Policy – Opt Out.
Storage duration:
- IDE: 2 years
- _gcl_*: 3 months
- test_cookie: 15 minutes
Google Analytics Demographics and Interests Reports (Google Ireland Limited)
Google AdSense
Google AdSense is an advertising service provided by Google LLC or by Google Ireland Limited, depending on how the Data Controller manages the processing of Data. This service uses the “DoubleClick” cookie, which tracks the use of this Application and the User’s behavior in relation to the advertisements, products and services offered.
The User can decide at any time to disable all DoubleClick cookies by going to: Ads Settings.
For an understanding of Google’s use of data, please see Google’s partner policies.
Personal Data processed: Usage Data; Tracking Tools.
Place of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out.
Category of Personal Information Collected Under the CCPA: Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
- Sharing in California
Google Ads Conversion Tracking
Google Ads Conversion Tracking is a statistics service provided by Google LLC or by Google Ireland Limited, depending on how the Data Controller manages the processing of Data, which connects data from the Google Ads ad network with the actions performed within this Application.
Personal Data processed: Usage Data; Tracking Tools.
Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.
Category of Personal Information Collected Under the CCPA: Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
Google Ad Manager
Google Ad Manager is an advertising service provided by Google LLC or by Google Ireland Limited, depending on how the Data Controller manages the processing of Data, with which the Data Controller may conduct advertising campaigns jointly with external advertising networks with which the Data Controller, unless otherwise specified herein, has no direct relationship. This service uses the “DoubleClick” cookie, which tracks the use of this Application and the User’s behavior in relation to the advertisements, products and services offered.
The User can decide at any time to disable all DoubleClick cookies by going to: Ads Settings.
For an understanding of Google’s use of data, please see Google’s partner policies.
Personal Data processed: Usage Data; Tracking Tools.
Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.
Category of Personal Information Collected Under the CCPA: Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in the United States
- Sharing in California
- Pubblicità mirata in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska e Montana
Google Ads Smart Bidding (Google LLC)
Google Ads Smart Bidding is an advertising service provided by Google LLC that maximizes conversions using various bidding strategies. These strategies can include optimizing bids based on customer lists, device information, and user behavioral activity. Users may opt-out of Google’s use of personalized advertising by visiting Google’s Ads Settings.
For an understanding of Google’s use of data, please see Google’s partner policies.
Personal Data processed: surname; Usage data; email; name.
Place of processing: United States – Privacy Policy.
Category of Personal Information Collected Under the CCPA: Identifiers; Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
- Sharing in California
Google Conversion linker
Google Conversion linker is a statistical service provided by Google LLC or Google Ireland Limited, depending on how the Data Controller manages the processing of Data, which links Data from Google’s ad services with the actions performed within this Application. Depending on the settings of the service, such Data may also be processed for retargeting purposes.
For an understanding of Google’s use of data, please see Google’s partner policies.
Personal Data processed: Usage Data; Tracking Tools.
Place of processing: United States – Privacy Policy – Opt out; Ireland – Privacy Policy – Opt out.
Category of Personal Information Collected Under the CCPA: Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
- Sharing in California
Google Ads advanced conversions
Google Ads Advanced Conversions is an advertising service provided by Google LLC or Google Ireland Limited, depending on how the Data Controller handles Data processing, which allows the Data Controller to send hashed first-party conversion data to Google in order to improve conversion measurements.
Personal Data processed: address; surname; contact details; email; name; telephone number; Tracking Tools.
Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.
Category of Personal Information Collected Under the CCPA: Identifiers; Information about your activities on the Internet or other networks.
Google Ads Customer Match
Google Ads Customer Match is an advertising service provided by Google LLC or Google Ireland Limited, depending on how the Data Controller handles Data processing, which allows the Data that Users have shared with the Data Controller to be associated with existing Google accounts, in order to target them or similar Users with personalized ads. Users may opt-out of Google’s use of personalized advertising by visiting Google’s Ads Settings.
To learn about Google’s use of Data, please see their partner policy and their Commercial Data page.
Personal Data processed: email.
Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.
Category of Personal Information Collected Under the CCPA: Identifiers.
Remarketing e behavioral targeting
This type of service allows this Application and its partners to communicate, optimize and serve advertisements based on the User’s past use of this Application. This is facilitated by tracking Usage Data and using Trackers to collect information that is then transferred to partners who manage remarketing and behavioral targeting activities. Some services offer a remarketing option based on email lists. Generally, services of this type offer the possibility of disabling such tracking. In addition to any opt-out features provided by any of the services listed in this document, you can read more about how to opt out of interest-based advertising in the appropriate section “How to opt out of interest-based advertising” in this document.
Facebook Remarketing (Facebook Ireland Ltd)
Facebook Remarketing is a remarketing and behavioral targeting service provided by Facebook Ireland Ltd that connects the activity of this Application with the Facebook advertising network.
Personal Data processed: Usage Data; Tracking Tool.
Place of processing: Ireland – Privacy Policy – Opt Out.
Category of Personal Information Collected Under the CCPA: Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
- Sharing in California
Facebook Custom Audiences (Facebook Ireland Ltd)
Facebook Custom Audiences is a remarketing and behavioral targeting service provided by Facebook Ireland Ltd that connects the activity of this Application with the Facebook advertising network.
Users may opt out of using Facebook’s Trackers for ad personalization by visiting this opt-out page.
Personal Data processed: email; Tracking Tool.
Place of processing: Ireland – Privacy Policy – Opt Out.
Category of Personal Information Collected Under the CCPA: Identifiers; Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
- Sharing in California
Statistics
The services contained in this section allow the Data Controller to monitor and analyze traffic data and are used to keep track of the User’s behavior.
Advertising reporting capabilities in Google Analytics (Google Ireland Limited)
Google Analytics on this Application has enabled advertising reporting features, which collect additional information from the DoubleClick cookie (web activity) and device advertising IDs (application activity). This allows the Data Controller to analyze specific Data relating to the behavior and interests of Users (Traffic Data and Ad Interaction Data by Users) and, if enabled, Demographic Data (information on age and gender).
Users may opt out of Google’s use of cookies by visiting Google’s [Ads Settings] (https://adssettings.google.com/authenticated).
Personal Data processed: unique device identifiers for advertising (Google Advertiser ID or IDFA identifier, for example); Tracking Tool; various types of Data as specified in the privacy policy of the service.
Place of processing: Ireland – Privacy Policy – Opt Out.
Category of Personal Information Collected Under the CCPA: Identifiers; Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
Meta Events Manager (Meta Platforms Ireland Limited)
Meta Events Manager is a statistics service provided by Meta Platforms Ireland Limited. By integrating the Meta pixel, Meta Events Manager can provide the Owner with information about traffic and interactions on this Application.
Personal Data processed: Usage Data; Tracking Tools.
Place of processing: Ireland – Privacy Policy.
Category of Personal Information Collected Under the CCPA: Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
Google Analytics 4 (Google Ireland Limited)
Google Analytics is a statistical service provided by Google Ireland Limited (“Google”). Google uses the Personal Data collected for the purpose of tracking and examining the use of this Application, compiling reports and sharing them with other services developed by Google. Google may use Personal Data to contextualize and personalize the ads of its advertising network. In Google Analytics 4, IP addresses are used at the time of collection and then deleted before the data is recorded in any data center or server. You can find out more about it in Google’s official documentation.
For an understanding of Google’s use of data, please see Google’s partner policies.
Personal Data processed: Trackers.
Place of processing: Ireland – Privacy Policy – Opt Out.
Category of Personal Information Collected Under the CCPA: Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
Viewing content from external platforms
This type of service allows you to view content hosted on external platforms directly from the pages of this Application and to interact with them. This type of service may still collect data on web traffic related to the pages where the service is installed, even when users are not using it.
Google Fonts (Google Ireland Limited)
Google Fonts is a font style display service operated by Google Ireland Limited that allows this Application to integrate such content into its pages.
Personal Data processed: Usage Data; Tracking Tool.
Place of processing: Ireland – Privacy Policy.
Category of Personal Information Collected Under the CCPA: Information about your activities on the Internet or other networks.
This type of treatment constitutes:
- A Sale in California
Data Provided Voluntarily by the User
In the event of a request to use the services offered by the site, other personal data may be collected, which are necessary exclusively for the provision of the services requested. The optional, explicit and voluntary sending of e-mails to the addresses indicated on this site involves the subsequent acquisition of the sender’s e-mail address, as well as any other personal data entered, necessary to respond to requests. The Data Controller will use this information only to send specific information requested by the data subjects. The information you provide will not be sold, transmitted, licensed, or otherwise forwarded to third parties. The only parties that can acquire payment data are the credit card issuing companies, which can be contacted to verify the validity of the same. In any case, the site administrator ensures the adoption of scrupulous procedures to protect browsing data and the use of special care to protect credit card data provided during online bookings.
The Data of the Data Subject are essential to evaluate and satisfy his requests; If the contact is successful, the Data of the Data Subject will be processed for the specific contractual or pre-contractual obligations.
If the Data Subject contacts Società Agricola Indaco S.r.l. by e-mail or telephone, the latter may process the information and data (including personal data) provided by the Data Subject in order to process his/her request.
The provision of the Personal Data indicated above is necessary for the execution of a contract to which the Data Subject is a party or for the execution of pre-contractual measures adopted on the basis of his/her request and is therefore mandatory. Otherwise, in fact, Indaco S.r.l. is not able to perform this contract or in a position to take measures at the request of the Data Subject.
The data are stored until any request for cancellation from the service, which can be freely made at any time by writing to info@dimoraghirlandaio.it.
Optional nature of data provision
Apart from what is specified for browsing data, the user is free to provide his/her personal data through the collection form, or in any case indicate them in the contact section to use the services offered, request the sending of information and other communications. Failure to provide them may make it impossible to obtain what has been requested. The sending of data involves the subsequent acquisition of the sender’s email address, as well as any other personal data entered, necessary to respond to requests.
Rights of the Data Subject
Users may exercise certain rights with reference to the Data processed by the Data Controller.
In particular, within the limits provided for by law, the User has the right to:
- withdraw consent at any time. The User may revoke the consent to the processing of their Personal Data previously expressed.
- object to the processing of their Data. The User may object to the processing of their Data when it takes place on a legal basis other than consent.
- access your Data. The User has the right to obtain information on the Data processed by the Data Controller, on certain aspects of the processing and to receive a copy of the Data processed.
- verify and request rectification. You can verify the accuracy of your Data and request that it be updated or corrected.
- obtain the restriction of processing. The User may request the restriction of the processing of their Data. In this case, the Data Controller will not process the Data for any other purpose than their storage.
- obtain the deletion or removal of your Personal Data. The User may request the deletion of his/her Data by the Data Controller.
- receive your Data or have them transferred to another controller. The User has the right to receive his/her Data in a structured, commonly used and machine-readable format and, where technically feasible, to obtain its unhindered transfer to another controller.
- lodge a complaint. The User may lodge a complaint with the competent data protection supervisory authority or take legal action.
Users have the right to obtain information regarding the legal basis for the transfer of Data abroad, including to any international organization governed by international law or consisting of two or more countries, as well as regarding the security measures adopted by the Data Controller to protect their Data.
How to exercise your rights
Any requests to exercise the User’s rights can be addressed to the Data Controller through the contact details provided in this document. The request is free of charge and the Data Controller will respond as soon as possible, in any case within one month, providing the User with all the information required by law. Any rectification, erasure or limitation of processing will be communicated by the Data Controller to each of the recipients, if any, to whom the Personal Data have been transmitted, unless this proves impossible or involves a disproportionate effort. The Data Controller shall notify the User of these recipients if he/she so requests.
Information not contained in this policy
Further information in relation to the processing of Personal Data may be requested at any time from the Data Controller using the contact details.
Changes to the Privacy Policy
The Data Controller reserves the right to make changes to this information in order to incorporate changes in the legislation or to adapt to technological innovations. Any changes will be posted on this web page, which is constantly available through the hyperlink located on the home page of the Site.
Last modified: March 17, 2025