Privacy

General
This information (or "Privacy Policy") is provided in compliance with current legislation on the protection of personal data, and, in particular, pursuant to EU Regulation 2016/679 relating to the protection of natural persons with regard to the processing of data personal data, as well as the free circulation of such data (so-called GDPR) and Legislative Decree 196/2003 (so-called Privacy Code), with reference to the processing of personal data of users who access the website www.masseriacorsano.com. This Policy describes how to manage the website with reference to the processing of personal data relating to users who access it. The information is provided only for the site mentioned above and not for other websites that may be consulted by the user through specific links.

Data controller
The data controller is LEDUNS SRL with headquarters in Montecatini Terme at via Mazzini, 62, p. VAT 01874460478 in the person of the pro-tempore legal representative (hereinafter referred to as the Owner). The Data Controller protects the confidentiality of personal data and guarantees them the necessary protection from any event that could put them at risk of infringement.

Purpose of the processing and data subject to processing
The owner may process personal data such as personal data, contact data (in order to use the services, the user may be required to provide some or all of the following data: name, surname, age, street, zip code, e-mail address, address, city, country, date of birth, telephone number, mobile phone number, fax number, period of stay, number of guests, payment information, name and surname of additional guests also additional information), IP addresses or domain names of the computers used by users who connect to the site, URI addresses, browsing data, browsing history.

Booking section
This section allows the user to proceed directly to a binding booking on the site. The transmission of the following personal data of the user is envisaged: name, surname, email, telephone, address, country, city, province, zip code, credit card data. Acceptance of the Privacy Policy is a prerequisite for using the service in question. The Company sends confirmation of the booking by e-mail to the address indicated by the user.

Contact section
The contact section allows the user to use the relevant form to send a personal message to the Data Controller to obtain a reply from the same. The following personal data is requested: name, email and other data possibly mentioned in the "Subject" and/or "Message Text" section. Acceptance of the Privacy Policy is a prerequisite for using the service in question.
The personal data provided will be processed exclusively for the following purposes:

• Purposes strictly connected and instrumental to allow access to and use of the site, its functions and the services requested by the user;
• fulfilment of the obligations established by law;
• operational and management needs concerning the services offered through the site;
• execution of the services by filling in the forms available on the site; exercise of the rights of the owner (for example right of defence in court).
  
  Subject to your express and explicit consent:
• to implement the newsletter service;
• to carry out direct marketing activities by the Data Controller, for sending information and commercial communications, including of a promotional nature, advertising material and/or offers of goods and services by means of traditional contact systems and computer systems, including commercial or promotional communications by email, sms, mail.

Provision of data
The provision of personal data is necessary only for the purposes referred to in points a), b), c), d) and e), as the legal basis of the processing for these purposes is the execution of the services requested by the user, or the use of the site and the various services made available through the site. Therefore, any refusal would make it impossible to provide the performance or service requested; as far as possible, the user will still be given the right to consult the site without providing any personal data, even if in this case, certain functions or characteristics of the site could be disabled. The provision of personal data for the processing activities for the purposes referred to in points f) and g) above is optional, as the legal basis of the processing in this case is always the user's consent, expressed in accordance with this information. Any refusal would make it impossible to carry out the activity described therein. In case of release by the user of express consent, the same can always revoke the consent and oppose the treatment.

TYPE OF DATA PROCESSED
Navigation data
The computer systems and software procedures used to operate this site acquire, during normal operation, some personal data which are then implicitly transmitted in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by their very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users who connect to the site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user's IT environment. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and are cancelled immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the site: except for this eventuality, the data on web contacts will not persist for more than 24 months.

Personal data transfers
Personal data will not be transferred either Member States of the European Union or in Third Countries not belonging to the European Union.

Processing methods
Personal data is processed lawfully and fairly and used only for the purposes indicated. The processing will take place using tools suitable for guaranteeing the security and confidentiality of personal data and with automated tools suitable for storing, managing and transmitting the data. Specific security measures are adopted to prevent data loss and limit the risks of illicit or incorrect use and unauthorized access. Personal data may be stored in paper, IT and telematic archives. The personal data provided will also be processed by employees and collaborators specifically authorized to process them, for the accomplishment of the purposes. In any case, no personal data will ever be disclosed without explicit consent, except for the necessary communications which may involve the transfer.

Data retention period
In compliance with the principles of lawfulness, purpose limitation and data minimization, the personal data collected will be kept for the times prescribed by law and for the time strictly necessary to follow up on the services for which they were collected and/or until the consent given is revoked in the event that processing is carried out for the purposes referred to in points f) and g). They will be kept for no longer than a maximum period of 12 months of inactivity, or if, within this period, no services are associated with them or unless otherwise indicated sections of the website.

Particular categories of personal data
Through this website, personal data belonging to particular categories are not deliberately collected pursuant to articles 26 and 27 of Legislative Decree 196/2003 and articles 9 and 10 of EU Regulation no. 2016/679, i.e. data qualifying as "special categories of personal data" and i.e. data revealing "racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data relating to a person's health or sex life or sexual orientation". It is therefore recommended not to provide such information through this site. In the event that communication is necessary (for example: belonging to protected categories in the event of sending a curriculum vitae for recruitment purposes, in response to a job advertisement or in the event of an expression of interest in working for the Data Controller) invites you to send to the registered office of the Company, by registered letter, a specific declaration containing the written consent to the processing of data belonging to particular categories (for example relating to health).

Data communication
Personal data may be communicated, within the limits strictly connected to the web services of this site, only to the technical personnel expressly entrusted with processing by the Data Controller. The data acquired via the web may also be communicated to the internal staff appointed by the Data Controller and to any technological partners that the Data Controller may use for the provision of services specifically designated as Data Processing Managers. The data collected may also be communicated to the entities or subjects authorized for this purpose for the fulfilment of legal obligations.

Rights of the interested party
At any time, the user can exercise, pursuant to art. 7 of Legislative Decree 196/2003 and articles from 15 to 22 of EU Regulation no. 2016/679, the right to:

• request confirmation of the existence or otherwise of personal data;
• obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated and, when possible, the retention period;
• obtain the rectification and cancellation of data if:
  • the data are no longer necessary with respect to the purposes for which they were collected or processed,
  • the data have been processed unlawfully,
  • the consent has been revoked,
  • there has been an opposition to the processing
• obtain the limitation of the treatment;
• obtain data portability, i.e. receive them from a data controller, in a structured format, commonly used and readable by an automatic device, and transmit them to another data controller without impediments;
• oppose the treatment at any time and also in the case of treatment for direct marketing purposes;
• ask the data controller to access personal data and correct or cancel them or limit their processing or to oppose their processing, in addition to the right to data portability;
• revoke the consent at any time without prejudice to the lawfulness of the treatment based on the consent given before the revocation;
• lodge a complaint with a supervisory authority.

Minors
The site www.masseriacorsano.com is not intended for use by minors, who are not authorized to make purchases through the sites listed. We understand the importance of protecting information intended for minors, especially in an online environment and therefore we do not knowingly collect or maintain personal data relating to minors. To obtain more information regarding the processing of data or to exercise the above rights, it will be possible to contact the Data Controller at the following references: By registered letter with return receipt. to the postal address of the headquarters or via Mazzini, n 62, 51016 Montecatini (PT); to the email address: gm@masseriacorsano.com.

Changes and updates to this legislation
Leduns SRL will take care to modify or simply update, in whole or in part, this information on data processing also in consideration of the modification of the laws or regulations that regulate this matter. The list of data processors and persons in charge of processing is kept at the registered office of the Data Controller.