The EU Regulation 2016/679 (hereafter, "Regulation" or "GDPR") establishes the rules relating to the protection of individuals in regard to the processing of personal data and the freedom of movement of the data. The Regulation protects the fundamental rights and freedoms of individuals and in particular their right to the protection of personal data. This information is provided by Top Service Tourist Services GmbH (hereinafter Top Service), pursuant to article 13 of the GDPR, in relation to the processing of personal data relating to the service called Tapsy Tours for Families with Kids (the Tapsy tour is an innovative experience in the world of excursions for families traveling with children from 6 to 12. Educational tours, cultural itineraries and fun activities. More information on the service is available on the website www.tapsy.eu). The data processing is carried out to an extent compatible with the purposes described in the following information and will be based on the principles of correctness, lawfulness and transparency and in compliance with the security measures.
HOLDER OF THE PROCESSING OF PERSONAL DATA
The Data Controller (hereinafter the Controller) is Top Service Tourist Services GmbH with headquarters in Waffenplatzstrasse 15, 4500 Solothurn Switzerland (tel: +39 066927538 - email: firstname.lastname@example.org
REPRESENTATIVE OF THE HOLDER ON THE EU TERRITORY
The Data Controller Representative on the EU territory is Top Service Tourist Service International S.r.l. (hereinafter Top Service International) based in Via Vincenzo Monti 1, IT-00152 Rome - Italy (tel: +39 0669275838 - email: email@example.com
TYPE OF PERSONAL DATA AND PURPOSE OF THE PROCESSING
The Data Controller processes the personal data provided on the occasion of the request and purchase of the services also aimed at minors (6/12 years). Personal data is personal information (for example, name, surname, date of birth of the minor, parents or guardian), contact specifications and contact details (address, telephone and e-mail) provided on the occasion of the request for services. The processing of personal data is aimed at carrying out the following activities, with the express consent of the parents/guardians or whoever takes their place:
provision and management of the Tapsy service;
administrative, accounting and fulfillment of obligations under sector regulations;
registration to the Tapsy Club and issue of the Tapsy Card including the management of the advantages connected to these services, the sending of information material and the card if the requested by the interested party online or via email;
carrying out informative, promotional, commercial and direct marketing activities such as sending gadgets (for example on the occasion of a birthday), sending information and commercial material by email, telephone and per mail.
LEGAL BASIS OF THE PROCESSING
The processing of personal data with respect to the purposes previously expressed is legitimized by the following legal bases:
CONSEQUENCES OF A REFUSAL TO PROVIDE DATA
- express consent of the interested party (art. 6 par. 1 lett. a of the GDPR);
- need for processing in order to execute the contract of which the interested party is also a party in the pre-contractual phase (art. 6 par. 1 letter b of the GDPR);
- necessity of the treatment to fulfill legal and legal obligations to which the data controller is subject (art.6 par.1 letter c of the GDPR);
- necessity of the processing to pursue a legitimate interest of the owner in relation to the information and marketing activity for the activities related to the services requested by the interested party provided that the interests or the fundamental rights and freedoms of the interested party do not prevail (art.6 par .1 letter f of the GDPR).
The provision of personal data is voluntary. It is our duty to inform you that the provision of data relating to the purposes referred to in points a) and b) is essential for the management of the services requested by you, including related and instrumental accounting and administrative activities. Your refusal to provide data for these purposes makes it impossible for Top Service to provide the requested services. For the purposes referred to in points c) and d), the provision is, however, optional and does not affect the use of the services requested. However, your refusal to such treatment makes it impossible for Top Service to proceed with the registration to the Tapsy Club, to release the Tapsy Card, to send the Tapsy Card and the gadgets provided for in the program, to send informative, promotional and commercial material.
RECIPIENTS AND / OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA
The data may be communicated to suppliers and / or collaborators who provide the Owner with services connected and instrumental to the management and organization of the services requested and relating to the purposes indicated above. These subjects carry out the processing as Data Processors by the Data Controller. Staff and collaborators can also access the data as persons authorized to process by the Data Controller in order to carry out their duties and tasks. At any time, you can contact the Data Controller or the Representative to obtain updated information on the field of data communication. Personal data are not intended for disclosure.
DATA PROCESSING METHODS
The processing of personal data is carried out in such a way as to guarantee maximum security and confidentiality, using paper, IT and telematic tools and means, adopting technical and organizational security measures suitable to reduce the risk of loss, destruction, unauthorized access, disclosure and tampering with data.
DATA TRANSFER TO A THIRD COUNTRY
Personal data are stored in Switzerland at the headquarters of the Data Controller and are not subject to transfer to third countries outside the EU or international organizations. Any transfers of personal data to non-EU countries are carried out in order to provide appropriate and appropriate guarantees pursuant to the provisions of EU Regulation 2016/679. The Data Controller performs the processing in compliance with the provisions of the aforementioned Regulation.
CRITERIA FOR THE RETENTION OF DATA
The personal data relating to the services requested are processed and stored in compliance with the times established by sector regulations, in compliance with the principle of proportionality and within the limits necessary to achieve the purposes described. For marketing purposes, the data will be kept for a maximum of 24 months.
RIGHTS OF THE INTERESTED PARTY
The interested parties have the right to obtain from the Data Controller, in the cases provided, access to their personal data, the correction, the cancellation of the same, the limitation of the treatment that concerns them, to oppose the treatment, to withdraw the consent (articles 15 and following of the Regulation). The withdrawal of consent does not invalidate the processing performed before the time of the request for withdrawal. To exercise your rights, you can contact the Data Controller or the Data Controller Representative by writing to firstname.lastname@example.org
. Furthermore, the interested parties have the right to lodge a complaint, as required by art. 77 of the GDPR, or to apply to the appropriate judicial offices (art.79 GDPR), if it believes that the processing takes place in violation of the GDPR itself.