Information on the processing of personal data

In compliance with Articles 13 (for data collected from the Data Subject) and 14 (for data not collected from the Data Subject) of EU Regulation 2016/679 (GDPR), the following information is provided to the Users of this Website, which refer exclusively to the processing carried out through this Website itself and not through other websites that may be visited through links from the present, for which it is suggested to refer to the relative privacy policies provided by their respective Data Controllers.

DATA CONTROLLER
Ortigia Island Excursion Escursioni & Noleggio di Mortellaro Lucia P.IVA 02013010893 c.f.: MRTLCU82M70L682P 96100 Siracusa
The Data Controller reserves the right to appoint a Data Processor for the processing of the personal data managed for the purposes of technical assistance, maintenance, technical management and similar to this Website, a web agency, whose references may be communicated following a request to the addresses mentioned above. The Data Controller and the Data Processor process the Users’ data through their own Internal Employees, specifically appointed and provided with instructions for the correct processing of the personal data, also in oral form

TYPE OF DATA PROCESSED AND SOURCES OF COLLECTION
• Browsing data • Cookies, for which we invite you to read our specific Privacy Policy • Personal Data voluntarily provided by the user • Common data (identification data, personal data, billing data and similar) • Sources: navigation, other sites, cookies and similar; user; public sources
We may primarily process browsing data as well as cookies so we invite you to read our specific Privacy Policy here. We may also process data voluntarily provided by the user. For example through the contact form or by sending a communication by e-mail, including common personal data (identification, personal data, billing data and similar) to the extent that this is required by the request received. Data may come from automated sources or voluntary sources, as well as from public sources. For example, they may come from the user's browsing, which brings information about previous consultations of other sites, including in particular cookies and other similar technologies. The data may also be voluntarily provided by the user or by subjects related to him/her. Other data may come from public sources, such as those processed in the field of research and from corporate surveys, public database searches and similar.

PURPOSE OF DATA PROCESSING
• Made available to Users of web services offered by the Website • Management of cookies • The personal data of the Users of the Website, as described above, will be processed in the manner and forms prescribed by GDPR, for the performance of the Website’s own functionalities, in particular – but not exclusive – a reference to the procedures described by the data collection, contact form, possible registration/ access procedure to the reserved area, subscription to the newsletter (for which you should refer to the specific Privacy Policy), purchase procedure and related cart and similar. • In particular, the personal data provided to the Data Controller will be processed for the following purposes: to follow up the specific requests made to the Controller by the User through the Website and its communication tools (contact form, request forms and similar); for any subscription to the newsletter and the consequent sending of commercial communications and various information concerning the sector in which the Data Controller operates, with the appropriate consent provided by the user through the selection of the relative box; for the forms of mere subscription to the newsletter, please refer to the specific Privacy Policy published there; for communications of an informative nature relating to the services of the same Data Controller, following a request for information by e-mail, completing the contact form and other communication tools; for other accessory purposes or purposes connected to those indicated above and in any case falling within the scope of the Website’s activities; for the processing of the e-mail address provided by the Data Subject in the context of the sale of a product or service, also aimed at sending, without further consent, communications for the subsequent direct sale of similar products or services to those subject to the sale itself; the interested party may, in any case, express his/her refusal and oppose this processing, both initially and subsequently, in an easy and free way, following the instructions given in each subsequent communication. • The processing of data given in general will be carried out, even following automatic collection during navigation, for the sole purpose of verification and control of access to the Website. This also applies to technical cookies, to be understood as session cookies, functionality cookies or analytics cookies that meet the requirements specified by the Data Protection Authority. In particular, concerning the latter, it is clarified that they can be assimilated to technical cookies where these are made and used directly from the Website. In any case, for these analytic cookies, the Website, also in compliance with the clarifications of the Data Protection Authority, has provided for the anonymization of the IP addresses and the collection and use of the aforementioned browsing data (without prejudice to the anonymization of the IP addresses) allow the monitoring of the Website’s performance and allow us to improve the service offered, offering the User a better browsing experience. Please refer to the appropriate Cookie Policy for further information.

LAWFUL BASIS FOR PROCESSING

The processing of personal data is based on the right to information, on the fulfillment of contractual obligations or social contact, or where necessary on consent through the free and conscious compilation of the appropriate information fields in the dedicated form.

LEGITIMATE INTEREST OF THE DATA CONTROLLER
• Exercise of the rights of the information society • Performance of the service by the Data Controller • Direct marketing
The processing of personal data is also based on the legitimate interest of the Data Controller, such as the exercise of his rights in the context of the information society, the performance of the contractual service and the implementation of direct marketing operations.

MANDATORY PROVISION OF PERSONAL DATA
Some data are mandatory, while others are optional, depending on the purpose of the processing that will be specifically indicated from time to time.
The provision of data relating to the browsing of Users, indicated above, depends on the degree of privacy that the User has enabled or disabled through his/her browser. In some cases, disabling could compromise the browsing on this Website. For certain forms of this Website, the provision of navigation data and/or the use of technical cookies is mandatory for the proper functioning of the Website. The provision of some personal data is in any case necessary for the structure of the Website and its procedures. In particular, by way of example: The minimum data required, such as the USERNAME and/or the name/ surname and/or the e-mail address and/ or other identifying data of the sender, are mandatory for sending messages via contact forms or for subscribing to the newsletter; In any case, the USERNAME and PASSWORD are mandatory for registration and access to the reserved area of the Website. A special approval check-box will precede any request for other optional data. The provision of all other data is optional, in accordance with the type of information that the User wishes to provide to the Website.

CONSEQUENCES OF FAILURE TO PROVIDE PERSONAL DATA
Failure to provide personal data prevents the Data Controller from sending updates on his own commercial and promotional initiatives.

RECIPIENTS OF PERSONAL DATA
The data may be communicated to associated, subsidiary and affiliated companies of the Data Controller, as well as to consultants, or also to third parties who also operate in the name and on account of the Data Controller. For the performance of the services related to the purposes indicated in this statement, both intra- EU and extra-EU (in the latter case, it will be exclusively those subjects adhering to the Privacy Shield protocol). Browsing data and similar (for which reference is made to the above), as well as profiling cookies even of third parties (for which reference is made to the Cookie Policy of this Website), which will be communicated to the respective third parties concerned, where these do not manage them directly as Data Controllers.

RETENTION PERIOD
The data provided by the Data Subject will be retained until the express revocation by the Data Subject, even by action on their browser, cleaning of cookies, express request or expressed in any other way. The navigation data will be retained for the technical time necessary for the fulfillment of the functions for which they were collected.

RIGHTS OF THE DATA SUBJECT
Rights (Arts. 15 – 22 of the GDPR): Access Correction Deletion Restriction Portability Forms and terms of exercise: Art. 12 of the GDPR
Via e-mail: info@ortigiaislandexcursion.com
Each Data Subject shall have the right to access, rectify, cancel (be forgotten), limit, receive the notification in the event of rectification, cancellation or limitation, portability, opposition and not to be the subject of an automated individual decision, including profiling, pursuant to the Articles 15 to 22 of GDPR. These rights may be exercised in the forms and in the terms set out in Art. 12 of the GDPR, by written notice, sent to the Data Controller by e-mail at info@ortigiaislandexcursion.com.
The Data Controller will respond as soon as possible and in any case within one month from receipt of the request.

RIGHT TO WITHDRAW CONSENT
- Via e-mail info@ortigiaislandexcursion.com - At a sales point
You may withdraw this consent at any time by: Sending an email to the Data Controller’s address info@ortigiaislandexcursion.com; - Communication expressed at a sales point of the Data Controller.

COMPLAINTS
Complaint (Art. 77 of the GDPR): To the Italian Data Protection Authority
Each Data Subject has the right to lodge a complaint pursuant to Articles 77 and following of the GDPR to a Supervisory Body, which for the Italian State is identified in the Data Protection Authority. The forms, methods and terms for proposing complaints are provided for and governed by the national legislation in force. The complaint does not prejudice the administrative and jurisdictional actions, which for the Italian State may alternatively propose to the same the Data Protection Authority or to the competent Court.

PROFILING
The personal data provided with this form will be subject to profiling. Profiling allows the Data Controller to evaluate certain personal aspects of the Data Subject in particular to his/her preferences, interests, tastes with reference to the products sold and the activities carried out by the Data Controller, in order to allow the Data Controller to offer the Data Subject a more specific sales service, which is aimed at his/her needs.