PRIVACY POLICY

Dear Customer,
in accordance with current data protection legislation (Reg. UE 2016/679 – GDPR and current Privacy Code), we would like to inform you that the processing of your personal data is carried out with correctness and transparency for lawful purposes and protecting your privacy and your rights.
Therefore, in compliance with the aforementioned legislation, we provide the following information:
 
1. Holder and responsible of the treatment
Holder of the treatment: Napoleon Tour Operator di Grandi Vacanze s.r.l., head office in Portoferraio (LI), C/o Palaturismo, P.Iva: 01736010495, PEC: grandivacanze@pec.it
Responsible of the treatment: Enrico Cioni
Sub-Responsible of the treatment: Lorena Villa
 
2. Treatment modalities
The processing is carried out both by electronic means (also through our website: www.napoleontours.com) and by means of paper for the performance of the services offered.
 
3. Nature of the data processed.
If you register with us or request news or purchase our products, we will process your personal and tax data, as well as economic data that are necessary for the conduct of relations between you and our Company. In general, we do not process sensitive or judicial data, but if this becomes necessary, we will only do so by asking for your consent first. In the execution of our services as requested by the user, the communication of personal data relating to minors may be necessary: in such cases we will take all the measures required by current legislation.
 
4. Purpose of processing and their legal basis.
Napoleon Tour Operator of Grandi Vacanze s.r.l. processes the above data for:
1) Receive requests for information and estimates; conclude contracts; provide the agreed services and any other service required and perform maintenance and technical assistance related to the required services.  Since the processing is necessary for the definition of the contractual agreement and for its subsequent implementation, its consent is not required (art. 6, par. 1, lett. b) Reg. UE 2016/679), except in the case where data belonging to particular categories, referred to in art. 9 Reg. EU 2016/679. If you refuse to provide your personal data, we will not be able to confirm your booking or provide you with the requested services.
2) Manage payments, including through third parties banking/financial. Since processing is necessary for the definition of the contractual agreement and its subsequent implementation, your consent is not required (art. 6, par. 1, lett. b) Reg. UE 2016/679). The data are processed by us and by our agents and are communicated outside only in compliance with legal obligations. In case of refusal to provide the data necessary for the above mentioned fulfilments, we will not be able to provide the requested services.
3) Manage billing. For these purposes the processing is carried out without the need to acquire your consent (art. 6, par. 1, lett. c) Reg. UE 2016/679). The data are processed by us and by our agents and are communicated outside only in compliance with legal obligations. In case of refusal to provide the data necessary for the above mentioned fulfilments, we will not be able to provide the requested services. The data acquired for these purposes are stored by us for the time required by current legislation (10 years and even more in case of tax assessments).
4) Handling of any complaints and/or disputes. For these purposes the processing is carried out without the need to acquire your consent (art. 6, par. 1, lett. f) Reg. UE 2016/679).
5) Where it is necessary to carry out a task in the public interest or in connection with the exercise of public authority by the controller, processing shall be carried out without the need to obtain the controller’s consent (art. 6, par. 1, lett. e), Reg. UE 2016/679).
6) In certain cases, there may be an overriding interest on the part of the data controller, for example in the event of a breach of the contract by the other party, allowing the data controller to initiate a credit recovery procedure. In such cases it is not necessary to obtain your consent (art. 6, par. 1, lett. f) Reg. UE 2016/679).
7) Subject to your express consent and until the revocation of the same (art. 6, par. 1, lett. a) and art. 7 Reg. UE 2016/679), to be provided following timely and exhaustive information provided before the acquisition of consent, your personal data may be processed directly or through third parties - also through one or more remote communication techniques (e-mail, telephone, fax) - as well as for the purposes referred to in points 1)-7) of the information for purposes not strictly related to the provision of the services requested, or for:
a) promotional initiatives on products and/or services of Napoleon Tour Operator of Grandi Vacanze s.r.l.;
b) sending, including by SMS, e-mail and/or telephone channels, advertising, information and commercial information;
c) interactive commercial communications;
d) promotional initiatives on products and/or services of third-party companies;
e) studies and statistical and market research.
 
5. Data transfers to third countries or international organisations
The transfer of personal data beyond the borders within which the GDPR operates carries the risk that the applicable legislation at the place of transfer does not present the same standards of guarantees. It becomes, therefore, important for the data subject to be made aware of the potential risks related to security and data protection.
Our processing does not involve the transfer of personal data outside the scope of applicability of the GDPR.
 
6. Retention period
The data are processed until the complete performance of the service and afterwards, in compliance with legal obligations and for administrative and commercial purposes.
 
7. Data voluntarily provided by the data subject
In case you choose to make the payment in one of the forms provided (bank transfers or credit cards), in addition to the data required in the contact form (name, surname, telephone number, e-mail) will be required to provide us with all the data necessary for the completion of these practices. Failure to communicate even some of these data makes it impossible to perform the service.
The express and voluntary sending of data through the compilation of the forms specifically prepared on our website involves our subsequent acquisition of the same data. All the data requested are necessary for us to respond to your requests and/or fulfil the service you require. Specific information summaries are prepared and/ or displayed in the individual pages of the site used to perform particular services on request.
 
8. Obligation or right to provide data and consequences of any refusal
The data listed above (name, surname, telephone number, e-mail) are necessary for us to be able to carry out the requested services: failure to provide them in whole or in part entails, consequently, the impossibility of giving rise to the performance of the service itself.
While browsing our website or during your telephone contacts, you may also be asked to provide us with additional data that are not strictly necessary for the fulfilment of the main service (offer of accommodation and accommodation services) but become it for the execution of any ancillary services that will be represented from time to time. Failure to provide them is evaluated on a case-by-case basis, and determines the resulting decisions according to the importance that we recognize to the data requested but not provided by you.
Whenever we intend to offer you an ancillary service, we will promptly describe the purposes specifically pursued and you will be asked for your express consent.
Failure to provide the data required for a specific service or the failure to release the relevant and consequent consent to their use does not affect the possibility of requesting and consenting to the provision of other different ancillary services (nor, let alone, prevents or excludes the principal service).
 
9. Communication and dissemination of collected data
The data collected are not "disseminated" by us, it is not, in other words, given knowledge to indeterminate subjects in any way, including through their provision or consultation; the data may, however, be "communicated" by us, that is, they are given knowledge to one or more determined subjects, in particular to:
- third parties, to whom Napoleon Tour Operator of Grandi Vacanze s.r.l. entrusts certain activities (or parts of them) functional to the provision of the above mentioned services. In this case, the same subjects will operate as autonomous Data Controllers or will be designated as Data Processors or Appointed of the treatment. The Data Processors or Appointed Persons will receive appropriate operational instructions, with particular reference to the adoption of minimum-security measures, in order to guarantee the confidentiality and security of the data;
- subjects who can access the data in compliance with a legal obligation, within the limits provided by law itself;
- the credit and/or financial institution, where payment by electronic money is required;
- the Partner Companies, if you have expressed your consent to the sending of advertising and the direct marketing by them.
 
10. The data subject's rights (Articles 13/22 and 77/79 of EU Regulation 2016/679)
As a data subject, you have the rights referred to in art. 13/22 and 77/79 Reg. EU 2016/679, and precisely the rights of:
- withdraw the consent at any time. The data subject can always withdraw consent to the processing of their personal data previously expressed (art. 13, par. 2, lett. c) Reg. UE 2016/679);
- object to the processing of their personal data. The interested party may object to the processing of their data in the cases referred to in art. 21 Reg. EU 2016/679;
- access to their data. The data subject has the right to obtain information on the data processed by the Data Controller, on certain aspects of the processing and to receive a copy of the data processed (art. 15 Reg. UE 2016/679);
- verify and request rectification. The data subject can verify the correctness of their data and request its update or correction (art. 16 Reg. UE 2016/679);
- obtain the restriction of processing. When certain conditions are met, the data subject may request the restriction of the processing of his or her data. In this case we will not process the data for any other purpose other than their storage (art. 18 Reg. UE 2016/679);
- obtain the deletion or removal of your personal data. When certain conditions are met, the interested party can request the cancellation of their data by the Data Controller (art. 17 Reg. UE 2016/679). In these cases, we will definitely cancel as soon as possible;
- receive your data or have it transferred to another data controller (data portability);
- the data subject has the right to receive his or her data in a structured, commonly used and machine-readable format and, where technically feasible, to obtain its unimpeded transfer to another data controller. This provision is applicable when the data are processed by automated means and the processing is based on the consent of the data subject, on a contract of which the data subject is a party or on contractual measures related to it (art. 20 Reg. UE 2016/679);
- lodge a complaint. The data subject may lodge a complaint with the competent data protection supervisory authority (art. 77 Reg. UE 2016/679);
- take legal action (art. 79 Reg. UE 2016/679).
 
11. How to exercise the rights
You may at any time exercise your rights by contacting the Data Controller at one of the addresses indicated.
You may also at any time lodge a complaint with the Italian Data Protection Authority via registered mail A/R addressed to: Garante per la protezione dei dati personali, Piazza Venezia 11, 00186, Roma. Or by certified e-mail (pec) addressed to: protocollo@pec.gpdp.it (art. 77 Reg. UE 2016/679) or appeal to the ordinary judicial authority (art. 79 Reg. UE 2016/679).