Data protection
Effective date: 25/05/2018

In accordance with the ORDINANCE (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL, we inform you that we will process personal data of customers and suppliers, as well as data of persons who communicate their data willingly (personally, by phoning, by faxing or by e-mailing to us) and by registering on our website, as well as persons whose data have been acquired by third parties, for example when collecting external data for business information, public directories, etc., whereas in the latter case only personal data of ordinary / common kind and nature is concerned.

Our company guarantees within the framework of legal regulations that the processing of personal data takes into account the fundamental rights and freedoms as well as the dignity of the person concerned, with particular reference to secrecy, personal identity and the right of protecting personal data.

Target and purpose positions in data processing:

fulfillment of legal obligations, duties arising from regulations, community norms as well as civil and tax laws
fulfillment of any contractual obligations to the person concerned
Performing activities related to the business of our company, such as completing internal statistics, accounting, and managing customer / supplier accounting
Business objectives such as sending business information and promotional material (by post, fax and e-mail), marketing and market research
Protection of claims and management of liabilities
Objectives regarding insurance, especially credit insurance
area of publication and circulation of data.

In relation to the above stated objectives, your personal information will be forwarded as needed:

to the public administration and authorities, if stipulated by law
to credit institutions our company has business relations with, concerning the management of receivables / payables and financial intermediation
to all those natural and / or legal, public and / or private persons (legal, administrative and tax consulting offices, courts, chambers of commerce, etc.), if the forwarding proves necessary or convenient for the performance of our duties
to suppliers / manufacturers, for the execution of the orders
The personal data processed by our company are not subject to circulation.

What kind of information is collected from you and for how long?

1. Information provided by the user and collected automatically

The personal data stored by our company are collected directly from customers or third parties, such as the hypothesis that the company acquires data from external companies for commercial information, market research, direct offers of products or services. For this last type of data, an informative notice will be provided at the time of its registration or, in any event, no later than the first possible notice.

In addition, our company may possess data that the law defines as "sensitive" in relation to customer-requested transactions. The law requires a specific consent for their utilization.

Each time you visit our platforms, we may collect information about the devices you use and the networks you are connected to when using our services, in accordance with applicable laws and, where applicable, your consent. This may include: IP address, login information, browser type and version, browser plug-in types and versions, operating system and platform, advertising ID, visit information including the clickstream URL to, from and to our platforms, products viewed or searched, download errors, duration of visits to specific pages, interaction on the pages and any phone numbers used to call our customer service. We collect this information using various technologies, including cookies (see our Cookie Policy for more information).

2. Data Storage

Click on this link to see the retention period of the data.

Type of data processing:

The data processing may be carried out with or without the aid of electronic means - in any case automatic - and includes all the operations required and necessary for the data processing concerned. In any case, the data processing will be carried out in compliance with all security measures that ensure their security and secrecy.

Online advertising
For advertising purposes, based on your interests and to display targeted online advertising based on the use of cookies, we may also combine the data collected by cookies with other data we have collected. If you do not want information to be processed through the use of cookies, read our Cookies section to learn how to review and disable this information. Please note that the exclusion of interest-based advertising does not prevent the display of advertising that is not based on your interests.

Third parties who act as processors of such contractual processing guarantee that they will not store the data received from the client and will not use them for other purposes. Our contractors are contractually committed to use the same privacy and security standards, and we ensure that they are complied with.

Navigation data in the context of our Internet information service:

The computer systems and procedures provided for the function of the merano-suedtirol.it website collect certain personal information during normal operation, the transmission of which is subject to the use of data exchange protocols on the Internet.

It is information that is not collected to associate with identified persons but, by their nature, enables users to be identified by processing and linking to third party data. This category of data includes the IP addresses or domain names of the computers that connect to the website, the Uniform Resource Identifier (URI) addresses of the resources requested, the time of the request, and other parameters related to the transfer and the data communication of the user's computer environment.

These data are used only for the purpose of collecting anonymous statistical information when using the Website to verify that it works correctly. The data in question may be used to establish liability in the case of offenses by means of information technology to the detriment of our website.

Transfer of data abroad:

We may need to submit your data to service providers in non-European countries (EEA). The EEA consists of countries of the European Union and Switzerland, Iceland, Liechtenstein and Norway, which are considered to be countries with equivalent data protection and privacy laws. This type of data transfer may occur if our servers (i.e. where we store data) or our suppliers and service providers are located outside the EEA or if you use our products and services during your stay in countries outside the EEA from this area.
The updated list of third countries to which the company may transfer data is available on request to the data controller.
If such transfer takes place, we will ensure that it is in accordance with this Privacy Policy and that it is governed by standard contractual clauses approved by the European Commission that provide reasonable protection for the parties concerned.

Rights of the person concerned:

The Basic Data Protection Regulation 679/2016 gives the data subject the opportunity to exercise certain rights. In particular, it has the right to obtain information on whether and what kind of its data exist and to obtain in an understandable form details of such data, their origin and the reason for and purpose of their processing, as well as details of the holder and controller of the processing and persons and categories of persons to whom such data may be transmitted.

The data subject has the right to update, correct and complete his data and to request that the data be deleted, blocked and converted into anonymous data if the processing violates the legal provisions. He has the right, for a justified reason, to oppose, in whole or in part, the processing of his data, and for no justified reason, to use data for the purposes of trade information, the sending of advertising material, direct sales, market research and opinion polling.
In addition, from 25 May 2018 onwards, the right to data portability will apply. For more information, please contact the data controller.
If you believe that your rights have been violated, you have the right to lodge a complaint with the competent data protection authority (Garante della Privacy) or to take legal action.

The rights can be asserted on the part of the person concerned or a person commissioned by him, by means of a request to the person responsible for data processing at the Tourist office Passeiertal Valley – Passeirerstraße 40/ Via Passiria 40 - 39015 St. Leonhard in Passeier / S. Leonardo in Passiria - by registered mail or e-mail to info@passeiertal.it

Holder of the data processing:

Tourist office Passeiertal Valley

Passeirerstraße 40/ Via Passiria 40
39015 St. Leonhard in Passeier / S. Leonardo in Passiria
T. +39 0473 656 188
info@passeiertal.it

Time information for the data storage of personal data

The processing of personal data takes place in accordance with the information contained in this privacy policy. Regarding the data storage of the data processed by us, we inform you about the following retention periods:

5 years after the last data processing, regarding the established business relationship;
5 years after expiry of the notified period of validity of the offer.

The following categories of personal data may be stored for different periods of time:

Financial information (such as payments, refunds, etc.) will be retained for the duration required by applicable tax and accounting rules;
All user-generated content (e.g. comments and ratings) is anonymous, but remains available on our platforms.

What are cookies?

A "cookie" is a small text that is sent to the computer to identify the visitor's browser or to store information and settings in the browser. You can also refuse browser cookies by disabling the corresponding setting on your browser. However, if you choose this setting, you may not be able to access certain parts of the web page or they may no longer function completely.

The following cookies are used on this website as well as on the subdomains:

Navigation cookies are required for normal navigation and use of the website; without these cookies, the website may not be able to access certain features or work properly.

Functionality cookies: by saving your settings, these cookies extend the functionality of the website. They capture settings you have made (such as username or language) and allow the site to be improved.

Performance cookies may originate from us or from a third party. The information collected by these cookies is anonymous data that is neither used to collect personal information nor for promotional purposes.

Cookies for marketing and retargeting purposes are applied by third parties and are used to display advertising. No personal information is processed, but a connection will be established to your computer or other device by tracking the information stored in it.

Instructions for disabling cookies

Internet Explorer
Block or allow all cookies

1. Open Internet Explorer
2. Navigate to "Tools" and "Internet Options"
3. Select the "Privacy" tab and move the slider to the top to block all cookies
4. Click OK to confirm

Further information https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies

Firefox
To block the cookies of all websites:

1. Click the menu button and select Settings.
2. Navigate to the Privacy section.
3. Go to the settings for the "History" and select "Create custom settings". Select "Accept cookies from websites" and save the settings.

Further information https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

Google Chrome

1. Select the Chrome menu icon Chrome Menu.
2. Select Settings.
3. At the bottom of the page, select Show advanced settings.
4. In the Privacy section, select Content Settings.
5. Select Block storage of data for all websites.
6. Select Done.

Further information https://support.google.com/chrome/answer/95647?hl=en&hlrm=en

Safari

1. Open Safari
2. Select "Settings" in the system bar and in the "Privacy" dialog box that opens
3. In the section "Accept cookies" you can specify if and when Safari should store the cookies of the websites. For more information, click the Help button (marked with a question mark)
4. For more information about the cookies that are stored on your computer, click on "show cookies"

Further information https://support.apple.com/en-gb/guide/safari/manage-cookies-and-website-data-sfri11471/mac

The following table contains a list of cookies that are used on the website and explains their purpose and lifetime:

Cookie Name	Use	Duration
ASP.NET_SessionId	System cookie, used to keep the user session up	until you close the Browser
CookieBanner	Hides the cookie banner	active for 1 year
PageHistory	Contains the session of the visitor	active for 11 months
_ga	Used to identify users	active for 2 years
_gat_ga0	Used to create tracker objects	active for 10 minutes
_gat_ga1	Used to create tracker objects	active for 10 minutes

Privacy Chatbot

PRIVACY NOTICE
(Pursuant to Article 13 of Regulation (EU) 2016/679 concerning the protection of natural persons with regard to the processing of personal data)

We invite you to read this privacy notice, which provides information on the processing of personal data in connection with the operation of our Website „www.passeiertal.it“ (“Website”) and our official WhatsApp channel (together, the “Chat Channels”), as well as the use of our Chatbot „Maia“ (“Chatbot”), in accordance with Regulation (EU) 2016/679 (“GDPR”).
This privacy notice supplements our general privacy notice for visitors to our Website, which contains all information pursuant to Articles 13 and 14 GDPR and is also available on the Website.
For comprehensive information about the processing of your personal data, we also recommend that you consult the general privacy notice.
The Chatbot is made available with the aim of providing users (“Users” or “you”) with quick, accessible and interactive access to information concerning accommodation as well as cultural and leisure offerings in Tourist office Passeiertal Valley. Any further use for purposes not compatible with this informational purpose is excluded.

1. Controller - Who we are
Tourist office Passeiertal Valley
VAT No. and Tax No.: IT02519970210
Passeirerstraße 40
I-39015 St. Leonhard in Passeier
+39 0473 656 188
info@passeiertal.it
processes Users’ data as Controller within the meaning of Article 4, No. 7 GDPR.
2. What personal data do we process and how
a) Technical data, system and security logs:
In the course of providing the Chatbot, we collect certain personal data that are technically necessary and the transmission of which is inherent in the use of internet and communications protocols, such as IP addresses, date and time of requests, time zone, browser, language and version of the browser software and the operating system of the end device, and the referrer URL, i.e. the Website from which access occurs. If the Chatbot is provided via our WhatsApp channel, we may also collect the User’s phone number and displayed profile name, which we retain for the duration of use and for maintenance purposes.
These are not collected with the intention of being associated with individual Users; however, by their nature they could, through processing and matching with data held by third parties, allow Users to be identified.
b) Dialogue content and other information
Use of the Chatbot, regardless of the Chat channel, also entails the processing of the messages you send and receive. This may include, in particular, information or files you provide or upload about yourself as well as information about your interactions with the Chatbot.
c) Contact details
To respond to enquiries or to handle complaints regarding the Chatbot, we also process contact details provided by Users for that purpose, such as first name, surname, email address and telephone number.
No information relating to your health, religious or political beliefs, or other special categories of personal data is required for the provision and use of the Chatbot. Please do not transmit such data. If you nevertheless share such information via the message window, you expressly consent to processing thereof pursuant to Article 9, paragraph 2, letter a) of the GDPR.
Personal data are processed using IT-based tools, including cookies. Further information on the cookies used for this purpose can be found on our website: https://www.merano-suedtirol.it/en/passeiertal-valley/legal-notice.html.
3. Legal bases and purposes of the processing of personal data
In relation to the provision and use of the Chatbot, we collect and use your personal data solely for the following purposes and on the following legal bases:
Legal basis Purposes of processing
Fulfilment of contractual obligations or pre-contractual measures (Article 6, para. 1, letter b) GDPR):
when Users use the Chatbot through one of the Chat Channels provided.
a) Provision of the Chatbot via one of our Chat Channels
We process Users’ personal data, such as technical data, system and usage logs, dialogue content, profile names and phone numbers, to provide the Chatbot via our Chat Channels and to enable its use and the delivery of information.
We regularly assess the necessity of retaining such requests and messages and delete the relevant data when they are no longer needed.
Users are free to provide their personal data for the above purposes. However, the provision of this data is necessary in order to process requests via the Chatbot and/or to maintain the business relationship with Tourist office Passeiertal Valley. If these data are not provided, we may be unable to process the request or provide our services.
b) Management of complaints
The Chatbot is able to detect indications of negative feedback or complaints. Relevant dialogue excerpts may—after a preliminary technical relevance check—be forwarded to us in order to be recorded as part of an internal process that includes an individual review, feedback to the complaining User and, where appropriate, further measures.
For this purpose, in addition to the dialogue content we also process the contact details provided for contacting the User, as well as, where applicable, booking- or order-related information relevant to handling the complaint.
Users are free to provide their personal data for the above purposes. However, the provision of this data is necessary in order to process requests via the Chatbot and/or to maintain the business relationship with Tourist office Passeiertal Valley. If these data are not provided, we may be unable to process the request or provide our services.
Legitimate interests (Article 6, para. 1, letter f) GDPR):
to ensure the availability, proper operation and security of the Chatbot, to detect and prosecute potential criminal offences, and to pursue other legitimate interests—provided that the protection of our interests or those of third parties does not override the user’s fundamental rights and freedoms.
c) Security and maintenance
We process technical and network data that could indirectly reveal the User’s identity in order to ensure a reliable User experience. These data are automatically collected during normal operation of the Chatbot and are processed for technical purposes (including troubleshooting, testing, system maintenance, technical support and reporting) or for statistical and analytical purposes to improve the User experience.
The latter are generally processed in aggregated and non-identifiable form for statistical purposes. For example, it may be assessed how often certain functions are used or how much time is typically required for certain requests. These evaluations help us to identify technical weaknesses and to further develop the Chatbot in a targeted manner.
d) Quality assurance, content maintenance and reporting
We use excerpts from the Chatbot’s dialogue content to continuously verify the quality of the information provided, maintain content and compile reports to assess and improve our digital offering.
For these purposes, the dialogue excerpts are cleansed of personal characteristics—such as phone numbers, profile names or other identifiers traceable to a natural person—or pseudonymised before analysis, in order to prevent the prepared content from being attributed to individual Users.
e) Disclosure of dialogue content to affiliated companies
To improve the Chatbot’s content offering, response speed and subject-matter quality, we may share dialogue excerpts via secure technical interfaces with software solutions of affiliated companies in the same tourism region. For these purposes, dialogue excerpts are cleansed of personal characteristics—such as phone numbers, profile names, or other identifiers traceable to a natural person—or pseudonymised before analysis, to prevent attribution of the prepared content to individual Users.
The receiving companies use these dialogue excerpts solely to answer the User’s enquiry automatically and, where applicable, to evaluate them statistically.
Legal obligations (Article 6, para. 1, letter c) GDPR):
to comply with applicable laws and regulations and to respond to requests from competent authorities. f) Personal data we process to comply with legal obligations
We process Users’ personal data in order to comply with any legal obligations, such as fiscal, administrative and accounting obligations.

g) Use of dialogue content and technical data by SaaS service providers
To operate the Chatbot, we rely on the specialist and technical support of a service provider that processes technical data, aggregated User statistics and dialogue content for the provision of the Chatbot under a contractual arrangement with us (Article 6, para. 1, letter b) GDPR).
In addition, these data are also used by the service provider on its own responsibility to train the algorithms and models underlying the Chatbot, to improve response quality and to enhance system stability (Article 6 para. 1, letter f) GDPR). For this purpose, the service provider uses pseudonymised, or where possible fully anonymised, dialogue excerpts and usage statistics. The service provider cannot readily infer your identity from these data.
You may object at any time to the transmission of your data to the service provider, unless compelling legitimate grounds prevail.
4. Recipients of data – How and to whom we disclose personal data
Without prejudice to the provision set out in our general privacy notice, we may forward certain dialogue excerpts and contact information for the above purposes to affiliated companies in the tourism region. Each receiving affiliated company processes these data under its own responsibility pursuant to Article 4, no. 7 GDPR and solely for the purpose of responding to your enquiry for quality assurance reasons.
If the Chatbot is used via our WhatsApp channel, your phone number may also be stored and processed for internal service purposes by WhatsApp Ireland Ltd. under its own responsibility. We have no influence over such processing activities. Details can be found in the privacy notice made available by WhatsApp: https://www.whatsapp.com/legal/privacy-policy-eea.
5. Transfers of personal data – Where personal data are processed
Management and storage of the personal data processed in connection with the operation of the Chatbot take place within the EU and/or the EEA, on servers managed by Tourist office Passeiertal Valley and/or third-party companies engaged by it. However, as part of individual functional components (e.g. cloud hosting, monitoring or support tools), a transfer of personal data outside the EU or EEA may be required. In such cases, before any transfer we ensure that all appropriate measures and safeguards required by the GDPR and applicable law are duly adopted.
6. Storage period for personal data
We process and store Users’ personal data in accordance with our general privacy notice and in any event only for as long as is strictly necessary to achieve the purposes for which they were collected.

In particular:
• Plain-text dialogues: retained for a period necessary to process User enquiries and to deliver information, and generally deleted or anonymised after 72 hours. Where the Chatbot is used via our WhatsApp channel, message texts and the phone number stored with WhatsApp may be retained for up to one year from the creation of the relevant chat. They may be processed for a longer period where circumstances exist that justify an extension of the data storage period. In such cases, the personal data will be deleted or anonymised no later than 30 days after the reason for retention ceases to apply.
• System and security logs: are kept for the period required for stable operation and network security, but generally no longer than 90 days.
After expiry of the above storage periods, the data are deleted from our live and backup systems or anonymised for statistical purposes.
7. Data security – How we protect personal data
We take the protection of our Users’ personal data very seriously. For this reason, we continuously adapt organisational, technical and administrative measures to protect Users’ personal data against unauthorised access, alteration, disclosure or destruction.
8. Rights of data subjects
As a data subject, the User may exercise his or her rights under the GDPR (Articles 15 to 21), in particular:

• Right to withdraw consent (Article 7 GDPR): to withdraw at any time the consent given for the various processing operations that require it. The lawfulness of the processing of the User’s personal data carried out before withdrawal remains unaffected. Withdrawal means that from that moment the personal data will no longer be processed for the purposes to which the withdrawn consent related.
• Right of access (Article 15 GDPR): to obtain confirmation of whether personal data are being processed and, if so, to be informed about the purposes of processing, the categories of personal data processed, the recipients and categories of recipients, the data storage period, etc.
• Right to rectification (Article 16 GDPR): to request the rectification of inaccurate personal data and/or the completion of incomplete personal data.
• Right to erasure (Article 17 GDPR): to obtain the erasure of personal data in the cases and under the conditions laid down by law.
• Right to restriction of processing (Article 18 GDPR): to obtain restriction of processing in the cases and under the conditions laid down by law.
• Right to data portability (Article 20 GDPR): to obtain the portability of personal data, i.e. the transmission of personal data, insofar as technically feasible, from one Controller to another, in the cases and under the conditions laid down by law.
• Right to object (Article 21 GDPR): to object to the processing of personal data on grounds relating to his or her particular situation, or where personal data are processed for the purposes of direct marketing.
You may exercise your rights by sending a request to the Controller at the contact details given above.
If the User considers that the processing concerning him or her infringes the GDPR, he or she has the right to lodge a complaint with the supervisory authority: Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11, 00187 Rome, https://www.garanteprivacy.it/.
9. Use by minors
The Chatbot is intended solely for individuals who are 18 years of age or older. If we become aware that a individual under the age of 18 years is using our Chatbot, we will prevent further use and delete all associated personal data.
If you have reason to believe that a minor has provided personal data to the Chatbot, please contact us immediately at the contact addresses indicated in section 1 (Who we are). We will endeavor to remove the relevant information from our systems without delay.
10. Changes to this privacy notice
We reserve the right to amend this privacy notice in order to adapt it to applicable provisions. The updated privacy notice will be published on our Website.
11. Licences
"Privacy icons" created by the Maastricht European Centre on Privacy and Cybersecurity; licence ECPC CC BY 4.0.