PRIVACY POLICY pursuant to Art. 13 of the Regulation (EU) 2016/679 This Policy contains important information about personal data collected when you visit this Website, whether you are a registered User or not, and about how such data is used. Please read this Privacy Policy carefully before you submit any personal information and/or fill in any online form on our Website. This Privacy Policy is pursuant to Art. 13 of the Regulation (EU) 2016/679 (GDPR) and applies only to this Website; our Website may contain links to other websites that are not covered by this Policy. Table of Contents

1. A) Controller and Joint Controller
2. B) Personal Data Collected
3. C) Legal Basis and Purposes for Processing Personal Data
4. D) How We Process Data and Period of Data Retention
5. E) Recipients of Personal Data
6. F) Mandatory or Optional Data
7. G) Rights of Data Subjects and How to Exercise Them
8. A) Controller and Joint Controller

The Data Controller is Costa Edutainment S.p.A., registered office at No. 6 Via Ascoli Piceno, Riccione (RN), and head office at Porto Antico Area – Ponte Spinola, Genoa, Tax ID and VAT Number 03362540100. When you purchase tickets online, subscribe to our Newsletter, fill in contact forms or simply register to our Website, your data will also be processed by C-WAY s.r.l. (head office at Porto Antico Area – Ponte Spinola, Genoa, VAT Number 03789020108), tour operator and investee company of Costa Edutainment (hereafter CE), acting as Joint Controller. You can contact our Data Protection Officer using the e-mail address [email protected] If you think that your data has been processed unlawfully, you can lodge a complaint with the Data Protection Commissioner.

1. B) Personal Data Collected

B.1.) Browsing Data The information systems and software procedures involved in the operation of this Website acquire certain personal data during their normal operation. The transmission of this data is implicit in the use of Internet communication protocols. The type of data acquired includes IP (Internet Protocol) addresses or domain names of the computers used by any User to access the Website, the addresses of the resources requested in URI (Uniform Resource Identifier) notation, the time of the request, the size of the file obtained in reply, the numerical code indicating the status of the reply given by the server, and other parameters related to the User's operating system and computer environment. This data is used with the sole purpose of obtaining anonymous statistical information concerning the use of the Website and to check its correct operation. Such data may be used to ascertain responsibility in hypothetical cases of computer crimes against the Website. B.2) Data Voluntarily Provided by the User/Visitor When you contact the e-mail addresses provided on this Website under the "contact us" section, you submit optional, explicit and voluntary information that we collect as follows: e-mail address, necessary in order to respond to your requests, as well as any other personal data contained in the message, which will be used only to execute your requests or to provide the services requested. Specific summary information notices will be shown and/or displayed on the pages that are used for providing specific services on demand.

1. C) Legal Basis and Purposes for Processing Personal Data

The legal basis for processing your personal data is your consent, depending on the purposes for which you gave it. Some website functionality, such as purchasing tickets online, may be unavailable to users who do not give their consent to data processing. Other than what stated below regarding our Cookie Policy, CE and/or C-WAY will process your personal data only for the purposes of handling requests received via the form filled in by the Data Subject, in particular: D.1) REGISTRATION ON THE WEBSITE: upon your consent and until its withdrawal, to allow you to register on the Website, which could be necessary to access certain parts of our Website and to provide and manage the various services offered (purchasing and booking tickets, reserving a parking space, etc.); D.2) NEWSLETTER AND MARKETING ACTIVITIES: upon your consent and until its withdrawal, for communication, advertising and marketing purposes (including, but not limited to, sending Newsletters, materials for advertising and marketing communications, as well as related surveys of registered users enabling CE and C-WAY s.r.l. to improve the services and products offered to customers); D.3) THIRD-PARTY MARKETING AND ADVERTISING: upon your consent and until its withdrawal, to allow us to share the data you provided with third parties for marketing and advertising purposes.

1. D) How We Process Data and Period of Data Retention

The data held by the Controller will be processed lawfully, fairly, in a transparent way and in a manner that ensures its accuracy, integrity and confidentiality; it will be adequate, relevant and limited to the purposes for which it is processed and stored only as long as necessary for such purposes. Data will be processed manually (on paper records) as well as by automated means, using security measures to ensure the confidentiality of personal data and prevent unauthorised access. Personal data will be retained for as long as necessary to provide the products and services you requested or to fulfil the purposes stated in this Privacy Policy (for instance, as long as you subscribe to our Newsletter, or until your account is deleted). At the end of that period, your personal data will be retained only to the extent necessary to comply with the legal obligations and requirements (for instance, 10 years for accounting purposes, or the maximum data retention period set forth by the applicable law provisions for fiscal purposes, etc.), so that we can comply with your/our obligations and protect your/our rights.

1. E) Recipients of Personal Data

Within the limits of the purposes outlined in this Policy, personal data may be disclosed, subject to appropriate safeguards, to a natural or legal person, public authority, agency or other body, that is likely to cooperate with the Joint Controller in performing activities aimed at achieving the above-mentioned purposes or with whom the Joint Controller must share personal data in order to comply with legal or contractual obligations. For some kind of purchases (e-commerce: buying tickets, booking guided tours, etc.), you will be redirected, through the designated link, to the website of C-WAY s.r.l., the company performing the requested service (Joint Controller). We inform you that personal data submitted upon authorisation by the users by filling in online forms will not be disclosed to third parties or made public, except in the case of releasing on the Website the names of winners of possible competitions or prize contests promoted by the Joint Controllers on their websites.

1. F) Mandatory or Optional Data

Some personal data may be requested that is optional, while other information is necessary (i.e. if the relative field is marked with a star) in order for the Joint Controllers to meet the requests of the Users and for the operation of the Website. If you do not complete the mandatory fields – marked with a star because these data are necessary to execute the requested services –, or do so only partially or incorrectly, we may not be able to take care of your requests; whereas if you do not provide the optional personal data, or provide it only partially or incorrectly, there will be no consequences. Any request of data beyond that essential to provide the services will be made separately, stating clearly the purposes for processing data and any other communication necessary to consent the User to object to data processing.

1. G) Rights of Data Subjects and How to Exercise Them

We would like to inform you that in any moment and pursuant to legal requirements you will have the right to ask CE to access, amend or delete your personal data, to withdraw your consent, as well as to limit data processing. You are also entitled to object to data processing and claim your right to data portability by sending an e-mail to the address below. Such rights may be exercised by sending an e-mail at our e-mail address [email protected] and/or [email protected], or writing to the Controller at the above-mentioned address. Should you have consented, it will still be possible to object to data processing for direct marketing or communication purposes (such as sending Newsletters, informative/advertising materials, etc. to your e-mail address) by clicking the “unsubscribe” link at the bottom of any e-mail you receive by us. If you think that your data has been processed unlawfully, you can lodge a complaint with the Data Protection Commissioner

Dernière mise à jour :2018-08-07 11:14:42