INFORMATION ON THE PROCESSING OF PERSONAL DATA COLLECTED FROM THE DATA SUBJECT - ARTICLE 13 EU REGULATION 2016/679

 

Dear User,
Pursuant to Articles 13 and 14 of the EU Regulation 2016/679 (GDPR), the following information is provided in order to make you aware of the characteristics and methods of the processing of your personal data.

​

(a) Identity and contact details of the Data Controller, Data Processors and Data Protection Officer.

The Data Controller is Mr.r Daniele Gazzano; owner of the website www.vivisardinia.com (henceforth also only the "Site"); Certified e-mail address (PEC): gazzano@namirialpec.it; Contact details for tourist bookings, Property management: +39 3425346053 or booking@vivisardinia.com; The Data Processors, coordinated in various capacities by the Data Controller for the achievement of the purposes better indicated in the following paragraph c) is Mr. Daniele Gazzano The Data Protection Officer (DPO) designated by www.vivisardinia.com. pursuant to Article 37 GDPR is Mr. Daniele Gazzano;

 

(b) Type of data being processed
When registering through the site, booking a stay, signing contracts better described in par. c) below, or purchasing experiences in the area (through the relevant page https:// www.vivisardinia.com) different categories of personal data of the User may be collected by www.vivisardinia.com and/or third parties (see below par. e). The data that may be collected are as follows: first name; last name; place and date of birth; company name or name; e-mail contact and telephone number; tax code; VAT number; address of residence or domicile; identity documents (such as ID card or driver's license); photograph of the User's person; browsing data or data relating to the User's preferences detected during the User's use of the service or website; payment information, bank details and/or credit card details; billing address; tax data; data relating to the property covered by the contracts entered into by vivisardinia. com such as cadastral, contractual, insurance coverage, energy certification and/or urban planning compliance data; as well as the Universal Unique Identifier Code (UUID); photographs of the property; documentation and information relating to the legal and economic status of the property, such as situations of ownership or co-ownership of real estate rights, transcriptions and mortgage registrations; credentials of the Owner referable to access portals or websites for the exchange of information pertaining to leases and/or related authorizations (henceforth, for brevity, also only the "Personal Data").

 

With reference to the sending of the application by the User who wishes to carry out the activity of local management in collaboration with vivisardinia.com, the User's Curriculm Vitae will also be processed. With regard to information on the collection of data specifically referring only to web browsing and the deactivation of advertisements based on said internet tools, the User is invited to refer to the specific Cookies Policy found separately on the site. Information specific to vivisardinia.com app: The vivisardinia.com app may require the use of user location. If explicitly requested by the app, such permission is for the sole purpose of ensuring its proper technical operation. User location data is NOT collected by the data controller in any way.

​

(c) Purpose and legal basis for processing
The data are collected by spontaneous contribution of data by the User when he decides to propose his own property for property management activity or decides to finalize his reservation of stay, or when he decides to potentially join the network of vivisardinia.com as a local manager, in all the mentioned cases by filling in the appropriate form and confirming his choice. The data thus collected are processed by vivisardinia.com for the following purposes:
To come to the conclusion of property management contracts in the real estate sector, in the interest of owners of houses located in the Region of Sardinia, aimed at the subsequent stipulation of short tourist leases in the forms better indicated in c2) below, and to give them subsequent execution, including the provision of vivisardinia.com services in the manner indicated in the relevant contracts.

 

In order to pursue these purposes, it is necessary to identify the User in advance; contact him/her by telephone or in writing during the execution of the mandate; acquire data relating to the identification of the property in terms of cadastral, mortgage, energy, as well as relating to its state of affairs; transfer the property's data to external On Line Travel Agencies (e.g, Vrbo, Booking.com, Airbnb and Expedia) for the purpose of publicizing the property; making payments and receiving receipts in its interest, managing the possible issuance of tax documents; communicating such data to the counterparty interested in the tourism solution for the purpose of entering into the contracts best indicated in c2). The communication of data to be processed for purposes related to the conclusion or execution of the contract or the execution of pre-contractual measures requested by the User is mandatory in order to reach the conclusion of the contract and/or to execute it. The legal basis for such processing is the need to conclude the contract or to subsequently execute it (see Art. 6, para. 1, lett b GDPR).

 

To come to the conclusion, in the name and on behalf of the owners of accommodation solutions and therefore, depending on the purpose and time of duration of stay, of short lease contracts referred to in Decree Law 50/2017 converted with amendments by Law No. 96 of June 21, 2017, lease contracts for exclusively tourist purposes referred to in Art. 1, co. 2, lett c) L. December 9, 1998 n. 43, or of leases of transitory nature referred to in Art. 5 L. December 9, 1998 n. 431, or even of atypical accommodation contracts for tourist use, in the interest of individuals who intend to stay at the tourist solutions proposed by vivisardinia.com.

 

To pursue these purposes, it is necessary to identify the User, to contact the User for assistance activities during the stay, to manage payments and collections according to the mandate received, to manage the possible issuance of tax documents; to communicate these data to the owner Users for the purpose of entering into the aforementioned contracts.

 

The communication of data to be processed for purposes related to the conclusion or execution of the contract or the execution of pre-contractual measures requested by the User is mandatory in order to reach the conclusion of the contract and/or to execute it. The legal basis for such processing is the need to conclude the contract or to subsequently execute it (see Art. 6, para. 1, lett b GDPR).

 

Those interested in the stay will be required to upload a photograph of themselves on the Website, and for these purposes the legal basis for such processing is the fulfillment of a legal obligation, with particular reference to Royal Decree No. 773 of June 18, 1931 (so-called Consolidated Text of the Laws of Public Security). To come to the conclusion of contracts for services better indicated on the Website under "Experiences" also provided by third parties.

 

To pursue these purposes, it is necessary to identify the User, to contact the User for assistance activities on the requested service, to manage payments and collections based on the requested service, and to manage the possible issuance of tax documents. The legal basis for such processing is the need to enter into the contract or to subsequently execute it (see Art. 6, para. 1, lett b GDPR).
To come to the conclusion of business cooperation contracts with local managers, having as their object the performance of one or more property management affairs, under the terms and in the manner specified in the contracts.

 

To execute these purposes, it is necessary to identify the User (local manager), contact the User, manage payments and collections according to the terms of the business collaboration contract, and manage the issuance of invoices, if any. The legal basis for such processing is the need to enter into the contract or to execute it (see Art. 6, para. 1, lett b GDPR). To fulfill legal obligations by communicating to the relevant authorities data concerning tenants and lodgers such as:

 

i) sending the data of Users and the persons they declare to be hosting, to the authorities of Public Security, by means of the Notification of Building Disposal form and through the Housing Portal of the competent Police Headquarters;

 

(ii) sending Lease data to the relevant authorities for statistical and/or census land data purposes (specifically, currently the SIRED system);

 

(iii) the sending of data on contracts entered into in the forms of Short Term Leases to the Revenue Agency by June 30 of the year following the year of the stipulation pursuant to Art. 4, para. 4, Decree Law 50/17 converted by L. 96/17, as well as the inclusion of the Property in the database established at the Ministry of Agricultural Food, Forestry and Tourism pursuant to Art. 13 quater of D.L. 34/2019 converted into L. 58/19 for the purpose of the attribution of the alphanumeric identification code to be used in any communication inherent in the promotion of the services of vivisardinia.com.

 

The communication of the data to be processed for this purpose is obligatory since it is compliance with a legal obligation. Failure to communicate the mandatory data will not allow the data subject to proceed with the completion of the procedure and the conclusion or execution of the contract. The legal basis for such processing is the fulfillment of a legal obligation (see Art. 6, par. 1, lett c GDPR).

 

Process profiling and tracking of Users' preferences for the purpose of increasing or improving the functionality and quality of the website. The legal basis for such processing is the legitimate interest of the Data Controller (see art. art. 6, par. 1, lett f GDPR). Sending information for the purposes of sales promotion and marketing to Users, including after the execution of contracts.

 

These activities will be preceded by obtaining the User's express consent to the processing of his/her data for these purposes. The legal basis for such processing is the consent of the data subject (see Art. 6(1)(a) GDPR).
Further information regarding the purposes of processing by the data controller or third parties is provided in the dedicated sections of this notice, as well as in the notices of the individual services provided by third parties, which you are invited to consult below.

If the Data Controller intends to further process personal data for a purpose other than the purpose for which it was collected, the Data Controller will, prior to such further processing, provide the data subject with information regarding such different purpose and any additional relevant information. In addition, the Data Controller will comply with all other requirements necessary for the different purpose of the Processing.

 

(d) Processing methods and security measures

The processing is carried out by means of computer and/or telematic tools, with organizational methods and logics strictly related to the purposes indicated above. When the data is uploaded by the User it will be stored in electronic format by vivisardinia.com on the memory space reserved for itself present on the servers provided by Wix.
The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification or destruction of personal data.

 

(e) Transfer of data to third parties
When confirming a reservation defined by the general conditions on the Website, the payment is handled by external providers, who guarantee the service through their own computer systems and act as independent data controllers of the data required for the execution of this service. ViviSardinia.com does not have the ability to access such data. The User is invited to consult the privacy policy for such services at the bottom of the respective websites. When booking excursions and/or experiences in the territory at the relevant section "Experiences" on the Site, the User's personal data - such as name, surname, other data communicated during the booking of the service, e-mail, telephone number, password, cookies, usage data, VAT number, company name, language - may be communicated to third parties providing the relevant services advertised therein. In this case, the owner of the relevant processing is vivisardinia.com

​

The data provided by Users interested in a stay may be transferred to the owners of the properties when reporting on the activities carried out by vivisardinia.com as property manager as well as to the Local Managers part of the network of vivisardinia.com in order to execute the lease give effect to any pre-contractual measures. On the other hand, the data provided by the Owner Users may be transferred to the intermediary for the purpose of the necessary advertising activities of the property at online channels (e.g., Vrbo, Booking.com, Airbnb and Expedia) and offline.

The execution of the property management contract with particular reference to the provision of vivisardinia.com services, as indicated in the contracts, may also involve the transfer of data to third parties, such as suppliers or technicians trusted by vivisardinia.com, as provided in the relevant contract in order to fulfill requests for intervention or maintenance by Users during their stay. The essential elements of the leases referred to in par. c2 above may be transferred to third public authorities (Internal Revenue Agency, Region of Sardinia, Prefecture and/or competent Police Headquarters, Municipality where the property is located) in order to comply with reporting obligations of a fiscal, administrative or otherwise required by law.

In addition, some Users' data generated while browsing the Website may be transferred to third parties, including non-EU parties, to enable them to perform services that this Website uses. In this regard, Users are invited to consult the sections of the policy dedicated below to the individual services in question.

 

(f) Data retention period or criteria for determining the period

Data is processed and retained only for the time required by the purposes for which it was collected and therefore:
the Personal Data collected for purposes related to the execution of a contract between the Data Controller and the User will be retained until the execution of such contract is completed and in any case until and no longer than the period required by law for the purposes of keeping accounting and extra-accounting records for the exercise of commercial enterprise activity and therefore for a period of 10 years;
the Data collected with the consent of the interested User in order to provide commercial, promotional and marketing information, will be retained for a time not exceeding 12 months from the end of the contractual relationship. In this regard, vivisardinia.com may consider implicitly confirmed the authorization to the processing of such data if the receipt of communications is not followed by a request for explicit cancellation by the User with respect to such Data. The User is always guaranteed the right to revoke consent to this processing. If consent is revoked, the Data provided by the User for this purpose will be deleted.

 

(g) Rights of data subjects over data

The User has the right to: revoke consent to the processing at any time. Where the processing is based on the User's consent, the User has the right to revoke the consent at any time without affecting the lawfulness of the processing based on the consent before revocation;
object to the processing of his/her Data when it is done on a legal basis other than consent. Further details on the right to object are provided in par. f below; access one's Data i.e., obtain information about the Data processed by the Data Controller, certain aspects of the processing, and receive a copy of the processed Data. to verify the correctness of one's Data and to ask for its rectification, updating or correction at any time;
obtain the limitation of the processing, recurring the conditions of art. 18 GDPR, upon which the Data Controller will not process the Data for any other purpose than its preservation; obtain the deletion or removal of one's Personal Data, recurring the conditions of Art. 17 GDPR;

receive their Data or have it transferred to another data controller (right to data portability). The User has the right to receive his or her Data in a structured, commonly used and machine-readable format and, where technically feasible, to have it transferred unimpeded to another data controller. This provision is applicable when the Data are processed by automated means and the processing is based on the User's consent, a contract to which the User is a party or contractual measures related thereto;
propose complaint. The User may propose a complaint to the competent data protection supervisory authority or take legal action.

 

(h) Details of the right to objectThe User has the right to object to the processing of his or her personal data, on grounds related to his or her particular situation, where the processing is based on the need to perform a task of public interest or related to the exercise of public authority vested in the Controller, or where the processing is based on the public interest of the Controller or third parties. The User also has the right to object to profiling carried out on the assumptions just mentioned. Furthermore, where personal data are processed for direct marketing purposes, the User has the right to object at any time to such processing, including profiling carried out for such purposes.
Following the User's objection to processing for direct marketing purposes, personal data will no longer be processed for such purposes.
In addition, the User has the right not to be subjected to a decision based solely on automated processing, including profiling, that produces legal effects concerning him or her or that significantly affects him or her in a similar way. This is subject to certain exceptions, such as a decision necessary for the conclusion or performance of a contract between the User and a Data Controller and a decision based on the explicit consent of the data subject.

 

(i) Details of the right of access
Users have the right to obtain confirmation from the Data Controller as to whether or not personal data concerning them are being processed. In addition, where such processing is taking place, Users have the right to obtain access to their personal data and the following information:

 

• purposes of processing(s)

• categories of personal data processed

• recipients or categories of recipients to whom the personal data have been or will be disclosed

• data retention period or criteria for determining such period

• existence of the User's right to request rectification or erasure of personal data, or restriction of processing of personal data concerning him/her

• right to object to processing (where the right to object is provided for)

• right to portability
   

The Holder is required to respond within one month from the date of receipt of the request, a period that can be extended up to three months in the case of particular complexity of the application.

 

(l) Details of the right to file a complaint
The User has the right to lodge a complaint with the supervisory authority and may address it to: gazzano@namirialpec.it
For more information on the right to file a complaint, please consult the institutional website of the Privacy Guarantor: www.garanteprivacy.it.