Privacy Policy

DESTINATION ITALIA S.P.A. and WELCOME TRAVEL GROUP S.P.A. (hereinafter also referred to as the "Company") is very attentive to privacy and the protection of personal data. We hereby intend, therefore, to inform you of the manner in which we will process your personal data collected when you use the following websites: www.welcometoitaly.com.

(hereinafter, collectively, the "Platform").

We may collect information about you:

when you request a quote or make a reservation at an affiliated hotel through the completion of the online form on the Platform or through the paper forms completed at the agency;
during the use of other services through the Platform;
during telephone calls with our operators.

In particular, we need to process the data provided to us when you register or request a service. With your consent, we may also use other information freely provided by you at the time of registration or relating to the way you interact with us (hereinafter, collectively, the "Data").

This Privacy Policy (together with our Terms and Conditions (if any) applicable to the relevant services, our Cookie Policy and any additional notices that may be provided in relation to individual services) sets out the basis on which your Data will be processed.

Data Controller

The Data Controllers of any data you may collect while browsing or performing activities on the Platform are:

Destination Italia S.p.A.
Galleria Sala dei Longobardi N.2 - 20121 Milano
Email: privacy@portalesardegna.com

Welcome Travel S.p.A.
Via Ernesto Lugaro, 15 - 10126 Torino
Email: dpo@wtg.it

Data Protection Officer

The "Data Controller", in compliance with the provisions of art. 37 of the RGPD, has appointed a Data Protection Officer (DPO).

Contact details of the DPO: Lawyer Marco Paramucchi - Email: privacy@destinationitalia.com - marcoparamucchi@ordineavvocatiroma.org

1. What Data will we use?

We may collect and process the following Data:

1.1. Data collected through the request or registration form

In order to request a quotation and for the use of other services that require your prior registration, such as in particular the booking of stays at affiliated establishments, we may ask you to provide us with some personal data concerning you, including your personal data (name and surname) and your contact details (e.g. postcode, telephone, email), and data relating to the payment method you intend to choose for the hotel booking.
The provision of the data requested in the online form is optional; however, if the data marked with an asterisk is not provided, we will not be able to complete the registration process and/or provide you with the services requested.

With your consent, we may also use additional information that you freely provide us with through the online form.

1.2. Data collected through the use of the Platform

During the use of our Platform, we will process the Data necessary for you to use the Platform and its services, such as, for example, your log-in data and the pages you visit and your requests for quotes, your preferences for a specific tourist location, hotel or category of hotel or accommodation in general, in order to be able to provide you with a service that is better suited to your actual needs.
This information - in the absence of your specific consent to its processing for other purposes - is used solely for the purpose of enabling you to use the Platform and provide the information and services requested.

1.3. Navigation data

Even in the absence of log-in, the computer systems used to ensure the proper functioning of our sites and applications acquire during their normal operation, some personal data whose transmission is implicit in the use of electronic communication systems.
This information is not collected in order to be associated with identified interested parties but, by its very nature, could, through processing and association with data held by third parties, allow you to be identified. This category includes, for example, the IP addresses or domain names of the computers you use to access our sites and applications, the type and version of your browser, the types and versions of browser plug-ins, the mobile device identifier (IDFA or AndroidID) and other parameters relating to your operating system and computer environment, the URIs (Uniform Resource Identifiers) of the resources requested, the time of the request, the size of the file obtained in response and the numerical code indicating the status of the response given by the server.

These data, in the absence of your specific consent to the processing for other purposes, are used only to obtain anonymous statistical information on the use of the sites and applications and to optimize the use and proper functioning and are deleted immediately after processing.

1.4. Additional data

With your consent, we may also use other information that you voluntarily provide us with when filling out the application and/or registration form or when using the Platform, as well as additional information about the way you interact with us and our operators and sales consultants.

2. For what purposes will we use your Data and on what legal basis?

We will use your Data, including by electronic means:

(a) to enable you to use our Platform. Your Data will be used in order to provide you with the relevant services provided to you and, more generally, for all related contractual and administrative purposes;

b) to provide you with the requested quotations and/or advice;

c) if you subscribe to the relative service, to deliver to your e-mail box our newsletter, with which you will receive Exclusive Offers and Useful Information;

d) for the fulfilment of legal obligations or to comply with any orders from judicial authorities

e) for statistical purposes, in completely anonymous and aggregate form.

Only if you give your consent by providing the relevant information, we may also use your Data for the following additional purposes:

f) to send you commercial and/or promotional information as well as to send advertising material or carry out direct sales activities or interactive commercial communications on products, services and other activities of the Company or third parties, or to carry out market research. We may, for example, send you e-mails or instant messages (e.g. SMS and WhatsApp), or contact you by telephone with an operator to present you with commercial offers, initiatives and promotions relating to our and/or third parties' products and services (including those different from those requested by you);

g) to examine your preferences and the ways in which you interact with us. In particular, in order to better understand your tastes and interest in our services and in our communications, we may examine - also through the use of automated systems - the information provided at the time of your registration to the Platform and other services provided by the Platform, your interest in communications and newsletters that we will send you, the way you use our Platform and your interest in our social channels (e.g. Facebook). Finally, we may enrich your profile with statistical information that we may lawfully acquire from other sources: for example, in relation to your area of residence (such as demographic information, geo-referencing data, etc.) or the electronic tools you use to interact with us.

In any case, you will not be subject to automated decision-making processes with the effects referred to in Article 22 of the GDPR.

h) to communicate your Data to our Business Partners (companies operating in the tourist-hotel or logistic sector, insurance companies, banks, telecommunications) for autonomous marketing purposes, subject to your consent;

The use of the Platform and the fruition of the relative services, including the fulfilment of requests for quotations for stays in affiliated hotels or other communications of service or in any case connected to the service, are in no way conditioned by the provision of the above mentioned consents, since they are necessary for the execution of the contractual relationship requested.

3. How long will we keep your Data?

Your Personal Data will be kept, starting from their receipt/update, for a period of time consistent with the purposes of the processing described above, as shown in the following table:

Categories	Duration	Main regulatory references
Candidates	maximum 12 months	art. 11 letter E) of Legislative Decree 196/2003 and art 5 letter E) of EU Reg 2016/679.
Employees	10 years	art. 43 of Dpr 600/73; art. 2946 civil code on ordinary prescription; Title I, Chapter III, of D.lgs.81/08 and subsequent amendments and integrations.
Site users, customers and suppliers	5 – 10 years	art. 2948 civil code that provides for a 5-year statute of limitations for periodic payments; art. 2220 civil code that provides for the 10-year preservation of accounting records; art. 22 of Presidential Decree no. 600 of 29 September 1973.
Users or other subjects, for commercial and promotional purposes.	In compliance with the terms prescribed by law for the type of activity and in any case until the revocation of consent or until the exercise of the right to object	art. 23 of Legislative Decree 196/03; General Measure of 15/05/13; art. 21 EU Reg. 2016/679.

4. To whom will we disclose your Data?

Your Data may be shared, for administrative purposes, with companies controlling, controlled by and connected to the Company and, for the purposes of managing the Platform and providing the services requested, with our suppliers of services instrumental to the services provided by the Company (e.g. IT services) who will act as data processors.
In the case of the elaboration of a quote or a reservation at the affiliated hotels through the Company's Platform, your Data may also be communicated by the Company to its commercial partners whose collaboration is necessary for the provision of the services requested (hereinafter, the "Commercial Partners"), including, in particular, hotel companies and companies operating in the logistics and tourism sector.

Our Business Partners will act both as data controllers pursuant to Article 28 GDPR, and as autonomous data controllers if you directly provide your Data to such Business Partners, who will process the same in accordance with their respective privacy policies.

A full list of the entities to which your Data may be disclosed will be made available by sending a written request to the Controller's contacts above. If you have directly provided your Data to our business partners, you should use the contacts provided by them in their respective privacy policies.

5. Will your Data be transferred to non-EU countries?

Personal Data is mainly processed within the European Union. For some services, we use tools (including but not limited to online services offered by Google LLC., Hubspot Inc., Survey Monkey Inc. together with their respective European subsidiaries) of companies with registered offices in the United States of America in accordance with the standard clauses concerning the protection of the data subject's rights according to the GDPR.

For the sake of better and more detailed information, please note that the email service referred to in the email addresses relating to the Platform is based on the email service made available by Gmail managed by Google LLC, headquartered in Mountain View, California, together with the European subsidiaries whose list is available here (hereinafter "Google").

If you do not wish to share your personal information and data through Google, please do not send this information and data to the aforementioned email address and agree with the Company on another method of sharing.

The Company also makes use of the software services, in particular for the preparation of online information request forms, offered by www.hubspot.com, the company HubSpot Inc. (hereinafter, "HubSpot"), with registered office at 25 First Street, Cambridge, MA, USA, and affiliates. Data collected through this service is processed in accordance with the guarantees set out in HubSpot's privacy policy (which also includes a complete list of its affiliated companies), available at this address. HubSpot declares that it complies with the principles established by the GDPR and the so-called Privacy Shield, the regulatory framework defined by the United States and the European Commission. It is currently on the list of companies covered by the Privacy Shield, available at this address.

For the preparation of specific satisfaction questionnaires (so-called customer feedback surveys), the Company makes use of the services offered by www.surveymonkey.com, of which the company SurveyMonkey Inc. (hereinafter "SurveyMonkey") with registered office in 1 Curiosity Way, San Mateo, California, and affiliates (the list of which is available at the following link: https://www.surveymonkey.com/mp/aboutus/office-locations/). Any data collected through this service will be processed in accordance with SurveyMonkey's privacy policy, which can be found at this address. For more information about SurveyMonkey's security safeguards for the processing of your personal data, you can view a summary document (a "White Paper") at this address. SurveyMonkey claims to comply with the principles set forth in the GDPR and the Privacy Shield, the regulatory framework established by the United States and the European Commission. SurveyMonkey is currently included in the list of companies covered by the Privacy Shield, available at this address.

6. What rights can you exercise?

You have the right to request access to, rectification or deletion of the Data, restriction of processing and to object to the use of the Data by us, as well as the right to request delivery of some of the Data. Specifically, you may exercise the following rights, in accordance with the law:

Right of access

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him are being processed and, if so, to obtain access to the personal data and the following information:

(a) the purposes of the processing;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organisations and, if so, the existence of adequate safeguards

(d) where possible, the proposed period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period

(e) the existence of the right of the data subject to request from the controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning him or her or to object to the processing of personal data concerning him or her

(f) the right to lodge a complaint with a supervisory authority;

(g) where the data are not collected from the data subject, all available information as to their source;

(h) the existence of an automated decision-making process, including profiling, which produces legal effects concerning him/her or

(h) the existence of an automated decision-making process, including profiling, which produces legal effects concerning him/her or significantly affects him/her in a similar way, and, at least in such cases, significant information on the logic used and the importance and envisaged consequences of such processing for him/her.

Right of rectification

The data subject shall have the right to obtain from the controller the rectification of inaccurate personal data concerning him or her without undue delay.

Right of erasure

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall be obliged to erase the personal data without undue delay, if one of the following grounds applies:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing;

(c) the data subject objects to the processing, and there is no overriding legitimate ground for processing;

(d) the personal data have been processed unlawfully;

(e) the personal data must be erased in order to comply with a legal obligation under European Union law or the law of the Member State to which the controller is subject;

Rights to restriction of processing

The data subject shall have the right to obtain from the data controller the restriction of processing when one of the following applies:

(a) the data subject contests the accuracy of the personal data, for the period necessary for the controller to verify the accuracy of the personal data;

(b) the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead that their use be restricted

(c) although the controller no longer needs the personal data for processing purposes, the personal data are necessary for the establishment, exercise or defence of legal claims by the data subject;

(d) the data subject has objected to the processing, pending verification as to whether the legitimate reasons of the controller prevail over those of the data subject.

Right to object

The data subject shall have the right to object at any time to the processing of personal data concerning him or her that is based on the legitimate interest of the controller, including profiling. The data subject shall have the right to object at any time to processing of personal data concerning him or her carried out for direct marketing purposes, including profiling insofar as it is related to such direct marketing.

Right to data portability

The data subject shall have the right to receive in a structured, commonly used and machine-readable format personal data concerning him or her that have been provided to a data controller and shall have the right to transmit such data to another data controller without hindrance by the data controller to whom he or she has provided them where:

(a) the processing is based on consent or on a contract; and

(b) the processing is carried out by automated means.

When exercising his or her data portability rights, the data subject shall have the right to obtain the direct transmission of personal data from one controller to another, if technically feasible.

7. How can you change your preferences or withdraw your consent?

At any time, you may review, modify or withdraw your consent in relation to the purposes set out in 2(e), (f), and (g) above (including by declaring that you do not wish to receive marketing information by email and/or instant messaging). To do so, you need only contact the Company in the manner set out below.

8. How to contact the Company to exercise your rights?

You may exercise your rights by writing to the data controller at the addresses indicated below:

Destination Italia S.p.A.
Galleria Sala dei Longobardi N.2 - 20121 Milano
Email: privacy@portalesardegna.com
Email DPO: dpo@portalesardegna.com

Welcome Travel Group S.p.A.
Via Ernesto Lugaro, 15 - 10126 Torino
Email DPO: dpo@wtg.it

9. How to contact the competent control authority for the presentation of any complaints?

Any complaints may be submitted to the competent Control Authority:

Guarantor for the Protection of Personal Data
Piazza di Monte Citorio n. 121
00186 Rome
Italy
Fax: (+39) 06.69677.3785
Tel: (+39) 06.696771
E-mail: garante@gpdp.it
Certified mail: protocollo@pec.gpdp.it

10. How will you be informed of any changes to this Privacy Policy?

This Privacy Policy may be amended and updated if there are changes in the way we process your data or other information provided to you herein. Any changes will ensure that your rights are fully protected. If any changes are made that may limit the safeguards protecting your Data or your rights as compared to the current version, before the processing of your Data begins in the new manner, you will be promptly informed through the contacts provided to us and you will have the right to cancel your account or change your consents and preferences.

In any case, we invite you to consult from time to time the updated Privacy Policy published on our website.

Last updated: 10th July 2023