Privacy Policy (Version May 2025)

Data controller

The controller of the processing of personal data is HOLIDAY SERVICE s.r.l., represented by its legal representative pro tempore, with registered office at Plan de Gralba 10, 39048 Selva di Val Gardena (BZ), Tax Code and VAT no. 02230670214 ("HS" or the "Controller").

 

Data Protection Officer (DPO)

A Data Protection Officer has been appointed and can be contacted at: info@rifugiocomici.com.

 

This privacy policy is provided pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”) to inform you about how your personal data is managed by the Controller. Any personal data you provide or otherwise transmit will be processed in accordance with the provisions of the Regulation and any other applicable data protection laws, such as Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (the “Privacy Code”). The processing of personal data by the Controller will be based on the principles of lawfulness, fairness, transparency, purpose and storage limitation, data minimization, accuracy, integrity, and confidentiality.

 

Personal Data Processed

While browsing and using the services offered by the Controller through the website “www.rifugiocomici.com” (hereinafter the “Website”)—such as: table reservations; managing reservations (modification or cancellation, etc.); purchasing value and/or product vouchers; sending promotional and marketing communications including newsletters; submitting job applications; and/or accessing sections of the Website or using the free Wi-Fi service provided by Rifugio Comici (collectively, the “Services”)—personal data is processed.

Personal data may include identifiers such as name and surname; identification numbers and online identifiers such as phone numbers (mobile and/or landline) and email addresses; other contact information such as home address; or any other elements that characterizes the data subject’s physical, physiological, psychological, economic, cultural, or social identity and that could render the person identified or identifiable (the “Personal Data”).

Additionally, Personal Data may include special categories of personal data, such as data revealing health status, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, and data concerning a person’s sex life or sexual orientation, pursuant to Article 9 of the GDPR (the “Special Categories of Data”).

 

The Personal Data processed through the Website include the following:

• Browsing data. The IT systems and software procedures used to operate the Website acquire, during their normal operation, some Personal Data whose transmission is implicit in the use of Internet communication protocols. These data are not collected to be associated with identified individuals but, by their very nature, could allow users to be identified through processing and association with data held by third parties. This category of data includes IP addresses or domain names of the computers used by users who connect to the Website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server's response (successful, error, etc.), and other parameters related to the user’s operating system and IT environment. These data are used solely to obtain anonymous statistical information on the use of the Website, to ensure its proper functioning, and to identify anomalies and/or abuse, and are deleted immediately after processing. The data may be used to determine liability in the event of hypothetical cybercrimes against HS or third parties.
• Data voluntarily provided by the data subject. When using certain services on the Website, you may provide Personal Data. The provision of some Personal Data may be necessary to access specific services. The optional, explicit, and voluntary submission of your Personal Data through contact forms and/or availability or reservation requests on the Website, or by sending emails to the addresses listed on the Website, entails the subsequent acquisition of the data communicated, including your name, surname, email address, phone number (mobile or landline), home address, and your consent to receive any response messages to your requests. The Personal Data provided in this manner will be used by HS exclusively for the provision of the requested Services and to process or respond to your inquiries, and will only be shared with third parties if necessary for that purpose. If you provide Personal Data of third parties while using the Website, you must ensure that there is a valid legal basis under Article 6 of the Regulation to lawfully process such Personal Data.
• Special Categories of Personal Data. In using certain sections of the Website, you may submit Special Categories of Personal Data. The legal basis for processing such data is either the necessity to comply with obligations and exercise specific rights of the Controller or the data subject in the field of employment law (Art. 9(2)(b) of the Regulation), or—if the data is voluntarily provided by the applicant—their explicit prior consent (Art. 9(2)(a) of the Regulation). Therefore, you are kindly requested not to submit unnecessary Special Categories of Data. If such data is nonetheless provided, the Controller may process it only to the extent permitted by law and by adopting appropriate security measures.
• Data Collected Through Cookies. While browsing the Website, certain Personal Data may be collected through the use of so-called "Cookies". For more information, please refer to the following link: www.rifugiocomici.com/en/cookies

 

Personal Data processed through the free Wi-Fi Service:

• Categories of Personal Data: Email address, MAC address

 

 

Purposes of Processing, Legal Bases, and Data Retention Periods

 

The Controller processes Personal Data for the following purposes:

• Provision of the requested Services (i.e.: (i) the table reservation procedure; (ii) management of the reservation—modification or cancellation, etc.; (iii) the procedure for purchasing value and/or product vouchers), as well as responding to requests for assistance, information, or bookings. The legal basis for the processing is the performance of pre-contractual measures and/or the performance of a contract (Art. 6(1)(b) of the Regulation), as the processing is necessary to provide the requested Services or to respond to the data subject’s inquiries. The provision of Personal Data for these purposes is optional, but failure to provide such data would make it impossible to activate the requested Services or respond to the inquiries. Such Personal Data will be retained for only as long as necessary to achieve the stated purposes. If the Personal Data is provided in connection with a service request, it will be retained for the period necessary to provide the service and, in any case, for a maximum period of 24 months, in accordance with Article 2946 of the Italian Civil Code.
• Subscription to Rifugio Comici's Free Wi-Fi Service. The legal basis for the processing is the performance of pre-contractual measures and/or the execution of a contract (Art. 6(1)(b) of the Regulation), as the processing is necessary to provide the requested service. The provision of Personal Data for this purpose is optional; however, failure to provide such data will make it impossible to activate the requested free Wi-Fi service. These Personal Data will be retained for only as long as necessary to achieve this purpose and, in any case, for a maximum period of 24 months.
• Verification of Security and Proper Functioning of the Free Wi-Fi Service. This purpose represents a legitimate processing of Personal Data, based on the Controller's legitimate interest, as the operator of the free Wi-Fi service, in ensuring the security of the service and of the IT infrastructure in general, with the aim of preventing anomalies and/or misuse (Art. 6(1)(f) of the Regulation). The Personal Data processed for this purpose will be retained for no longer than is necessary to achieve the purposes for which they were collected, and in any case for a maximum period of 24 months.
• Analysis of CVs and Recontacting of Candidates. The legal basis for this processing is the performance of pre-contractual measures and/or the execution of a contract (Art. 6(1)(b) of the Regulation), as the processing is necessary for the analysis and evaluation of submitted CVs.
  Regarding the review of professional social media profiles that are freely available online (e.g., LinkedIn), the legal basis is the legitimate interest of HS to assess any risks related to the candidate's suitability for the specific open position (Art. 6(1)(f) of the Regulation).
  During the recruitment process, the Controller may come into possession of Special Categories of Data. Such data will only be processed if necessary to fulfill obligations and exercise specific rights of the Controller or the data subject in the field of labor law (Art. 9(2)(b) of the Regulation), or upon the explicit consent of the candidate if provided voluntarily (Art. 9(2)(a) of the Regulation).
  Candidates are therefore requested not to include unnecessary Special Categories of Data in their CVs for the position they are applying for. If such data are nonetheless included, the Controller may only process them within the limits permitted by law and while adopting appropriate security measures. For the above-mentioned purposes, Personal Data will be retained for a maximum period of 24 months.
• Compliance with Legal, Accounting, or Tax Obligations. The legal basis for this processing is compliance with a legal obligation (Art. 6(1)(c) of the Regulation). Once the Personal Data are provided, the processing is necessary to comply with a legal obligation to which HS is subject. For this purpose, Personal Data will be retained for the period required by the relevant legal obligation or applicable regulation.
• Sending of Newsletters and Promotional Communications. The legal basis for sending promotional and marketing communications regarding products or services—including those related to other facilities owned by HS—through automated (e.g., email) and non-automated means (e.g., regular mail) is the data subject's freely given and specific consent (Art. 6(1)(a) of the Regulation). Failure to provide consent for this purpose will not affect the use of the services, except for the free Wi-Fi service of Rifugio Comici.

Furthermore, pursuant to Art. 130, paragraph 4 of the Italian Privacy Code, the Controller may use your email address to send promotional communications about products or services similar to those you have already purchased (so-called “soft spam”), unless you object. For these purposes, Personal Data will be retained until consent is withdrawn by the data subject or, in the absence of such withdrawal, for a maximum period of 24 months.

 

• Prevention and Management of Disputes and Legal Proceedings. The legal basis for this processing is the legitimate interest of HS to prevent and/or manage disputes, and to defend itself in legal proceedings (Art. 6(1)(f) of the Regulation). For this purpose, Personal Data will be retained for a period of 10 years, unless an objection is raised and excluding the time necessary for legal defense.

 

For more information on the retention period of Personal Data and the criteria used to determine such period, please contact: info@rifugiocomici.com

 

Recipients and Transfers of Personal Data

 

Your Personal Data may be disclosed to the following recipients:

• Individuals acting under the authority of HS, who have been authorized to process Personal Data pursuant to Art. 29 of the Regulation in the context of their job duties and who are bound by confidentiality or a suitable legal obligation of confidentiality (e.g., employees, collaborators).
• Data Processors pursuant to Art. 28 of the Regulation, who process Personal Data on behalf of the Controller and under a contract with the Controller, including: (i) individuals, companies, or professional firms providing HS with assistance and consultancy services in the fields of accounting, administration, legal matters, taxation, finance, and credit recovery; (ii) entities necessary for the provision of services (e.g., hosting providers, resources providers, software developers, marketing agencies); (iii) the operator of the online table reservation platform; (iv) the operator of the job application platform; (v) entities in charge of technical maintenance (system administrators).
• Subjects acting as independent Data Controllers. In the context of the free Wi-Fi service offered at Rifugio Comici, the service provider acts as an independent data controller for the purpose of identifying users accessing the free Wi-Fi network, in order to trace any individuals responsible for illegal conduct carried out via the network.
• Subjects, entities or authorities to whom your Personal Data must be disclosed pursuant to legal provisions or authority orders.

 

If any of your Personal Data is shared with recipients located outside the European Economic Area, HS ensures that such processing will occur in compliance with the Regulation and with appropriate safeguards as set out therein.

For more information regarding the processing of your Personal Data by third parties, please contact: info@rifugiocomici.com

 

Your Rights

Pursuant to Articles 15 et seq. of the Regulation, you have the right to request at any time from HS access to your Personal Data, rectification or erasure of such data, objection to its processing, restriction of processing in the cases provided for in Article 18 as well as data portability in the cases provided for in Article 20, i.e., to receive your data in a structured, commonly used, and machine-readable format.

Requests can be submitted via email to: info@rifugiocomici.com

You are also informed that you may withdraw your consent at any time for any processing not required for the provision of services. Specifically, you can opt-out of receiving newsletters and promotional communications at any time by clicking the unsubscribe link at the bottom of every email or by emailing: info@rifugiocomici.com

Please note that the withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal, as stated in Article 7(3) of the Regulation.

In any case, you have the right to lodge a complaint with the competent Supervisory Authority (in Italy: Garante per la Protezione dei Dati Personali), pursuant to Article 77 of the Regulation, if you believe the processing of your Personal Data violates applicable law.

 

Modifications

HS reserves the right to amend or update this policy, in whole or in part, also in response to changes in applicable law. You will be notified of any such changes through their publication on the website. HS therefore invites you to regularly check this section to stay informed about the most recent and updated version of the privacy policy and to remain aware of how your data is collected and used.