Privacy information data processing Information document article 13 EU Reg. 2016 / 679- GDPR

Gruppoinvest D’Amico Sas with headquarters in Via Ceglie, 15/17- 72014 Cisternino (BR), VAT no. 02083250742, in the person of its legal representative, (hereinafter, “Owner”), as owner of the data processing, informs you pursuant to art. 13 D.Lgs. 30.6.2003 n. 196 (hereinafter, “Privacy Code”) and art. 13 EU Regulation n. 2016/679 (hereinafter, “GDPR”) that your data will be processed in the following ways and for the following purposes:

1. Purpose of processing. The Data Controller processes personal, identifying data (e.g., name, surname, company name, address, telephone, e-mail, bank and payment references)-hereafter, “personal data” or also “data”) communicated by you in connection with the conclusion of contracts for the services of the Data Controller. The data deriving from the web service may be communicated to the technological and instrumental partners that the Data Controller uses to provide the services requested by user visitors. The personal data provided by visitors who request information material (requests for information, answers to questions, etc..) or other communications are used only to perform the service or provision requested and are communicated to third parties only where this is necessary for that purpose (provision of services requested through the technological and instrumental partner). The Data Controller employs persons in charge of the processing. The Regulation imposes on the appointee, but also on the Controller, the obligation to preserve the documentation of all processing operations carried out under its responsibility. Preservation which, if referring to electronic documents, obviously implies the need for skills related to electronic storage.

2. Purposes of the processing Your personal data are processed: A) without your express consent (art. 24 lett. a), b), c) Privacy Code and art. 6 lett. b), e) GDPR), for the following Service Purposes: – to conclude contracts for the Owner’s services; – to fulfil pre-contractual, contractual and fiscal obligations arising from existing relations with you; – to exercise the Owner’s rights, such as the right to defence in court; B) only after your specific and distinct consent (art. B. Only with your specific and separate consent (Articles 23 and 130 of the Privacy Code and Art. 7 GDPR), for the following Marketing Purposes: – to send you via e-mail, post and/or sms and/or telephone contacts, newsletters, commercial communications and/or advertising material on products or services offered by the Owner and detection of the degree of satisfaction on the quality of services; – to send you via e-mail, post and/or sms and/or telephone contacts commercial and/or promotional communications of third parties (e.g. business partners)

3. Processing methods. The processing of your personal data is carried out by means of the operations indicated in art. 4 n. 2) GDPR and precisely: collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data. Your personal data shall be subject to both paper and electronic and/or automated processing. The Data Controller will process your personal data for the time necessary to fulfil the above purposes and in any case for no longer than 5 years from the termination of the relationship for the Service Purposes and for no longer than 2 years from the termination of the service, for the collection of data for Marketing Purposes. Without prejudice to the provisions of law for the storage of tax data. Navigation data. The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the site. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the site. Data provided voluntarily by the user. The optional, explicit and voluntary sending of electronic mail to the addresses indicated on this site entails the subsequent acquisition of the sender’s address, which is necessary to respond to requests, as well as any other personal data included in the message. If you have given your explicit and free consent, during the registration process, to request assistance and to subscribe to the newsletter or during the use of our services, the aforementioned personal data may also be processed for the following additional purposes: sending of newsletters and commercial notices, traditional marketing activities such as sending brochures, catalogues and/or technical material by ordinary paper mail and telephone calls with operator, and marketing activities with automated or assimilated tools such as: Fax, E-mail, SMS, MMS, Instant Messaging, Chat and phone calls without an operator. In addition, online marketing activities, web marketing and web advertising. Market research and commercial profiling activities and finally, communication to third parties. The provision of personal data collected for the above-mentioned purposes is optional. Where necessary, the data may also be communicated to third parties. Data obtained through authentication with third party systems are understood to be conferred to this site through explicit acceptance of the authentication service (o-auth).

4. Access to the data.  Your data may be made accessible for the purposes referred to in point 2.A and 2.B: – to employees and collaborators of the Controller, in their capacity as persons in charge and/or internal authorised processors and/or system administrators; – to third party companies or other entities (by way of example, for the provision of shipping and packaging services, postal services, etc.) that perform outsourcing activities on behalf of the Controller, in their capacity as external data processors.

5. Communication of data Without the need for express consent art. 6 lett. b) and c) GDPR), the Owner may communicate your data for the purposes referred to in paragraph 2.A to those subjects to whom the communication is required by law for the fulfillment of the aforementioned purposes. These subjects will process the data in their capacity as autonomous data controllers. Transfer of data. The Data Controller does not transfer personal data to third countries or to international organisations.

6. Nature of data conferment and consequences of refusal to answer. The conferment of data for the purposes of point 2.A) is mandatory. Without it, we will not be able to guarantee the Services provided by the Controller. The provision of data for the purposes referred to in art. 2.B) is instead optional. You may therefore decide not to provide any data or to subsequently deny the possibility of processing data already provided: in this case, you will not be able to receive newsletters, commercial communications and advertising material relating to the Services offered by the Owner. You will, however, continue to be entitled to the Services referred to in point 2.A).

7. Rights of the data subject. As a data subject, you have the rights where applicable under Articles 15 to 22 of EU Regulation 2016/679 and specifically: right of access, right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object, as well as the right to complain to the Supervisory Authority.

8. How to exercise your rights. You can exercise your rights at any time by sending an email to info@damicoholidayspuglia.it or by sending a written notice by registered mail to: the owner of the data processing, in the person of the administrator, with registered office in Via Ceglie, 15/17- 72014 Cisternino (BR). To exercise your rights you can use the form provided at the following link: https://www.damicoholidayspuglia.it/en/privacy-eng/ The owner assumes the burden of giving an answer to the complaint submitted by the person concerned within 1 (one) month from the request, even in case of refusal. This time limit may be extended to 3 (three) months in cases of particular complexity.

9. Consent to processing and minors. The interested party declares that he/she has read the above information, with the communication of personal data freely given or otherwise collected during navigation, always carried out in compliance with the privacy laws in force; he/she gives his/her consent to processing, and therefore, by “ticking” the appropriate box expressly accepts the registration and processing of his/her data, which will be based on the principles of correctness, lawfulness and transparency, in the manner indicated above. Particular conditions are dictated by EU Regulation 679/2016 in the interest of minors in Article 8, which clarifies that the processing of personal data of minors under 16 years of age – or, if provided for by the law of the Member States, of a lower age but not under 13 years – is lawful only if and to the extent that such consent is expressed or authorised by the holder of parental responsibility over the child. Therefore, conduct by minors without the authorisation of those who have to supervise them under their responsibility, primarily their parents, is contrary to the provisions and the data controller cannot be held responsible for the minor’s having broken the law by circumventing the provisions in force.