Privacy policy for the processing of the personal data

(rev. 02/2026)

PRIVACY POLICY 

UNDER ART. 13 OF REGULATION (EU) N. 679 of 2016

European Regulation (EU) 2016/679 (hereinafter also referred to as the “Regulation”) establishes regulations on the protection of natural persons with respect to the processing of their personal data.

In compliance with the principle of transparency set out under Articles 5 and 12 of the Regulation, Trentino Marketing S.r.l.

provides the information required under Article 13 of the Regulation.

The personal data Controller is Trentino Marketing S.r.l. (hereinafter, the “Controller"), in the person of its legal representative, with registered office address at Via Romagnosi n. 11, 38122 – Trento, phone (+39) 0461 219300, e-mail privacy@trentinomarketing.org Certified E-mail (PEC) trentinomarketing@pec.visittrentino.it

The Compliance & Privacy Manager is the person appointed to respond to the Data Subject in the event of the exercising of the rights provided for in articles 15-22 of the Regulation and described below.

The contact details of the Data Protection Officer (DPO) are: Trentino Sviluppo S.p.A., Via F. Zeni n. 8, 38068 – Rovereto, email dpo@trentinosviluppo.it (use subject line “Richiesta intervento RPD ex art. 38 Reg. UE”) (“Request for DPO Assistance under Article 38 of EU Regulation”).

The processing of your personal data shall be based on compliance with personal data protection regulation, and particularly with the principles of fairness, lawfulness, and transparency, storage limitation, and data minimisation in accordance with Articles 5 and 25 of the Regulation. Your personal data shall be processed using appropriate safety measures, in compliance with the provisions of Articles 5 and 32 of the Regulation.

1. CATEGORIES OF PERSONAL DATA

The personal data processed fall within the category  of personal data other than special categories of data (known as “common personal data”) 

Unregistered User

•     IP address/connection ID;

•     installation identification code;

•     information regarding location;

•     content viewed through the APP and/or on the Website Registered User:

•     name, surname, email address, city, nationality, phone;

•     IP address/connection ID;

•     installation identification code;

•     any personal data associated with the “Trentino Guest Card”;

•     information regarding location;

•     information regarding the mobile device used;

•     reservations made; 

•     functionalities used;

•     content viewed through the APP and/or on the Website

•     information on preferences and interests;

•     any customer satisfaction feedback expressed regarding the use of the APP and/or the Website.

2.    PURPOSES AND LEGAL BASIS FOR PROCESSING 

The data minimisation principle establishes that the only data that may be collected and processed are data which are relevant and not excessive in relation to the specific purposes for which they are processed. 

The principle of storage limitation states that data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed, save in exceptional cases.

For these reasons, and in order to comply with Article 13 of the Regulation, we provide below the specific purposes of processing  and the legitimate basis that allow the processing of your personal data (including the legal grounds  upon which processing is based). Your personal data shall be processed in order to

2.1.   PERFORM THE SERVICES AND THE FUNCTIONALITIES OF THE APP AND/OR WEBSITE.

the legitimate basis for processing is found in Article 6 (b) of the Regulation, meaning that processing is necessary for the performance of an agreement to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. 

2.2.   HANDLE REQUESTS FOR ASSISTANCE OR INFORMATION SUBMITTED THROUGH THE APP.

the legitimate basis for processing is found in Article 6 (b) of the Regulation, meaning that processing is necessary for the performance of an agreement to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. 

2.3.   HANDLE REQUESTS FOR INFORMATION SUBMITTED THROUGH THE WEBSITE, REQUIRING THE TRANSFER OF YOUR PERSONAL DATA TO THE ENTITIES ESTABLISHED UNDER PROVINCIAL LAW NO. 8 OF 2002, AND/OR TO HOSPITALITY FACILITIES IN ORDER TO HANDLE THE REQUEST FOR INFORMATION sent through the Website and to process said request. The above entities shall become independent Controllers for the same data.  the legitimate basis for processing is found in Article 6 (a) of the Regulation: the data subject has expressed its consent to the processing of his or her data for one or more specific purposes. 

2.4.   sEND PROMOTIONAL COMMUNICATIONS TO ADVERTISE PRODUCTS AND/OR SERVICES THAT ARE SIMILAR TO THOSE PURCHASED IN THE PAST, without prejudice to the data subject's right to object at any time to the sending of

said promotional communications, by following dedicated unsubscribe functionalities or by sending an e-mail to privacy@trentinomarketing.org, with subject line APP/Sito - diritto di opposizione (APP/Website - Right to Object);

The legal grounds for processing is the legitimate interest under Article 6 (f) of the Regulation, exercised in compliance with Article  130 (4) of the Privacy Code: processing is necessary for the purposes of the legitimate interests pursued by the controller, except where such

interests are overridden by the interests for fundamental rights and freedoms of the data subject, particularly where such data subject is a minor. 

2.5.   IN ORDER TO PREVENT POSSIBLE FRAUDS AND TO THE EXTENT STRICTLY NECESSARY FOR THE PURPOSES OF ENSURING NETWORK AND INFORMATION SECURITY.

The legitimate basis of processing is found in Article 6 (f) of the Regulation, meaning that processing is necessary for the purposes of the legitimate interests pursued by the controller, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject, particularly where such data subject is a minor.

2.6.   SENDING NEWSLETTERS REGARDING, FOR INSTANCE, EVENTS, PROMOTIONAL ACTIVITIES, OR HOLIDAY OFFERS IN TRENTINO, PROMOTED BY THE CONTROLLER. 

The legitimate basis for processing is found in Article 6 (a) of the Regulation: the data subject has expressed its consent to the processing of his or her data for one or more specific purposes. 

2.7.   ACCESSING YOUR LOCATION FOR THE PURPOSE OF PROVIDING INFORMATION REGARDING PLACES OR SERVICES THAT MAY BE OF INTEREST IN THE SURROUNDING AREA, AND TO CREATE CUSTOMISED TRAVEL ITINERARIES.

The legitimate basis for processing is found in Article 6 (a) of the Regulation: the data subject has expressed its consent to the processing of his or her data for one or more specific purposes.

2.8.   BE ENTERED INTO ANONYMOUS CLUSTERS WITH HOMOGENEOUS CHARACTERISTICS FOR THE SENDING OF CUSTOMISED PROMOTIONAL COMMUNICATIONS BY THIRD PARTIES, AS INSTRUCTED BY THE CONTROLLER. 

The legitimate basis for processing is found in Article 6 (a) of the Regulation: the data subject has expressed its consent to the processing of his or her data for one or more specific purposes. 

2.9.   ANALYSE, INCLUDING THROUGH AUTOMATED MEANS, YOUR PURCHASES, TASTES, AND PREFERENCES FOR THE PURPOSE OF PROVIDING YOU INFORMATION ON SERVICES OR INITIATIVES THAT ARE IN LINE WITH YOUR INTERESTS. The above processing does not constitute an automated decision-making process, it does not produce any legal effects concerning data subjects, and it is excluded that it similarly significantly affects data subjects. 

The legitimate basis for processing is found in Article 6 (a) of the Regulation: the data subject has expressed its consent to the processing of his or her data for one or more specific purposes.

2.10. The users’ data shall, in addition, used in AGGREGATED AND ANONYMISED FORM TO CONDUCT STATISTICAL ANALYSES. 

3.    NATURE OF THE PROVISION OF PERSONAL DATA AND CONSEQUENCES OF FAILURE TO PROVIDE DATA

The provision of your personal data is mandatory for the purposes listed under 2.1, 2.2, and 2.3, and for all auxiliary and connected purposes (such as auditing and advisory activities), as such provision is necessary in order to enter into a contract; refusal to provide such data shall render it impossible to provide the services requested.

The provision of your personal data for other purposes is not mandatory, but it is necessary to process a specific request and/or to have access to the requested services; therefore, failure to provide such data shall render it impossible to receive the information requested and/or use the services.

4.    METHODS OF PROCESSING

Processing shall be carried out using manual and automated  (digital/electronic) means, using criteria designed to ensure the confidentiality, integrity, and availability of such data.

Your personal data shall be processed, exclusively for the purposes above, by duly trained members of staff (or other contracted associates), and particularly by Persons in Charge of Processing, who have been appointed to such role, and by persons qualified as Assigned processing staff, who are expressly authorised to process personal data.

In addition, your data may be processed, for the above purposes, by persons who carry out activities which are instrumental for the Controller (including outsourced service providers), who provide appropriate guarantees with respect to the protection of personal data, and are appointed as Data Processors under Article 28 of the Regulation. You can obtain an updated list of said Processors can contacting the Controller at privacy@trentinomarketing.org, using subject line: APP/Sito – elenco responsabili (APP/Website - List of Processors).

5.    AUTOMATED DECISION-MAKING PROCESSES AND PROFILING

Processing also includes profiling (Article 4 (4) of the Regulation). This  automated  data processing consists in utilizing personal data to assess, for instance, target, interests, or geographical location. The criteria used is the following: based on user choices and browsing, users are entered into specific clusters to whom are sent communications that pertain to said choices.

6.    DATA COMMUNICATION AND DISCLOSURE (CATEGORIES OF RECIPIENTS)

We inform you that your data shall be communicated to the entities established under Provincial Law No. 8 of 2002 and/or to hospitality facilities in order to handle your information requests sent through the Website, which is a necessary requirement for the conclusion of the contract.

Your personal data shall not be disseminated.

7.    DATA TRANSFER OUTSIDE OF THE EU/EEA (European Economic Area) Your personal data shall not be transferred outside of the European Union/EEA.

8.    DATA RETENTION PERIOD

In compliance with the storage limitation principle detailed above, we inform you that the storage period for your data shall be  

•     for the purpose of creating and registering your profile: until your profile is deleted. 

•     for generic marketing purposes: until the user’s consent is revoked, but in any case, no longer than 48 months from the time in which the consent was provided;

•     for marketing purposes based on the services purchased by the user: until the user’s consent is revoked, but in any case, no longer than 14 months from the time in which the consent was provided;

•     for profiling activities:  until the user’s consent is revoked, but in any case, no longer than 48 months from the time in which the consent was provided;

•     data relative to location: these data shall be retained for no longer than 12 months from collection.

Ince the retention period is ended, your data shall be erased and/or anonymised to be used for statistical purposes.

9. RIGHTS OF DATA SUBJECTS 

You may exercise, towards the data Controller (using the contact details indicated above) the data afforded to data subjects under the Regulation, at any time.

Based on the Regulation, you may

•         request access to your personal data and obtain a free copy of the same (Article 15);

•         should you find your data to be incorrect or incomplete, request the rectification of incorrect data or to have incomplete data completed l (Article 16);

•         where the legal conditions are met, request the erasure of data (Article 17), or exercise the right to restrict processing (Article 18); 

•         receive the data  concerning you, provided by you to the Controller, in a structured, commonly used and machinereadable format, and you have the right to transmit said data to a different controller; where technically feasible, you also have the right to obtain your data to be communicated directly, by the Controller, to a different controller (Article 20).

•         where the legal conditions are met, object to the processing of your data, at any time, on grounds related to your personal situation (Article 21(1))

•         object to the processing of your data (including profiling), at any time, where processing is carried out for marketing purposes (Article 21(2))

•         under Article 19, the Controller shall communicate any rectification or erasure of personal data or restriction of processing carried out to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort; should you request it, the Controller shall provide you with the names of those recipients.  

You have the right to withdraw any consent you have provided at any time and free-of-charge (Article 7); such withdrawal shall not affect the lawfulness of processing based on consent prior to its withdrawal, by unsubscribing or sending an e-mail to privacy@trentinomarketing.org. 

In addition, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) and with the competent Judicial Authority. 

For the purpose of added transparency, please find below a table summarising our processing operations.