a) The personal data will be processed for the following purposes:
- account registration and profile creation;
- use of the Website and the APP functions;
- managing any requests for assistance or information.
The legal basis of the processing for the purposes referred to in letter a) is Article 6(b) of the GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. The provision of data is not compulsory, but is a necessary requirement to perform the requested services. Failure to provide them therefore means that such requests cannot be fulfilled.
b) The personal data will also be processed to fulfil a legal obligation to which the Controller is subject (in accordance with Article 6(c) of the GDPR).
c) The data may be processed in pursuit of the legitimate interests of the Controller provided that the interests or the fundamental rights and freedoms of the data subject are not overridden, having regard to the reasonable expectations of the data subject based on his or her relationship with the Controller and in particular for the prevention of fraud or, to the extent strictly necessary and proportionate, to ensure network and information security.
The legal basis for the processing for the purposes referred to in letter c) is Article 6(f) of the GDPR.
d) With reference to Users who have made a reservation and/or used the services and/or activities offered, data will be processed to carry out communications, via email, related to:
Suggestions for activities and experiences to be done in the area of interest (e.g., near the accommodation where the User is staying);
Offers and/or discounts dedicated to the User on the occasion of their birthday;
Requests for feedback on the activity/service that the User has used.
The Data Subject may oppose at any time to receiving such communications through the appropriate unsubscribe feature, contained in the emails, or by contacting the Data Controller at the contact details mentioned in point 1. The legal basis for processing for the purposes outlined in point d) is Article 6 letter f) of the GDPR: the legitimate interest of the Data Controller.
e) With the prior consent of the Data Subjects, the personal data will be processed:
- to inform Users, by e-mail, SMS and MMS, of services, initiatives and events promoted by the Controller;
- to analyse, including by automated means, the Users consumption, tastes and preferences in order to provide them with information on services or initiatives in line with their interests. The automated decision-making process envisaged in the context of the processing of this data does not produce any legal effect for the data subjects and does not affect them in the same way;
- to provide the User with information regarding places and services of interest in the surrounding area.
The legal basis of the processing for the purposes referred to in letter d) is Article 6(a) of the GDPR: the Data Subjects have given consent to the processing of their data for one or more specific purposes. The provision of data is optional but is a necessary requirement to pursue the purposes indicated.
User data will also be used in aggregated and anonymised form for statistical analysis.