Privacy Policy

This notice is provided pursuant to art. 13 of Regulation (EU) 2016/679 (hereinafter the “GDPR”) and of Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the “Privacy Code”) to all those who interact with the website www.parcodelleserre.it (hereinafter also the “Site”), and describes how the personal data of users who visit it or use the services offered on it are processed.

This notice relates to this Site only, and not to any other website the user may reach through links.

1. Data Controller

The Data Controller is the Ente Parco Naturale Regionale delle Serre, with registered office at Via Santa Rosellina 2, 89822 Serra San Bruno (VV), Italy.

Contact details of the Controller:

  • Address: Via Santa Rosellina 2, 89822 Serra San Bruno (VV), Italy
  • Certified e-mail (PEC): parcodelleserre@pec.it
  • Telephone: +39 0963 772825
  • Tax code: [to be added]

2. Data Protection Officer (DPO)

Pursuant to art. 37 of the GDPR, the Controller has appointed as Data Protection Officer Dott. Francesco Maria Pititto, who may be contacted regarding any matter concerning the processing of personal data and the exercise of the rights granted by the GDPR, at the Controller’s contact details given above.

3. Categories of data processed

The Controller processes the following categories of personal data, either provided by users or collected automatically while browsing:

3.1 Browsing data

The computer systems and software procedures used to operate this Site acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, make it possible to identify users. This category includes the IP addresses or domain names of the computers used by visitors to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s response (successful, error, etc.) and other parameters relating to the user’s operating system and computing environment.

These data are used solely to obtain anonymous statistical information on the use of the Site and to check that it is working correctly, as well as to establish liability in the event of computer crimes against the Site or third parties.

3.2 Data provided voluntarily by the user

The optional, explicit and voluntary sending of e-mail to the addresses given on the Site, and the completion of the forms available (contact form and newsletter subscription), entail the acquisition of the sender’s contact details, which are necessary in order to respond to requests, together with any personal data included in the communication.

In particular, the following are processed:

  • Contact form: first name, surname, e-mail address, subject and content of the message.
  • Newsletter subscription: e-mail address.

3.3 Cookies and tracking technologies

The Site uses technical cookies and, subject to the user’s consent, profiling and/or third-party cookies. For full details please refer to the Cookie Policy available at the following address: https://parcodelleserre.it/cookie-policy-eu/

4. Purposes and legal basis of the processing

Users’ personal data are processed for the following purposes:

  • a) To allow browsing of the Site and ensure that it works correctly. Legal basis: legitimate interest of the Controller (art. 6(1)(f) GDPR) and performance of a task carried out in the public interest (art. 6(1)(e) GDPR).
  • b) To respond to requests for information sent through the contact form or by e-mail. Legal basis: performance of pre-contractual or contractual measures taken at the data subject’s request (art. 6(1)(b) GDPR) and/or performance of a task carried out in the public interest connected with the Controller’s institutional functions (art. 6(1)(e) GDPR).
  • c) To send the newsletter with updates on the Park’s events, initiatives and activities. Legal basis: consent of the data subject (art. 6(1)(a) GDPR), freely given at the time of subscription and revocable at any time.
  • d) Anonymous statistical analysis through Google Analytics. Legal basis: consent of the data subject (art. 6(1)(a) GDPR) given through the cookie banner.
  • e) To comply with obligations laid down by laws, regulations or EU legislation. Legal basis: legal obligation (art. 6(1)(c) GDPR).

5. Methods of processing

Personal data are processed by manual, electronic and telematic means, following logic strictly related to the purposes indicated and, in any case, in such a way as to guarantee the security and confidentiality of the data, in compliance with the appropriate technical and organisational measures required by arts. 25 and 32 of the GDPR.

Specific security measures are in place to prevent data loss, unlawful or improper use and unauthorised access.

6. Google Analytics

The Site uses Google Analytics, a web analytics service provided by Google Ireland Limited (“Google”), in order to collect information on users’ use of the Site in aggregate, anonymous form (pages visited, time spent, geographical origin, etc.).

Google Analytics uses cookies installed on the user’s device. The information collected is transmitted to and stored on Google’s servers. The Controller has adopted measures to anonymise the user’s IP address (IP masking) wherever technically possible.

For further information please refer to Google’s privacy policy, available at the following address: https://policies.google.com/privacy. Google Analytics can be disabled by installing the opt-out browser add-on provided by Google: https://tools.google.com/dlpage/gaoptout.

7. Recipients of the data

The personal data collected may be disclosed to:

  • Authorised staff of the Park Authority, specifically instructed and trained in the processing of personal data;
  • External parties carrying out outsourced activities on behalf of the Controller, appointed as Data Processors pursuant to art. 28 GDPR (by way of example: hosting service provider, Site maintenance provider, newsletter service provider, Google Ireland Limited for the Analytics service);
  • Public authorities, judicial or supervisory bodies, where required by legal obligations or binding orders.

Personal data are not disseminated, except in the cases provided for by specific legal obligations (for example, publication in the Transparent Administration section or on the official online notice board, as provided for by Legislative Decree 33/2013).

8. Transfer of data to third countries

Some of the data collected may be processed by service providers based outside the EEA (in particular Google, for the Analytics service). In such cases, the transfer takes place exclusively to parties guaranteeing an adequate level of data protection, in accordance with art. 44 et seq. of the GDPR, through the adoption of Standard Contractual Clauses approved by the European Commission or other instruments provided for by the applicable legislation.

9. Data retention period

Personal data are kept for as long as is strictly necessary to achieve the purposes for which they were collected and, in any case, in compliance with statutory and regulatory time limits. In particular:

  • Browsing data: kept for no longer than 7 days, except where computer crimes against the Site are being investigated.
  • Data provided through the contact form: kept for as long as is necessary to deal with the request and for the following 24 months, unless a different period is required by legal obligations.
  • Data provided to subscribe to the newsletter: kept until the data subject withdraws consent (unsubscribing from the newsletter).
  • Data collected through cookies and Google Analytics: kept for the periods indicated in the Cookie Policy.

10. Rights of the data subject

In relation to the personal data processed, the data subject has the right to exercise, at any time, the rights provided for by arts. 15-22 of the GDPR, and in particular:

  • Right of access (art. 15): to obtain confirmation as to whether or not personal data concerning them exist and, if so, access to those data.
  • Right to rectification (art. 16): to obtain the correction of inaccurate data or the completion of incomplete data.
  • Right to erasure (art. 17): to obtain the erasure of personal data, in the cases provided for by the GDPR.
  • Right to restriction of processing (art. 18): to obtain restriction of the processing, in the cases provided for.
  • Right to data portability (art. 20): to receive personal data in a structured, commonly used and machine-readable format.
  • Right to object (art. 21): to object to the processing of data on grounds relating to their particular situation.
  • Right to withdraw consent: to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise the rights listed above, the data subject may contact the Data Controller or the Data Protection Officer using the contact details given in points 1 and 2.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) if they consider that the processing of their personal data infringes the GDPR or the applicable legislation (art. 77 GDPR).

11. Whether providing data is mandatory

Providing personal data is optional. However, failure to provide the data marked as mandatory in the forms on the Site makes it impossible to receive a reply to the requests submitted or to use the services offered (for example, newsletter subscription).

12. Automated decision-making

The Controller does not carry out any automated decision-making, including profiling, as referred to in art. 22(1) and (4) of the GDPR.

13. Minors

The Site is not intended for persons under the age of 16. The Controller does not knowingly collect personal data of minors. Should it emerge that data of a minor are being processed without valid consent given by the holder of parental responsibility, the Controller will delete such data as soon as possible.

14. Changes to this notice

The Controller reserves the right to change, update, supplement or delete parts of this notice at its own discretion and at any time, including as a result of changes in the applicable legislation. Changes will be published on the Site and will take effect from the date of publication. Users are therefore invited to consult this page periodically.