Sintur s.a.s is the company appointed by the Municipality of San Gavino Monreale for the activation of the DMS platform and the website integration within the context of the Project “VISIT SAN GAVINO MONREALE” P.S.R. SARDINIA 2014-2022. TYPE OF INTERVENTION 19.2.1.7.5.1.1.10 Execution of hiking itineraries of San Gavino Monreale

Sintur sas, with registered office in Capoterra (CA) and operational headquarters in Cagliari (CA) via Piovella, 31, Fiscal Code and VAT number 02750140929 (hereinafter, “Data Controller”), as data controller, hereby informs you pursuant to art. 13 of Legislative Decree 30.6.2003 n. 196 (hereinafter, “Privacy Code”) and art. 13 of EU Regulation n. 2016/679 (hereinafter, “GDPR”) that your data will be processed in the following ways and for the following purposes:

1. Object of the Processing
The Data Controller processes personal, identifying data (for example, name, surname, company name, address, telephone, e-mail, bank and payment references) – hereinafter, “personal data” or also “data” – communicated by you upon the conclusion of contracts for the services that the Data Controller offers on its own behalf and on behalf of third-party companies. According to the specified regulations, such processing will be based on the principles of correctness, lawfulness, transparency, and the protection of your privacy and your rights.

2. Purposes of the Processing
Your personal data are necessary for purposes strictly connected and instrumental to the management of commercial relations, for administrative and accounting purposes, and for purposes related to legal obligations.
In particular, we inform you that your personal data are processed:
A) Without your express consent and if directly provided by you (art. 24 lett. a), b), Privacy Code and art. 6 lett. b), e) GDPR), for the following Service Purposes:
Conclude contracts for the services of the Data Controller or of companies for which the Data Controller is an authorized intermediary.
Fulfill pre-contractual, contractual, and tax obligations deriving from existing relationships with you.
Fulfill the obligations established by law, by a regulation, by community legislation, or by an order of the Authority (such as, for example, in anti-money laundering matters).
Exercise the rights of the Data Controller, for example the right of defense in court.

B) Only subject to your specific and distinct consent (articles 23 and 130 of the Privacy Code and art. 7 of the GDPR), for the following Marketing Purposes:
Send you via e-mail, mail, and/or SMS and/or telephone contacts, newsletters, commercial communications, and/or advertising material on products or services offered by the Data Controller and detect the degree of satisfaction with the quality of services.
Send you via e-mail, mail, and/or SMS and/or telephone contacts commercial and/or promotional communications of third parties (for example, business partners).

We point out that if you are already our customer, we may send you commercial communications relating to services and products of the Data Controller similar to those you have already used, unless you object (art. 130 paragraph 4 of the Privacy Code).
In any case, if the data are provided via the web, we will ask for your consent by means of a flag/click which will confirm both the reading of this privacy policy and the processing.

3. Methods of Processing
The processing of your personal data is carried out by means of the operations indicated in art. 4 of the Privacy Code and art. 4 n. 2) GDPR and precisely: collection, recording, organization, storage, consultation, adaptation, alteration, selection, extraction, comparison, use, interconnection, restriction, communication, erasure, and destruction of data. Your personal data are subjected to both paper and electronic and/or automated processing.

The Data Controller will process personal data for the time necessary to fulfill the aforementioned purposes and in any case for no longer than 10 years from the termination of the relationship for Service Purposes and for no longer than 2 years from data collection for Marketing Purposes.

4. Access to Data
Your data may be made accessible for the purposes referred to in art. 2.A) and 2.B):
To employees and collaborators of the Data Controller in Italy and abroad, in their capacity as persons in charge and/or internal data processors and/or system administrators.
To third-party companies or other subjects (by way of indication, credit institutions, professional firms, consultants, mailing companies, etc.) that perform outsourcing activities on behalf of the Data Controller, in their capacity as external data processors.

5. Communication of Data
Without the need for express consent (ex art. 24 lett a), b), d) Privacy Code and art.6 lett. b) e c) GDPR), the Data Controller may communicate your data for the purposes referred to in art. 2.a) a to Judicial Authorities, as well as to those subjects to whom communication is mandatory by law for the fulfillment of the said purposes. Said subjects will process the data in their capacity as autonomous data controllers.
Your data will not be disseminated.

6. Data Transfer
Personal data are stored on servers located within the European Union. In any case, it remains understood that the Data Controller, should it become necessary, will have the right to move the servers also outside the EU. In this case, the Data Controller ensures from now on that the transfer of data outside the EU will take place in accordance with the applicable legal provisions, subject to the stipulation of the standard contractual clauses provided by the European Commission.

7. Nature of Data Provision and Consequences of Refusal to Respond
The provision of data for the purposes referred to in art. 2.A) is mandatory. In their absence, we will not be able to guarantee you the Services of art. 2.A).
The provision of data for the purposes referred to in art. 2.B) is instead optional. You can therefore decide not to provide any data or to subsequently deny the possibility of processing data already provided: in this case, you will not be able to receive newsletters, commercial communications, and advertising material relating to the Services offered by the Data Controller. You will however continue to be entitled to the Services referred to in art. 2.A).

8. Rights of the Data Subject
In your capacity as a data subject, you have the rights referred to in art. 7 of the Privacy Code and art. 15 of the GDPR and precisely the rights to:
Obtain confirmation of the existence or not of personal data concerning you, even if not yet registered, and their communication in an intelligible form.
Obtain indication of: a) the origin of the personal data; b) the purposes and methods of the processing; c) the logic applied in case of processing carried out with the aid of electronic instruments; d) the identification details of the controller, processors, and designated representative pursuant to art. 5, paragraph 2 of the Privacy Code and art. 3, paragraph 1, GDPR; e) the subjects or categories of subjects to whom the personal data may be communicated or who may come to know them as designated representative in the territory of the State, processors, or persons in charge.

3. Obtain: a) the updating, rectification or, when interested, integration of data; b) the erasure, transformation into anonymous form, or blocking of data processed in violation of the law, including those whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed; c) certification that the operations referred to in letters a) e b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case where this fulfillment proves impossible or involves a use of means manifestly disproportionate to the protected right.
4. Object, in whole or in part: a) for legitimate reasons, to the processing of personal data concerning you, even if pertinent to the purpose of the collection; b) to the processing of personal data concerning you for the purpose of sending advertising material or direct selling or for carrying out market research or commercial communication, through the use of automated calling systems without the intervention of an operator, by e-mail and/or through traditional marketing methods by telephone and/or paper mail. Please note that the data subject’s right to object, as set out in point b) above, for direct marketing purposes through automated methods extends to traditional ones, and that in any case, the data subject retains the right to exercise their right to object even only in part. Therefore, the data subject can decide to receive communications only through traditional methods, or only through automated communications, or neither of the two types of communication.
Where applicable, the data subject also has the rights pursuant to articles 16-21 of the GDPR (Right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Supervisory Authority (Garante).

9. Methods for Exercising Rights
You may exercise your rights at any time by sending:
A registered letter with acknowledgement of receipt (raccomandata a.r.) to Sintur sas, via Piovella 31, Cagliari;
An e-mail to the address info@sintur.com.

10. Data Controller, Data Processor, and Persons in Charge of Processing
The Data Controller and internal Data Processor is Sintur sas, with operational headquarters in Via Piovella n. 31, Cagliari, in the person of its legal representative pro tempore.
The updated list of external data processors, where appointed, and of the persons in charge of processing is kept at the headquarters of the Data Controller.