Privacy & Policy

Privacy Policy - Information

In accordance with the obligations arising from national legislation (Legislative Decree No. 196 of June 30, 2003, Personal Data Protection Code) and EU legislation (European Regulation for the protection of personal data No. 679/2016, GDPR) and subsequent amendments, this page describes how the website www.campingpuntala.it (hereinafter also referred to as the "Website") is managed with regard to the processing of personal data of users who consult it. The information is also provided for the sub-levels (third-level sites of the same domain) of the Site, booking.campingpuntala.it and loyalty.campingpuntala.it (hereinafter also referred to as the "Site") consulted by the user via links.

This information is provided to those who interact with the web services accessible electronically from the address www.campingpuntala.it, also pursuant to Articles 13 and 14 of EU Regulation 2016/679 (European Regulation for the protection of personal data) for the protection of personal data.

This policy concerns all personal data collected and processed by Campeggio Puntala S.r.l., Tax ID 00225550532, VAT number 01233070539, with registered office in 58043 Punta Ala, Castiglione della Pescaia, Grosseto, Italy (hereinafter "Campsite" or "Company") through the Website, with the exception of Cookies. With regard to cookies, please refer to the specific extended information at the link (Cookie Policy) in accordance with EU Regulation 2016/679.

By visiting the Website, you implicitly accept the practices described in this Privacy Policy.

Browsing data

The computer systems and software procedures used to operate the Website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes IP addresses or domain names of computers used by users connecting to the Site, URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.) etc.) and other parameters relating to the user's operating system and IT environment.

This data is used for the sole purpose of obtaining anonymous statistical information on the use of the Site and to check its correct functioning, and is deleted immediately after processing.

The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the Site.

Data provided voluntarily

The Data Controller processes personal identification data (e.g., name, surname, company name, address, telephone numbers, e-mail, bank and payment details) that you provide when concluding contracts for the Data Controller's services, subscribing to the newsletter and/or service - via WhatsApp - instant messaging for customer support, information requests and marketing, joining the Data Controller's Puntala + loyalty program, present on the Site.

The optional, explicit, and voluntary sending of emails to the addresses indicated on this Website entails the subsequent acquisition of the sender's address, which is necessary to respond to requests, as well as any other data included in the message.

Purpose of data processing, communication, and access to data

The personal data you provide will be processed in compliance with the conditions of lawfulness pursuant to Art. 6 of EU Reg. 2016/679:

1. without your express consent (Article 24(a), (b), (c) of the Privacy Code and subsequent amendments (provisions for the adaptation of national legislation to the provisions of EU Regulation 2016/679) and Article 6(b), (e) of the GDPR), for the following Service Purposes:

a) to carry out the technical administration of the Website;

b) performing the service or provision requested, concluding contracts for the services of the Data Controller;

c) to fulfill pre-contractual, contractual, and tax obligations arising from existing relationships with you;

d) to fulfill obligations under the law, regulations, EU legislation, or an order from the Authority (such as anti-money laundering);

e) exercise the rights of the Data Controller, such as the right to defense in court;

For the above purposes, your data may be disclosed to the judicial authorities and to those subjects to whom disclosure is mandatory by law for the fulfillment of the aforementioned purposes. These subjects will process the data in their capacity as independent data controllers. Your data will not be disclosed. Guests' credit card details are processed through the Mews PMS hospitality management system exclusively to guarantee the reservation, manage any penalties, allow the issuance of any refunds or discounts, and allow legitimate charges for damages or additional expenses incurred after departure.

2. without your express prior consent, as required by Article 130, paragraph IV, of the Privacy Code and subsequent amendments (provisions for the adaptation of national legislation to the provisions of EU Regulation 2016/679), for the following Marketing Purposes:

f) to process the e-mail coordinates (i.e., the e-mail address) you provided in the context of purchasing a product and/or service offered and sold on the Site directly by the Campsite, to allow the Campsite to sell similar products or services directly (and therefore to send promotional communications by e-mail to the user with such products and/or services as the subject ), provided that you do not exercise your right to object in the manner indicated below (so-called soft spam).

You may object to receiving soft-spam communications:

• by contacting Campeggio Puntala S.r.l. at the following addresses: thomas.daddi@campingpuntala.it;

• via the specific link in every promotional communication sent by Campeggio Puntala S.r.l.

For the above purposes, your data will not be disclosed to third parties, except in the case of legal obligations or requests from the judicial authorities, nor will it be disseminated.

3. only with your specific and distinct consent (Articles 23 and 130 of the Privacy Code and subsequent amendments (provisions for the adaptation of national legislation to the provisions of EU Regulation 2016/679) and Article 7 of the GDPR), for the following Marketing Purposes:

g) to send you - using automated contact methods (e.g., email, and/or text message, and/or instant messaging via WhatsApp and traditional methods via telephone contact with an operator) - newsletters, commercial communications, and/or advertising material on products or services offered by the Data Controller, including those other than those for the provision of which the data was collected, and to survey your level of satisfaction with the quality of services;

h) send you (via email, post, and/or text message, and/or instant messaging, and/or telephone contact) newsletters, commercial and/or promotional communications from third parties (e.g., business partners);

i) communicate your personal data to third parties for promotional purposes exclusively for products or services offered by Campeggio Puntala S.r.l.;

l) carry out prize promotions and customer loyalty programs.

For the above purposes, your data will not be disclosed to third parties other than those to whom your data is disclosed pursuant to letter i), except for any legal obligations or requests from the Judicial Authorities, nor will it be disseminated.

4. only with your specific and distinct consent (Articles 23 and 130 of the Privacy Code and subsequent amendments (provisions for the adaptation of national legislation to the provisions of EU Regulation 2016/679) and Article 7 of the GDPR), for the following Marketing Purposes:

m) the communication of your personal data for their promotional purposes to the companies CENTRO VELICO PUNTA ALA A.S.D. (VAT No. - Tax Code 01356920536) with registered office in Punta Ala - c/o PuntAla Camp & Resort Loc. Punta Ala – 58043 Castiglione della Pescaia (GR), PUNTA ALA TRAIL CENTER A.S.D. (VAT No. – Tax Code 01647880531) with headquarters in Punta Ala – c/o Campeggio Puntala – 58043 Castiglione della Pescaia (GR) , PUNTA ALA SUP EXPERIENCE A.S.D. (VAT No. - C.F. 01708190531) with headquarters in Punta Ala - c/o PuntAla Camp & Resort Loc. Punta Ala – 58043 Castiglione della Pescaia (GR) and PUNTALA AMBIENTE S.R.L. (P.I. – Tax Code 01415020534) with registered office in Via Zanardelli, 1 – Grosseto (GR), GYMTRAINER S.R.L. (VAT No. – Tax Code 04643350236) with registered office in San Martino Buon Albergo, Via XX Settembre 32/a, 37036 -Verona (VR), LOGITAL S.R.L (VAT/Tax ID 03947730374) with registered office in Via Palazzetti 5/F, 4006 San Lazzaro Di Savena (BO), and possibly to suppliers of additional services located in the area where our facility is also located, whose details we will provide.

For the above purposes, your data will not be disclosed to third parties other than those listed above in letter m), except for any legal obligations or requests from the Judicial Authority, nor will it be disseminated.

5. Only with your specific and distinct consent (Articles 23 and 130 of the Privacy Code and subsequent amendments (provisions for the adaptation of national legislation to the provisions of EU Regulation 2016/679) and Article 7 of the GDPR), for the following Profiling Purposes: n) to process your personal data using automated and non-automated tools, with the aim of analyzing your preferences, consumption habits, behavior, and interests, in order to improve the services offered, personalize commercial communications, and propose targeted promotional initiatives. For the aforementioned purposes, your data will not be communicated to third parties, except for any legal obligations or requests from the Judicial Authority, nor will it be disclosed.

Your data may be made accessible for the purposes referred to in points 1, 2, 3, 4, and 5:

– to employees and collaborators of the Data Controller or of partner companies and/or entities in Italy and abroad, in their capacity as persons in charge and/or internal data processors and/or system administrators;

– to third-party companies or other entities (for example, credit institutions, professional firms, consultants, insurance companies for the provision of insurance services, etc.) that perform outsourced activities on behalf of the Data Controller, in their capacity as external data processors, and specifically to persons/companies that perform services connected and instrumental to the execution of the purposes indicated above.

Transfer of data to countries outside the EU

Your personal data will be processed by the Data Controller within the European Union. If, for technical and/or operational reasons, it is necessary to use entities located outside the European Union, or if it is necessary to transfer some of the data collected to technical systems and services managed in the cloud and located outside the European Union, the processing will be regulated in accordance with the provisions of Chapter V of the Regulation and authorized on the basis of specific decisions of the European Union. All necessary precautions will therefore be taken to ensure the complete protection of personal data, basing such transfer on: a) adequacy decisions of the recipient third countries expressed by the European Commission; b) adequate safeguards expressed by the recipient third party pursuant to Article 46 of the Regulation; c) the adoption of binding corporate rules, known as Corporate Binding Rules.

Legal basis for data processing

The provision of data for the purposes referred to in point 1 above is mandatory. Without such data, we will not be able to guarantee the Services referred to in point 1. The legal basis for the processing of such data is the performance of a contract to which you are party, the legitimate interest of the data controller in managing any post-stay disputes, or the need to comply with legal obligations.

The legal basis for data processing for the purposes referred to in point 2 above is Article 130, paragraph IV, of the Privacy Code and subsequent amendments (provisions for the adaptation of national legislation to the provisions of EU Regulation 2016/679), which expressly allows the processing in question.

The provision of data for the purposes referred to in points 3, 4, and 5 above is optional. You may therefore decide not to provide any data or subsequently deny the possibility of processing data already provided: in this case, you will not be able to receive newsletters, commercial communications, and advertising material relating to the Services offered by the Data Controller. However, you will continue to be entitled to the Services referred to in point 1. The legal basis for the processing of such data is consent (optional and revocable at any time).

The Website processes some of the data based on the legitimate interests of the Data Controller.

Methods of processing

The data in question will be processed:

- on paper and electronic media of any kind;

- by authorized persons, who are constantly identified, appropriately trained, and made aware of the constraints imposed by current laws;

- for the time strictly necessary to achieve the purposes for which they were collected;

- with a commitment to keep the data up to date, eliminating obsolete, unnecessary, or irrelevant data;

- with a commitment to adopt the organizational and security measures required by law, designed to ensure the confidentiality of the data subject and to prevent unauthorized access by third parties or unauthorized persons.

For credit card data, all transactions are handled through PCI DSS-certified payment gateways; the Mews PMS hospitality management system uses cryptographic tokens and does not store complete card numbers in any way.

Duration of processing

The personal data collected will be stored, in accordance with the provisions of Article 5, paragraph 1, letter e) of EU Regulation 2016/679, in a form that allows the identification of the data subjects for a period of time not exceeding the achievement of the purposes for which the personal data are processed and in any case for no longer than 10 years from the termination of the relationship for the Service Purposes.

Credit card details, stored in tokenized form through the Mews PMS hospitality management system, are retained for a maximum period of 30 (thirty) days from the date of check-out or cancellation of the reservation. The 30-day period allows us to securely manage any refund requests or disputes within the average accounting and banking closing times, fulfill tax and reporting obligations, and comply with the principle of minimization provided for by the GDPR.

After this period, the data is automatically deleted from the system or made permanently anonymous/unusable.

Personal data processed for Marketing Purposes will be retained for a maximum period of 24 months from the date of consent, or until such consent is revoked by the data subject, whichever is earlier.

Personal data processed for Profiling Purposes will be retained for a maximum period of 12 months from the collection of consent, or until such consent is revoked by the data subject, if earlier.

After this period, the data will be deleted or anonymized irreversibly, except for the processing of any data necessary to fulfill contractual, accounting, or legal obligations, which will be stored for the period required by the relevant legislation (e.g., up to 10 years).

The data subject has the right to withdraw consent at any time, without prejudice to the lawfulness of the processing carried out prior to withdrawal.

Data controller, data processors, and data protection officer

The data controller is Campeggio PuntAla S.r.l., tax code 00225550532, VAT number 01233070539, with registered office in 58043 Punta Ala, Castiglione della Pescaia, Grosseto, Italy, tel. +390564922254, e-mail:thomas.daddi@campingpuntala.it . The persons in charge of data processing are the employees and/or collaborators of CAMPEGGIO PUNTALA s.r.l. The data may be processed by employees and/or collaborators of the company departments responsible for pursuing the above-mentioned purposes, who have been expressly authorized to process the data and who have received adequate operating instructions.

MEWS SYSTEMS BV (VAT No. NL856548327B01) with registered office in Wibautstraat 137 D – Amsterdam, LOYCO, with registered office in Oevre Ole Bulls Plass 1, 5012 Bergen-Norway, and LOGITAL S.R.L (P.I/C.F. 03947730374) with registered office in Via Palazzetti 5/F, 4006 San Lazzaro Di Savena (BO), are Data Processors, processing personal data on behalf of the Data Controller. The updated list of data processors and persons in charge of processing is kept at the registered office of the Data Controller.

The rights of the data subject

Pursuant to European Regulation 679/2016 (GDPR) and national legislation, the User may, in accordance with the procedures and within the limits established by current legislation, exercise the following rights:

- request confirmation of the existence of personal data concerning him/her (right of access);

- know its origin;

- receive intelligible communication of the data;

- obtain information about the logic, methods, and purposes of the processing;

- request the updating, rectification, integration, erasure, anonymization, or blocking of data processed in violation of the law, including data no longer necessary for the purposes for which it was collected;

- in cases of processing based on consent, receive, at the sole cost of any support, your data provided to the data controller, in a structured and readable form by a data processor and in a format commonly used by an electronic device, without prejudice to paragraphs 3 and 4 of Article 20 of EU Regulation 2016/679;

- if you believe that the processing of data concerning you violates the provisions of EU Reg. 2016/679, pursuant to Article 15(f) of the aforementioned EU Reg. 2016/679, the right to lodge a complaint with the Data Protection Authority and, with reference to Article 6(1)(a) and Article 9(2)(a), the right to withdraw consent at any time;

- if the data are processed on the basis of legitimate interests, the rights of the data subjects are in any case guaranteed (except for the right to portability, which is not provided for by the regulations), in particular the right to object, in whole or in part, to the processing, which may be exercised by sending a request to the data controller;

- the right of the data subject to object to the processing of their personal data for marketing purposes, carried out through automated means of contact, extends to traditional means of contact and, in any case, does not affect the possibility for the data subject to exercise this right even partially, for example by objecting only to the sending of promotional communications carried out through automated means;

- as well as, more generally, exercising all rights granted to them by current legal provisions.

The User may exercise their rights as expressed in Articles 15, 16, 17, 18, 19, 20, 21, and 22 of EU Regulation 2016/679 by contacting the Data Controller with a request to be sent to Campeggio Puntala S.r.l., with registered office in 58043 Punta Ala, Castiglione della Pescaia, Grosseto, Italy, tel. +390564922254, e-mail: thomas.daddi@campingpuntala.it, also by e-mail or telephone, with the right to obtain confirmation of the processing of the request upon its completion.