The Easy Market Spa company (with registered address in Strada Statale Consolare 51/c 47924, Rimini, Italy, Rimini Companies Register, Tax Code and VAT Number 03109340400, Tel: +39 0541 797510, Fax: +39 0541 489908. email: privacy@easymarket.travel PEC: legale@pec.easymarketcrs.it
DATA PROTECTION OFFICER (DPO/RPD)
The Data Protection Officer is Rosario Garcia, email dpo@easymarket.travel, PEC: legale@pec.easymarketcrs.it

Your personal data shall be collected and processed for the following purposes:

1. Fulfilment of legal, regulatory and secondary legislation obligations:
   
   • the legal basis for this data processing is the need to fulfil a legal obligation to which the Data Controller is subject; moreover, the retention period of data processed for this purpose is the duration of the contract and, after the termination thereof, for a further 10 years and, in the case of judicial litigation, for the entire duration of the same, until the terms of practicability of such appeals have been exhausted;
   • the provision of personal data is compulsory as there is a legal obligation to do so, and any refusal will result in the impossibility of fulfilling legal obligations.
2. Management of the tourism service:
   • the legal basis for this data processing is the need to execute a contract to which the Data Subject is party, or to perform any pre-contractual measures adopted at the request of the Data Subject;
   • the retention period of data processed for this purpose is the duration of the contract and, after the termination thereof, for a further 3 years;
   • the provision of personal data is mandatory as there is a contractual obligation and any refusal to provide such data will make it impossible to carry out the existing contractual relationship.
3. Management of the user's "abandoned cart" as a prerequisite to the purchase of the "tourism service":
   • the legal basis for this data processing is the pursuit of the legitimate interests of the Data Controller, reminding the Data Subject of the status of their "shopping cart", by sending an electronic communication (email, etc.);
   • the retention period of data processed for this purpose is 5 days;
   • the provision of personal data is optional; moreover, the eventual refusal shall make it impossible for pre-contractual relationships to take place.
4. Sending information and promotional materials pertaining to the activities carried out by the Data Controller (newsletters, offers, etc.) concerning products and services similar to services already rendered in the past, surveys and analysis of customer satisfaction,..:
   • the legal basis for this data processing is the pursuit of the legitimate interests of the Data Controller, where the Data Subject is party to a contract;
   • data processed for this purpose shall be retained until the Data Subject wishes to unsubscribe from using the promotional communication/newsletters service.
5. Sending information and promotional materials pertaining to the activities carried out by the Data Controller (newsletters, offers, etc.), research and market analysis, including in anonymous form:
   • the legal basis for this data processing is the express consent of the Data Subject;
   • data processed for this purpose shall be retained until the Data Subject wishes to unsubscribe from using the promotional communication/newsletters service.
6. Registration and processing of personal data for profiling purposes and sending of personalised promotional communications, based on the tastes and interests of the data subject during his/her experience on the lol.travel website:
   • the legal basis for this processing is the consent expressed by the data subject;
   • the storage period of the data processed for this purpose is until the data subject revokes his/her consent to the profiling.
7. Service, optional and subject to payment, of sending communications via SMS for confirmation of booking:
   • the legal basis for this processing is the consent given by the data subject;
   • the storage period of data processed for this purpose is until the conclusion of the purchased tourist service.

Personal data processing shall mean any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data such as the collection, storing, organisation, structuring, retention, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other means of making the data available, comparison or interconnection, limitation, deletion or destruction. Data which, pursuant to Article 9 of the GDPR, may fall under the definition of 'special categories of personal data' may also be requested, i.e. data that reveals the racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, data concerning health or sex life or sexual orientation of the person. These categories of data shall only be processed by the Data Controller subject to prior consent.

The personal data processed is as follows:
Data required for the use of the platform
When the user registers on the reserved area of the website, the Data Controller shall process the following personal data:
- personal information [first name, last name, email address, date of birth, place of birth, nationality, tax code number, gender, land line phone, mobile phone, domicile, residence, details of the user's photo ID, credit/debit card]
- information on social media accounts [Facebook, Google]
- special data categories (sensitive) [disabilities, diseases, religion]

Data necessary for subscription to the newsletter
Personal data processed for subscribing to the newsletter, directly or through the use of the user's Facebook profile, is as follows: First Name, Last Name, Email.

Navigation data
Information systems and software procedures operating this website acquire, during normal operations, some personal data whose transmission is implicit when using Internet communication protocols. This data category includes IP addresses or the domain names of computers and terminals used by users, URI/URL addresses (Uniform Resource Identifier/Locator) of resources requested, time of the request, method used to submit the request to the server, size of file obtained in response, the numerical code indicating response status given by the server (successful, error, etc.) and other parameters related to the user's operating system and computer environment. Such data, necessary for the use of the web services, is also processed in order to:
- obtain statistical information on the usage of the services (most visited pages, hourly or daily visitors, geographical areas of origin, etc.);
- verifying the correct operation of the services offered.

Navigation data shall not be retained for more than 365 days and is deleted immediately after the aggregation of such data (except where needed by judicial authorities to investigate any eventual offences).

Data provided by the user
The optional, explicit and voluntary sending of messages to the website's contact details involve the acquisition of the sender's contact data, necessary to respond to their request, as well as of all personal data included in the communications. The user is entitled to register on the portal to take advantage of specific services offered by the Data Controller in the reserved area of the website.



Cookies and other tracking systems
Please refer to the detailed information available at the following link: https://www.lol.travel/it/cookie

Data required to use the sms service
Activation of the SMS service, which is optional and can be activated only and exclusively at the request of the user and is aimed at receiving information relating to their booking through this channel, entails the acquisition of the sender's contact details, including the mobile phone number, necessary for replying, as well as all the personal data included in the communication. The user has the option of registering on the portal to take advantage of the services offered by the Data Controller in the reserved area. The service is activated upon payment and at the request of the user only and limited to the individual booking for which the activation of the service is requested in the purchase phase of the tourist service.

Persons under 18 years of age are not permitted to provide any personal data. The Data Controller shall not be liable in any way for the collection of personal data, as well as any false statements, provided by persons under 18 years of age, and, in any case, where deemed necessary, the Data Controller shall make use of the right of access and deletion provided by the legal guardian or person exercising their parental rights.

Your personal data may be shared for the above mentioned purposes, with: subjects that typically act as Data Processors, i.e. individuals, companies or professionals who provide assistance and consulting services to the Data Controller on accounting, administrative, legal, tax, financial and debt collection matters, in relation to the supply of services; parties with whom it is necessary to interact for the provision of services; subjects, bodies or authorities to whom it is mandatory to communicate your personal data pursuant to applicable legal provisions or orders from the authorities; personnel expressly authorised by the Data Controller, necessary to carry out activities strictly related to the provision of services, who have committed to the privacy and confidentiality of the data or have an appropriate legal obligation of confidentiality and who have received adequate instructions to carry out such tasks; The full list of Data Processors is available by sending a written request to the Data Controller.

Some of your personal data is shared with recipients who may be located outside the European Union. The Data Controller ensures that the processing of personal data by such recipients shall take place in compliance with the GDPR. The transfers of data may be based on a decision of adequacy or on the Standard Contractual Clauses approved by the European Commission. Additional information is available from the Data Controller.

The Data Controller, for the purpose of the conclusion or the execution of the contract, adopts an automated decision-making process pertaining to the processing of personal data, including profiling, referred to in Article 22 of the GDPR and aimed at customising the price list based on the customer's origin.

The Data Subjects are entitled to request from the Data Controller, in the appropriate cases, access to their personal data and correction or deletion thereof or restriction of the processing or to object to the processing of their data (Articles 15 et seq. of the GDPR). The relative application to the Data Controller can be submitted using the email address made available to the Data Subject.

The Data Subjects are entitled to request from the Data Controller, in the appropriate cases, access to their personal data and correction or deletion thereof or restriction of the processing or to object to the processing of their data (Articles 15 et seq. of the GDPR). The relative application to the Data Controller can be submitted using the email address made available to the Data Subject.

The data subjects that deem that the processing of their personal data has breached the provisions of the GDPR, have the right to file a claim to the Data Protection Authority (https://www.garanteprivacy.it), as set forth by art. 77 of the GDPR, or to file a claim before the judicial authority (art. 79 of the GDPR).Requests can be addressed to the Data Controller or to the our Data Protection Officer: dpo@easymarket.travel

The Data Controller reserves the right to change this Privacy Policy Statement at any time. The current version is published at the following link: https://www.lol.travel/it/privacy-and-cookie-policy