WEBSITE PRIVACY POLICY Following consultation of the website www.amturistic.it, data relating to identified or identifiable persons may be processed. REGULATORY REFERENCES , REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016. DATA CONTROLLER Casper Emotion Srl Via Montichiari 2 20148 20148 Milan VAT No.: 12453850963 PLACE OF DATA PROCESSING Dataprocessing related to the web services of this site takes place at the Data Controller’s operational facilities and is carried out solely by the Data Controller or, in some cases, by other parties involved in the organization of www.amturistic.it or by external parties appointed, if necessary, as Data Processors by the Data Controller. TYPES OF DATA PROCESSED -Browsing Data- The computer systems and software procedures used to operate this website collect, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified individuals, but by its very nature could, through processing and association with data held by third parties, make it possible to identify users. This category of data includes the IP addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.), and other parameters related to the user’s operating system and IT environment. This data is used solely to obtain anonymous statistical information about the use of the website and to verify its proper functioning, and is deleted immediately after processing. The data may be used to determine liability in the event of hypothetical cybercrimes against the website; except in this case, web log data are not currently retained for more than seven days. -Data provided voluntarily by the user- The optional, explicit, and voluntary submission of personal data by the user through the registration forms on this website entails the subsequent collection of the data provided by the user, which is necessary for the provision of the requested service. Specific summary notices will be progressively posted or displayed on the website pages dedicated to particular on-demand services. OPTIONAL NATURE OF DATA PROVISION Except as specified regarding browsing data, the user is free to provide the personal data contained in the request forms or otherwise indicated when contacting the Office to request the sending of informational material or other communications. Failure to provide such data may make it impossible to obtain what has been requested. METHODS OF PROCESSING Personal data is processed using automated tools for the time strictly necessary to achieve the purposes for which it was collected. Specific security measures are in place to prevent data loss, unlawful or improper use, and unauthorized access. Casper Emotion Srl has implemented all the minimum security measures required by law and, guided by leading international standards, has also adopted additional security measures to minimize risks related to the confidentiality, availability, and integrity of the personal data collected and processed. STORAGE PERIODS The data will be retained for the time strictly necessary to fulfill the aforementioned purposes and/or legal obligations, and in any case no longer than necessary to ascertain, exercise, or defend a legal claim, consistent with the statutory limitation periods. Except where users provide personal data via email or by completing forms on the website (in which case, please refer to the specific and detailed information), the collected data will be deleted at the end of the session. At the end of the retention period, the Personal Data will be deleted. Therefore, upon expiration of the retention period, the rights to access, erasure, rectification, and the right to data portability can no longer be exercised. SHARING, DISCLOSURE, AND DISTRIBUTION OF DATA The data collected may be transferred or disclosed for activities strictly related to and necessary for the operation of the service, such as the management of the IT system, or for processing carried out by other companies for the same purposes. The personal data provided by users is used to perform the requested service or provide the requested benefit, as well as for advertising or promotional purposes. Except in these cases, the data will not be disclosed or provided to anyone, unless otherwise provided for in a contract or authorized by the data subjects. In this regard, personal data may be transferred to third parties, but only and exclusively if: 1. there is explicit consent to share the data with third parties; 2. there is a need to share the information with third parties in order to provide the requested service; 3. this is necessary to comply with requests from judicial authorities or public security agencies. No data derived from the web service is disclosed. RIGHTS OF DATA SUBJECTS The individuals to whom the personal data relate have the right at any time to obtain confirmation as to whether or not such data exist and to learn of their content and origin, to verify their accuracy, or to request that they be supplemented or updated, or to have it corrected (Articles 15–22 of the GDPR (EU) 2016/679). Pursuant to the same articles, you have the right to request the erasure, anonymization, or restriction of processing of data processed in violation of the law, as well as to object, in any case and for legitimate reasons, to the processing of your data. For any communication pursuant to Articles 15–22 of the GDPR, data subjects may write to privacy@amturistic.it. CHANGES TO THIS PRIVACY POLICY Casper Emotion Srl periodically reviews its privacy and security policies and, if necessary, revises them in light of regulatory, organizational, or technological changes. If the policies change, the new version will be posted on this page of the website. INFORMATION, EXERCISING YOUR RIGHTS Anyone interested in further information or wishing to exercise their personal rights regarding the company’s privacy policies may write to the Data Controller at privacy@amturistic.it