This document describes the processing of personal data of users (hereinafter referred to as "Data Subjects") in the context of the use of this/these website/s or app/s (https://www.stafler.com), in accordance with the provisions of Article 13 of Regulation (EU) No 2016/679 (hereinafter referred to as "Regulation") and the relevant legal provisions. The data will be processed following the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, integrity, and confidentiality. What is described in this document does not include cookies and other navigation tracking tools, for which please refer to the cookie policy.
Data Controller
The Data Controller is Stafler, with its registered office at Mauls Nr. 10, Freienfeld bei Sterzing (BZ) - 39040, Tax ID/VAT IT01586550210 (hereinafter referred to as "Data Controller" or "Controller"). Data Subjects may contact the Data Controller or the Data Protection Officer (hereinafter referred to as DPO), if appointed, at the contact details provided in the "Contacts" section.
Purposes of Processing, Legal Basis, Nature of Provision, Consequences of Non-Provision, and Retention Period of Personal Data
The Controller processes the data provided by the Data Subjects for the purposes listed below.
| Purposes of Processing |
Reservation
|
| Description |
The processing of data is necessary to proceed with the requested reservation at our facility. |
| Legal Basis |
Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
|
| Nature of Provision |
Providing the data is necessary for the conclusion of a contract. |
| Consequences of Missing Consent |
Failure to provide the data may result in total or partial inability to respond to the submitted request. |
| Retention Period |
10 years |
| Purposes of Processing |
Purchase product/service
|
| Description |
The processing of data is necessary to purchase the requested product/service. |
| Legal Basis |
Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
|
| Nature of Provision |
Providing the data is necessary for the conclusion of a contract. |
| Consequences of Missing Consent |
Failure to provide the data may result in total or partial inability to proceed with the purchase. |
| Retention Period |
10 years |
| Purposes of Processing |
Insurance
|
| Description |
The processing is necessary for the purchase of insurance for products or services. |
| Legal Basis |
Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
|
| Nature of Provision |
Providing the data is necessary for the conclusion of a contract. |
| Consequences of Missing Consent |
Failure to provide the data may result in total or partial inability to activate the insurance policy. |
| Retention Period |
10 years |
| Purposes of Processing |
Gift voucher
|
| Description |
The processing is necessary for the purchase of the gift voucher. |
| Legal Basis |
Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
|
| Nature of Provision |
Providing the data is necessary for the conclusion of a contract. |
| Consequences of Missing Consent |
Failure to provide the data may result in total or partial inability to issue the gift voucher. |
| Retention Period |
10 years |
| Purposes of Processing |
Live chat
|
| Description |
The processing is necessary to access the live chat with our operators |
| Legal Basis |
Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
|
| Nature of Provision |
Providing the data is necessary to fulfill a contractual obligation. |
| Consequences of Missing Consent |
Failure to provide the data may result in total or partial inability to respond to the submitted request. |
| Retention Period |
1 year |
| Purposes of Processing |
Availability request
|
| Description |
The processing of data is necessary to respond to the availability request for the indicated dates. |
| Legal Basis |
Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
|
| Nature of Provision |
Providing the data is necessary to fulfill a contractual obligation. |
| Consequences of Missing Consent |
Failure to provide the data may result in total or partial inability to respond to the submitted request. |
| Retention Period |
1 year |
| Purposes of Processing |
Loyalty card / Fidelity program / Points collection
|
| Description |
The processing is necessary to join the loyalty program/obtain the loyalty card/access the points collection. |
| Legal Basis |
Consent of the data subject (art. 6 par. 1 lett. a)
|
| Nature of Provision |
The provision of data is optional |
| Consequences of Missing Consent |
N.A. |
| Retention Period |
Until the withdrawal of consent.
|
| Purposes of Processing |
Marketing in general
|
| Description |
The processing is necessary to receive commercial communications in the forms provided by the Data Controller, which may include, for example, emails, SMS, printed materials, etc. |
| Legal Basis |
Consent of the data subject (art. 6 par. 1 lett. a)
|
| Nature of Provision |
The provision of data is optional |
| Consequences of Missing Consent |
Failure to provide the data will only result in the impossibility of receiving commercial communications. |
| Retention Period |
Until the withdrawal of consent or 2 years.
|
| Purposes of Processing |
Purchase of product/service
|
| Description |
The processing of data is necessary to purchase the requested product/service. |
| Legal Basis |
Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
|
| Nature of Provision |
Providing the data is necessary for the conclusion of a contract. |
| Consequences of Missing Consent |
Failure to provide the data may result in the total or partial inability to proceed with the purchase. |
| Retention Period |
10 years |
| Purposes of Processing |
Request or book an appointment
|
| Description |
The processing of data is necessary to make a booking request |
| Legal Basis |
Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
|
| Nature of Provision |
Providing the data is necessary to fulfill a contractual obligation. |
| Consequences of Missing Consent |
Failure to provide the data may result in total or partial inability to respond to the submitted request. |
| Retention Period |
6 months |
| Purposes of Processing |
Statistical analysis
|
| Description |
The processing involves analyzing already obtained data to generate sales statistics, digital channel analysis, or other tools used. The statistics provide an aggregated result that does not allow for the direct identification of individuals. |
| Legal Basis |
|
| Purposes of Processing |
Newsletter
|
| Description |
The processing is necessary to subscribe to the newsletter and to receive commercial communications |
| Legal Basis |
Consent of the data subject (art. 6 par. 1 lett. a)
|
| Nature of Provision |
The provision of data is optional |
| Consequences of Missing Consent |
The failure to provide data will only result in the failure to subscribe and the inability to receive the newsletter |
| Retention Period |
Until the withdrawal of consent.
|
Processing Methods
The processing is carried out through manual and/or automated methods, including the use of IT and telematic technologies (e.g., CRM, management software, and mailing list services), after applying appropriate technical and organizational security measures to ensure the safety, integrity, and confidentiality of personal data, thereby minimizing the risks of destruction, loss, unauthorized access, modification, and unauthorized disclosure.
Any profiling via cookies is carried out only with the user's specific consent: more information is available in the cookie policy and/or the informational banner upon first access. User profiling carried out with tools other than cookies is described in the paragraph referring to the purposes of processing, where applicable.
Transfer of Personal Data outside the EU/EEA
The transfer of personal data to countries outside the European Union is carried out in full compliance with Articles 44 et seq. of Regulation (EU) 2016/679 (GDPR), ensuring the adoption of appropriate legal instruments, such as the existence of an adequacy decision by the European Commission, the signing of standard contractual clauses, or other appropriate safeguards provided for by applicable legislation.
Data Subject Rights
At any time, the Data Subject may access their information and request its rectification, deletion, or integration, restriction of processing, or object to its processing where there are legitimate reasons, as well as data portability to another Data Controller (where applicable). They may also object in whole or in part to the processing and have the right not to be subject to automated decision-making processes concerning natural persons, including profiling. To exercise the rights set out in Articles 15-22 of the GDPR, the Data Subject may contact the Data Controller using the contact details provided in the "Contacts" section. The Data Controller is obliged to respond to the request within 1 month or communicate any delay in response in case of numerous and/or complex requests (the extension cannot exceed 2 months). In any case, the Data Subject always has the right to file a complaint with the competent Supervisory Authority (Data Protection Authority) if they believe that the processing of their personal data is contrary to the current legislation.
Contacts
To exercise the rights provided by the law and for more information about the processing of personal data, you can contact the Data Controller at their office or by email at: info@stafler.com.
