This document describes the processing of personal data of users (hereinafter referred to as "Data Subjects") in the context of the use of this/these website/s or app/s (https://oggi00hne.com), in accordance with the provisions of Article 13 of Regulation (EU) No 2016/679 (hereinafter referred to as "Regulation") and the relevant legal provisions. The data will be processed following the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, integrity, and confidentiality. What is described in this document does not include cookies and other navigation tracking tools, for which please refer to the cookie policy.

Data Controller

The Data Controller is Tourismusverein Schenna, with its registered office at Erzherzog Johann Platz 1/D, Tourismusverein Schenna (BZ) - 39017, Tax ID/VAT IT01516780218 (hereinafter referred to as "Data Controller" or "Controller"). Data Subjects may contact the Data Controller or the Data Protection Officer (hereinafter referred to as DPO), if appointed, at the contact details provided in the "Contacts" section.

Purposes of Processing, Legal Basis, Nature of Provision, Consequences of Non-Provision, and Retention Period of Personal Data

The Controller processes the data provided by the Data Subjects for the purposes listed below.

Purposes of Processing	Purchase product/service
Description	The processing of data is necessary to purchase the requested product/service.
Legal Basis	Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
Nature of Provision	Providing the data is necessary for the conclusion of a contract.
Consequences of Missing Consent	Failure to provide the data may result in total or partial inability to proceed with the purchase.
Retention Period	10 years

Purposes of Processing	Participation in training-promotional events
Description	The processing of data is necessary to participate in the organized event
Legal Basis	Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
Nature of Provision	The provision of data is necessary to fulfill a contractual obligation
Consequences of Missing Consent	Failure to provide the data may result in the total or partial impossibility of proceeding with the registration.
Retention Period	2 years or 10 years in case of accounting and tax obligations.

Processing Methods

The processing is carried out through manual and/or automated methods, including the use of IT and telematic technologies (e.g., CRM, management software, and mailing list services), after applying appropriate technical and organizational security measures to ensure the safety, integrity, and confidentiality of personal data, thereby minimizing the risks of destruction, loss, unauthorized access, modification, and unauthorized disclosure.

Any profiling via cookies is carried out only with the user's specific consent: more information is available in the cookie policy and/or the informational banner upon first access. User profiling carried out with tools other than cookies is described in the paragraph referring to the purposes of processing, where applicable.

Transfer of Personal Data outside the EU/EEA

Third Country Transfer: The Data Controller does not intend to transfer Personal Data outside the European Economic Area. However, if necessary, due to organizational/production needs (for example, using providers and/or cloud services that involve data transfer abroad), appropriate safeguards will be identified for the transfer of Personal Data to a Third Country, which may include verifying the existence of European Commission adequacy decisions, signing standard contractual clauses and/or binding corporate rules, and checking for the adoption of any supplementary measures as recommended by the EDPB Recommendation 01/2020.

Data Subject Rights

At any time, the Data Subject may access their information and request its rectification, deletion, or integration, restriction of processing, or object to its processing where there are legitimate reasons, as well as data portability to another Data Controller (where applicable). They may also object in whole or in part to the processing and have the right not to be subject to automated decision-making processes concerning natural persons, including profiling. To exercise the rights set out in Articles 15-22 of the GDPR, the Data Subject may contact the Data Controller using the contact details provided in the "Contacts" section. The Data Controller is obliged to respond to the request within 1 month or communicate any delay in response in case of numerous and/or complex requests (the extension cannot exceed 2 months). In any case, the Data Subject always has the right to file a complaint with the competent Supervisory Authority (Data Protection Authority) if they believe that the processing of their personal data is contrary to the current legislation.

Contacts