Privacy Policy
Published on 12/08/2025
Ahrntal, with registered office in Ahrner Str.22, Luttach (BZ) - 39030, Tax ID IT00506410216, (hereinafter "Data Controller" or "Controller") is constantly committed to protecting the online privacy of natural persons during the browsing and enjoyment of services on the website https://www.ahrntal.com (hereinafter "Portal" or "Website").
This document describes all aspects related to the processing of Personal Data of users (hereinafter "Data Subjects") carried out through the Website, in compliance with the provisions of Art. 13 of Regulation (EU) no. 2016/679 (hereinafter "Regulation"). According to the rules of the Regulation, the processing carried out by the Controller through the Website shall be based on the principles of lawfulness, fairness, transparency, purpose limitation and storage limitation, data minimization, accuracy, integrity and confidentiality.
1. Data Controller
The Data Controller for the processing carried out through the Portal is Ahrntal as defined above and can be contacted through the methods indicated in the "Contacts" section (see Art. 10).
2. Categories of Personal Data Processed
Navigation/usage data:
Information collected during the user's visit to the Website (e.g., IP address, URI notation addresses, browsing history, information related to interactions with the site, information related to the user's computing environment, browser type and language, operating system, location, date and time of the request). These are pieces of information that are not collected to be associated with identified data subjects, but which by their very nature could, through processing and association with data held by third parties, allow users to be identified;
Data voluntarily communicated by the user:
Personal information voluntarily released by the user through special forms on the Website (e.g., subscription/registration, contact, comments, reviews, posts, etc.). This information may include, by way of example: identifying data (name, surname, Tax ID, username, user ID, password, place and date of birth, etc.), personal image, contact and location data (residential/domicile address, email address, telephone number and postal address, etc.);
Commercial data:
Information necessary for the performance of economic and tax obligations related to the provision of Website services (e.g., payment information, Tax ID, purchase history, product or service usage information, credit and billing information, support requests, etc.);
Sensitive data:
So-called "special categories of personal data" as provided for in Art. 9 of the Regulation, namely personal information capable of revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data intended to uniquely identify a natural person, data concerning health or sex life or sexual orientation of the person.
Location or position data (or mobility):
Information indicating the geographic position (latitude, longitude, altitude, direction of travel, time of position recording) of a user's terminal equipment (e.g., smartphone, pc) of the Website service.
3. Processing Purposes
The Controller uses Personal Data collected through this Website for the following purposes:
Contract execution:
Processing of personal data in order to execute contracts of which the user is a party (e.g., service provision contracts, product sales, registrations, subscriptions, participation in interactive services and similar). This purpose concerns the processing of data necessary to maintain the contractual relationship with the user, provide the services offered by the Website and fulfill the obligations arising from it;
Compliance with legal obligations:
Processing of personal data for compliance with legal obligations to which the Controller is subject (e.g., tax obligations, workplace safety regulations, document retention regulations, anti-money laundering regulations, civil liability, data protection regulations, etc.);
Fulfillment of legal obligations:
Processing of personal data where this is necessary to fulfill the legal obligations mentioned above;
Security and fraud protection:
Processing of personal data in order to protect the security of data, information systems and the technological platform of the Controller, as well as to prevent, detect and combat fraudulent activities, abuse, cyber attacks and all other illegal activities;
Contact with the data subject:
Processing of personal data in order to contact the user through various communication channels (e.g., email, telephone, SMS, WhatsApp) for various purposes such as: request for feedback, customer satisfaction surveys, service communications, account updates, technical assistance, etc.;
4. Legal Basis of Processing
The processing of Personal Data is lawful by virtue of the following legal bases, as provided for in Art. 6 of the Regulation:
Contract execution:
Art. 6(1)(b) of the Regulation – The data are necessary to execute a contract to which the data subject is a party;
Compliance with legal obligations:
Art. 6(1)(c) of the Regulation – Processing is necessary to comply with a legal obligation to which the Controller is subject;
Legitimate interests:
Art. 6(1)(f) of the Regulation – Processing is necessary for the pursuit of legitimate interests of the Controller;
Protection of vital interests:
Art. 6(1)(d) of the Regulation – Processing is necessary to protect the vital interests of the data subject or of another natural person;
Performance of tasks in the public interest:
Art. 6(1)(e) of the Regulation – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
Consent:
Art. 6(1)(a) of the Regulation – The data subject has given consent to the processing of their personal data;
5. Processing Methods
Processing is carried out through manual and/or automatic methods, including through the use of information and computer technologies (e.g., CRM, management software and mailing list services), subject to the application of appropriate technical and organizational security measures to ensure the security, integrity and confidentiality of Personal Data, so as to minimize the risks of destruction, loss, unauthorized access, modification and unauthorized disclosure, in accordance with Articles 6 and 32 of the GDPR.
6. Transfer of Personal Data outside the EU/EEA
The Controller does not intend to transfer Personal Data outside the European Economic Area. However, should it become necessary to meet organizational/production needs (by way of non-exhaustive example, by using providers and/or cloud services that require the transfer of data abroad), adequate safeguards will be identified for the transfer of Personal Data to a Third Country, which depending on the circumstances may include: verification of the existence of adequacy decisions of the European Commission, execution of standard contractual clauses and/or binding corporate rules, verification of the adoption of any supplementary measures in implementation of Recommendation 01/2020 EDPB.
| Vendor Name | Description | Vendor Privacy Policy |
|---|---|---|
| Consisto | https://www.consisto.it/it/privacy-policy.html | |
| Avacy CMP | https://jumpgroup.it/privacy-policy/ | |
| Google Advertising Products | https://business.safety.google/privacy/ | |
| https://www.facebook.com/policy/cookies | ||
| YouTube | https://policies.google.com/privacy | |
| Microsoft | https://privacy.microsoft.com/en-us/privacystatement |
7. Data Retention Periods
The Controller retains Personal Data only for the periods of time necessary to pursue the purposes indicated in this document, or for the timeframes provided for by specific regulations.
- Personal Data processed for the purpose of "Provision of the service" will be retained for a period not exceeding 10 years;
- Personal data processed for the purpose of "Payments and Billing" will be retained for a period not exceeding 10 years (art. 2220 c.c.)
- Personal Data processed for Direct Marketing purposes will be retained for a period not exceeding 2 years, or until the data subject revokes consent to processing.
- The duration of persistence of individual cookies is reported within the "Cookie Policy";
- Without prejudice to the possibility for the Controller to retain Personal Data for the period of time provided for and allowed by Italian law for the purposes of "Legal protection" of its interests (art. 2946 and 2947 c1, c.3 c.c.).
After the expiration of such retention periods, Personal Data will be deleted or made anonymous, if not retained for further purposes based on appropriate legal grounds.
8. Recipients
Personal Data collected by the Data Controller may be communicated or made accessible, for the execution of the purposes indicated above, to the following categories of subjects:
- Employees and collaborators who assist the Controller in processing operations, subject to express authorization for processing and possibly to the execution of confidentiality agreements;
- Subjects providing outsourcing services on behalf of the Controller, as Data Processors: cloud computing service providers, freelancers, companies or professional firms providing assistance and consulting activities to the Data Controller, or subjects delegated to carry out hosting and technical maintenance activities, including software maintenance, network equipment and electronic communication networks;
- Independent data controllers to whom the communication of data is necessary for the purposes of providing the service requested by the data subject.
- Independent data controllers in the pursuit of their own purposes (subject to consent from the data subject);
- Public authorities, in the event that such communication is required by law.
After the expiration of such retention periods, Personal Data will be deleted or made anonymous, if not retained for further purposes based on appropriate legal grounds.
9. Rights of the Data Subject
At any time, the Data Subject may access the information concerning them and request its rectification, deletion, restriction of processing, and portability. They may also object, in whole or in part, to the processing and have the right not to be subject to automated decision-making concerning natural persons, including profiling.
To exercise the rights referred to in Articles 15-22 of the GDPR, the Data Subject may contact the Data Controller in the manner indicated in the "Contacts" section (see art. 10). The Data Controller must respond to the request within 1 month, or communicate any delay in response in the case of numerous and/or complex requests (the extension cannot exceed 2 months in any case). In any case, the Data Subject always has the right to lodge a complaint with the competent Supervisory Authority (Data Protection Authority), pursuant to Article 77 of the Regulation, if they believe that the processing of their Personal Data is contrary to the applicable regulations.
Contacts
For further information about the processing of Personal Data carried out in execution of the contract, or to submit a request to exercise rights, it is possible to contact the Controller at the email address: info@ahrntal.com
