Privacy policy
PRIVACY POLICY
Premise
Ares Investment Property S.R.L. (hereinafter “Ares”), as Data Controller (hereinafter: “Data Controller”) pursuant to EU Regulation 679/2016 (hereinafter: “Regulation”) – considers privacy and protection of personal data is one of the main objectives of its business. We therefore invite you, before communicating any personal data to the Data Controller, to carefully read this Privacy Policy because it contains important information on the protection of your personal data.
It describes the personal data processing activities carried out by Ares through the website www.aresprop.com (hereinafter: "Site"), the related commitments undertaken in this regard and constitutes an integral part of it in relation to the services offered. Ares may process the user's personal data when they visit the Site and use the services and features on it. In the sections of the Site in which the user's personal data are collected, a specific information is normally published pursuant to art. 13 of EU Reg. 2016/679.
Where required by EU Reg. 2016/679, the user's consent will be requested before proceeding with the processing of their personal data. If the user provides personal data of third parties, he must ensure that the communication of the Ares data and the subsequent processing for the purposes specified in the applicable privacy information complies with EU Reg. 2016/679 and the legislation to which it refers.
We also inform you that the processing of your personal data will be based on the principles of correctness, lawfulness, transparency, purpose limitation and conservation, minimization and accuracy, integrity and confidentiality, as well as the principle of accountability referred to in art. 5 of the Regulation. Your personal data will therefore be processed in accordance with the legislative provisions of the Regulation and the confidentiality obligations provided therein. By processing of personal data we mean any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or modification, retrieval, consultation, use, communication by transmission, dissemination or any other form of provision, comparison or interconnection, limitation, cancellation or destruction.
We inform you that the personal data being processed may consist - also depending on your decisions on how to use the services - of textual information, photographic or video images and any other information suitable for making the interested party identified or identifiable, depending on the type of services requested.
INDEX
Below we provide the index of this Privacy Policy so that you can easily find the information relating to the processing of personal data that interests you.
• 1. DATA CONTROLLER
• 2.LAWS AND REGULATIONS
• 3. THE PERSONAL DATA SUBJECT TO PROCESSING
or 3.1. Browsing data
or 3.2.Data provided voluntarily by you
or 3.3. Third party data voluntarily provided by you
or 3.4.Personal information we receive from other sources
o 3.5. Data processed in interaction with social networks
o 3.6.Special categories of data
or 3.7.Cookies
• 4. PURPOSE OF THE TREATMENT
• 5. LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF THE PROVISION
• 6. RECIPIENTS OF PERSONAL DATA
• 7. TRANSFERS OF PERSONAL DATA
• 8. SECURITY AND QUALITY OF PERSONAL DATA
• 9. STORAGE OF PERSONAL DATA
• 10. SPECIAL DATA SUBJECT TO SPECIAL TREATMENT
• 11.MINORS
• 12. RIGHTS OF THE INTERESTED PARTY
• 13. DATA PROCESSING METHODS
• 14.LINKS TO OTHER WEBSITES
• 15. CHANGES
• 16.CONTACTS
1. DATA CONTROLLER
The data controller is:
Ares Investment Property S.r.l.; VAT number:04108421209; with headquarters located in Via Giuseppe Mazini 2/3, 40138 Bologna, represented by the Legal Representative pro tempore.
2. LAWS AND REGULATIONS
The regulatory sources we refer to for the protection of personal data are:
• "REGULATION (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (General Data Protection Regulation ) ("GDPR");
• National code regarding the protection of personal data (Legislative Decree no. 196 of 30 June 2003), as amended by Legislative Decree 101/2018;
• National Supervisory Authority for the protection of personal data, through provisions and guidelines issued by it on the matter.
3. THE PERSONAL DATA SUBJECT TO PROCESSING
Visiting and consulting the Site do not generally involve the collection and processing of the user's personal data except for navigation data and cookies as specified below. In addition to the so-called "navigation data", personal data voluntarily provided by the user may be processed when the user interacts with the functions of the Site or requests to use the services offered on the Site. Such data may consist of an identifier such as the name, your email, to an online identifier or to one or more characteristic elements suitable for making the interested party identified or identifiable, depending on the type of information that you yourself could report in the text of the message with which you decided to interact with us (hereinafter only "personal data").
The personal data processed through the Site are as follows:
• 3.1.Navigation data
The computer systems and software procedures used to operate the Site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users who connect to the Site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user's IT environment. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the Site to check its correct functioning, to identify anomalies and/or abuses, and are deleted immediately after processing. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the Site or third parties.
• 3.2.Data provided voluntarily by you
Except for the reference to specific information, this Privacy Policy is also intended for the processing of data voluntarily provided by you through the Site to obtain information regarding the services provided by Ares, or when you decide to book a stay, in which case the Your name and e-mail address are requested as basic data. We may also ask for your home address, telephone number, nationality, payment information, the names of any other people traveling with you and any preferences for your stay. If you want to get in touch with us, or contact us through other means (for example on social media), we will also collect information through these channels. You may be interested in subscribing to our newsletter to receive information on advantageous promotions that we reserve for this channel. In this regard, we invite you not to enter, in the forms contained within the Site, information that may fall within the category of particular categories of personal data referred to in art. 9 of the Regulation (for example, data referring to your state of health or that of other subjects), unless expressly requested (see below, "special categories of data").
• 3.3. Third party data provided voluntarily by you
You may also need to book a stay for other people traveling with you, or make a reservation on behalf of another person. In these cases, you will also have to provide data about them during the booking process. In these cases, the information provided will only be used as described on the specific pages of the service, you can read all the details there. We want to make it clear that it is our responsibility to ensure that the people about whom you have provided information are aware of this, and that they have accepted the ways in which Ares uses their information (i.e. as described in this privacy policy). In this sense we specify that if you provide or otherwise process personal data of third parties when using the Site, you guarantee from now on - assuming all related responsibility - that this particular processing hypothesis is based on the prior acquisition - by you - of the consent of the third party to the processing of information concerning him.
• 3.4.Personal information we receive from other sources
In addition to the information you provide to us directly, we may also receive information through various sources, for example business partners such as affiliates, independent third party sub-contractors, which may be combined with information received directly from you. For example, Ares booking services are available not only on Ares, but are also integrated with services of affiliate partners that you can find online. When you use these services, you communicate your booking details to our business partners, who then send them to us. Furthermore, we rely on external international providers to manage payments between users and facilities: these service providers share information about payments, to help us manage them and take care of your booking, so as to guarantee you the best possible experience. Partner facilities can also share information about you with Ares, for example when you have questions about a current booking, if there is a dispute about a booking or if there is any communication about your booking through Ares.
• 3.5. Data processed in interaction with social networks
Some services allow interactions with social networks or other external platforms. The interactions and information acquired are in any case subject to the User's privacy settings relating to each social network. If an interaction service with social networks is installed, it is possible that, even if Users do not use the service, it collects traffic data relating to the pages on which it is installed. As an example:
o Like button and social widgets of Facebook and Instagram The "Like" button and social widgets of Facebook are interaction services with the social network Facebook and Instagram, provided by Facebook Ireland Ltd. Personal data collected: Cookies and navigation and use data . Place of Processing: Ireland – Privacy Policy
o Tripadvisor social widgets button (Tripadvisor) Tripadvisor social widgets are interaction services with the web review portal on hotels, B&Bs, restaurants, tourist attractions, controlled by Tripadvisor LLC through the representative appointed for the European Union. Personal data collected: Cookies and navigation and use data. Place of Processing: USA – Privacy Policy
o Linkedin social widget button The Facebook "Like" button and social widgets are interaction services with the Facebook and Instagram social networks, provided by Likedin Corporation through the Data Controller LinkedIn Ireland Unlimited Company.
Personal data collected: Cookies and navigation and use data. Place of Processing: USA – Privacy Policy
• 3.6. Special categories of data
When interacting with the Site, no information is requested in any way that could lead to the processing of data that falls within the category of particular categories of personal data referred to in art. 9 of the Regulation.
• 3.7.Cookies
Information on the cookies served by the Site is available in the specific section of the site
4. PURPOSE OF THE PROCESSING
Your personal data will be processed, with your consent where necessary, for the following purposes:
• 4.1. allow navigation of the Site;
• 4.2. meet specific requests for information addressed to Ares and contact it via e-mail, post, telephone or SMS, depending on the contact method you have chosen;
• 4.3.manage booking requests for stays, auxiliary transport services, etc. either through our online services or by means of direct contact with the structure or through external commercial partners, also through the use of the interested party's credit card which may be used for purposes related to guaranteeing the service requested for any debit as a penalty in the event of cancellation after the agreed deadline for exercising the right of withdrawal indicated in the booking confirmation, or in the case of failure to arrive within the defined deadline;
• 4.4. fulfill any obligations established by current laws, regulations or community legislation, or satisfy requests from the authorities, such as for example:
or to fulfill the obligation established by article 109 of the Royal Decree. 18.6.1931 n. 773, which requires us to register and communicate to the Police Headquarters the personal details of the clients accommodated;
o to fulfill the obligation to communicate to the Regional Tourism Observatory, in order to monitor the tourism sector through the acquisition, management and dissemination of information and statistical data relating to the flow between regional tourism supply and demand (L.R. n. 13/2007, articles 28 and 31, as amended by Regional Law no. 17/2011).
• 4.5.carry out direct marketing activities via e-mail for products and/or services similar to those previously purchased, unless you expressly refuse to receive such communications, which you can easily express during registration or on subsequent occasions, objecting to the processing;
• 4.6. subject to consent, carry out marketing activities such as:
o send you informative and promotional material relating to the activities and services of Ares and its commercial partners;
or send you personalized offers based on preferences, liking, customizations or other so-called elements. profiling;
or send you surveys to improve the service (“customer satisfaction”);
o newsletter and any other communications,
These communications may be made via e-mail or text message, through paper mail and/or the use of the telephone with an operator and/or through the official Ares pages on social networks; it is specified that the Data Controller collects differentiated consents for the marketing purposes described here and for sending newsletters, pursuant to the General Provision of the Guarantor for the Protection of Personal Data "Guidelines regarding promotional activities and combating spam" , of 4 July 2013; if, in any case, you wish to object to the processing of your data for marketing purposes carried out with the means indicated here, you may do so at any time by contacting the Data Controller at the contact details indicated in the "Contacts" section of this policy, without prejudice to the lawfulness of the processing based on the consent given before the revocation.
• 4.7. for statistical purposes, without it being possible to trace your identity. Specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access.
5. LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF THE PROVISION
The legal basis inherent to the processing of personal data for the purposes referred to in sections 4.1, 4.2 and 4.3 is art. 6(1)(b) of the Regulation ([…]the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same), as the processing is necessary to the provision of services. The provision of personal data for these purposes is optional, but failure to provide it would make it impossible to activate the requested services.
The purpose referred to in section 4.4 represents legitimate processing of personal data pursuant to art. 6(1)(c) of the Regulation ([…]processing is necessary to fulfill a legal obligation to which the data controller is subject). Once the personal data has been provided, in fact, the processing is indeed necessary to fulfill legal obligations indicated in the purpose described above, to which Ares is subject.
The processing carried out for the marketing and profiling purposes described in section 4.5 is based on legitimate interest pursuant to art. 6(1)(f) of the Regulation ([…] the processing is necessary for the pursuit of the legitimate interest of the data controller or third parties, provided that the interests or fundamental rights and freedoms of the interested party which require the protection of personal data, in particular if the interested party is a minor): for processing carried out for these purposes and with this legal basis, the interested party may exercise the right to object. For processing carried out for marketing purposes, the legitimate interest is applicable within the limits set by the Regulation and art. 130 c. 4 of the Code regarding the protection of personal data (Legislative Decree 196/2003), if the processing is aimed at providing services similar to those already subscribed to or in which the interested party has expressed interest, unless express refusal to receive such communications, which you may express by objecting both during the registration phase and on subsequent occasions.
The processing carried out for the marketing and profiling purposes described in section 4.6 is based on the granting of your consent pursuant to art. 6(1)(a) ([…] the interested party has expressed consent to the processing of their personal data for one or more specific purposes) and art. 22(2)(c) of the Regulation. The provision of your personal data for these purposes is therefore completely optional and does not prejudice the use of further services. If you wish to revoke consent to the processing of your data for marketing and profiling purposes, you may do so at any time by contacting the owner at the contact details indicated in the "Contacts" section of this policy.
It is also specified that the processing referred to in section 4.7 is not carried out on personal data and therefore can be freely carried out by Ares.
6. RECIPIENTS OF PERSONAL DATA
For the purposes referred to in section 4 of this Privacy Policy, your personal data may be shared with third parties, either because you have agreed to do so, or for legal reasons connected to them. These are personnel working in the owner's organization authorized to process and/or our service providers and other third parties as described in detail below:
• 6.1. Electronic invoicing: if you receive a receipt or invoice by email, a summary of the goods and services provided to you during your stay will be sent to your payment card provider and, if you participate in a corporate invoicing program and uses a company payment card, your payment card provider may provide this summary to your employer. Once we have transferred your information, the privacy policies of your employer, payment card provider and card issuer apply.
• 6.2.Group Events or Meetings: If you attend an event or meeting, information collected to plan that event or meeting may be shared with the organizers and, if appropriate, guests organizing or attending the event or meeting.
6.3. Business partners: We may partner with other companies to provide you with products, services or offers based on your needs and experiences and share your information with our business partners accordingly. For example, we may receive assistance from our business partners for car rental or other services and share your personal information with them to provide you with the services you request.
• 6.4.Service Providers: We rely on third parties to provide services on our behalf and, if necessary, we may share your personal information with them. These are subjects who typically act as data controllers, i.e.:
or companies that provide support in the management of booking reception services made via the Ares website.
o companies that provide web mailing services for the automated sending of communications such as invitations, promotions, newsletters;
o people, companies or professional firms that provide assistance and consultancy to Ares in tax, accounting, administrative, legal, tax, financial and regulatory compliance matters;
or subjects delegated to carry out technical maintenance activities of the Ares IT infrastructures and the website. In general, our service providers undertake by contract through the signing of confidentiality agreements by their staff, to protect your information personal and will not be able to use or share it, unless required by law.
• 6.5.Telemarketing: If you stay at our property, we may share your phone number and email with the portfolio of collaborating brands, for telemarketing purposes in accordance with your preferences and applicable law. We may also receive your telephone number from our partners or other sources and use it for telemarketing purposes.
• 6.6.Other reasons: we may communicate your personal information to:
o comply with applicable laws;
or respond to government requests or requests from public authorities,
or comply with valid legal process,
or protect the rights, privacy, safety or property of Ares, site visitors, guests, employees or the public,
or allow us to implement available remedies or limit the damages we may sustain,
or enforce terms and conditions of our websites,
or deal with an emergency.
• 6.7.Aggregated or Anonymized Data with Personal Information Removed: We may, from time to time, provide data to third parties that has been aggregated or anonymized. This means that your personal information that could be used to identify you has been removed from the data. Data provided to third parties in this way is not personal data; however, you retain the right to object.
• 6.8. Credit institutions or insurance companies and brokers (only in the event of accidents that may occur in the structure).
• 6.9.Persons authorized by Ares to process personal data, necessary to carry out activities strictly related to the provision of services, who are committed to confidentiality or have an adequate legal obligation of confidentiality.
The complete list of data controllers is available by sending a written request to the Data Controller at the contact details indicated in the "Contacts" section of this policy.
7. TRANSFERS OF PERSONAL DATA
We primarily store and process your personal data in Italy/EU/European Economic Area ("EEA"). If we transfer your personal data outside the EEA, we assure you from now on that the transfer of data outside the EEA will take place in compliance with the applicable legal provisions, subject to verification of the certification of compliance with the principles and protocols adopted by non-EEA states -EU with the European Union
The data may be transferred outside the EEA area, if the level of data protection implemented by them has been deemed adequate by the European Commission pursuant to art. 45 of the GDPR, through a specific adequacy decision.
The owner also declares that, in the absence of an adequacy decision from the European Commission on the level of protection of interested parties guaranteed by the countries pursuant to art. 45 of the GDPR, the transfer of data will take place, where possible, upon signing of the Standard Contractual Clauses (SCC) adopted by the European Commission pursuant to art. 46, 2, letter. c) and exceptionally, with the prior consent of the interested party.
8. SECURITY AND QUALITY OF PERSONAL DATA
Ares undertakes to protect the security of the user's personal data and respects the security provisions established by the applicable legislation in order to avoid data loss, illegitimate or illicit use of the data and unauthorized access to the same. Furthermore, the information systems and computer programs used are configured in such a way as to minimize the use of personal and identifying data; such data are processed only to achieve the specific purposes pursued from time to time. Ares uses multiple advanced security technologies and procedures aimed at promoting the protection of users' personal data; for example, personal data is stored on secure servers located in places with protected and controlled access. The user can help and contribute to updating and keeping their personal data correct by communicating any changes relating to their address, title, contact information, etc.
9. STORAGE OF PERSONAL DATA
The personal data processed for the purposes referred to in sections 4.1, 4.2 and 4.3 will be kept for the time strictly necessary to achieve those same purposes. In any case, since these are treatments carried out for the provision of services, Ares will retain the personal data for the period of time envisaged and permitted by Italian legislation to protect its interests (Art. 2946 of the Civil Code et seq.).
The personal data processed for the purposes referred to in section 4.4 will be kept until the time required by the specific obligation or applicable law. For the purposes referred to in section 4.5, your personal data will be processed until you have objected to the treatment.
For the purposes referred to in sections 4.6 and 4.7, your personal data will instead be processed, as a general rule, until your consent is revoked. If you withdraw from the services provided by Ares without having revoked such consent, the data may also be processed after your withdrawal. It is expected that a periodic check will be carried out on an annual basis on the data processed and on the possibility of being able to delete them if they are no longer necessary for the intended purposes. With reference to personal data subject to Processing for Marketing Purposes or Processing for profiling purposes, the same will be kept in compliance with the principle of proportionality and in any case until the purposes of the processing have been achieved or until the revocation of specific consent by the interested party.
Specifically, the Data Controller will process the data for no longer than 2 years from the collection of data for Marketing Purposes and one year for data collected for Profiling Purposes.
Further information regarding the data retention period and the criteria used to determine this period can be requested by sending a written request to the owner at the contact details indicated in the "Contacts" section of this policy. In any case, Ares is entitled to retain your personal data for the period of time established and permitted by Italian law to protect its interests (Art. 2947(1)(3) of the Civil Code).
10. SPECIAL DATA SUBJECT TO SPECIAL TREATMENT
The term "confidential data subject to special processing" means your information relating to racial or ethnic origin, political opinions, religion or other beliefs, trade union membership, health, sexual life or orientation, genetic information, criminal record and biometric data used to purposes of unique identification. We generally do not collect any particular data unless you provide it voluntarily. We may use the information you have provided about your health to provide you with a better service and meet your particular needs (for example, providing special access arrangements for people with disabilities). They are therefore data whose protection has the aim of guaranteeing freedom of thought and opinion, the dignity of the person and freedom from possible discrimination, for the processing of which explicit consent is required, even if not necessarily written, because they concern aspects particularly private to the individual and can be used for discriminatory purposes.
11. MINORS
The new European Regulation (GDPR) has prescribed, in Article 8, the obligation not to allow the direct offer of information society services (therefore registration to social networks and messaging services) to persons under 16 years of age unless the consent of the parents is obtained (it must be ensured that the consent is given by the person exercising parental authority) or of their guardian.
Registration for an online service, therefore, is subject to the rules for the conclusion of contracts, for which the subject must be able to appreciate the nature and consequences of his consent.
In any case, parental consent is not always necessary. According to Article 8 of the new European regulation, parental consent is required only if the processing of minors' data is legitimized on the basis of consent. If, however, the processing has another legal basis, such as compliance with a legal obligation, legitimate interests, etc., parental consent is not necessary. Furthermore, this limit can be further lowered by national states (but the limit cannot go below 13 years). In this perspective, the Italian legislator has set the age limit to be applied in Italy at 14 years, with the decree adapting the Privacy Code.
Our website does not intend to solicit or knowingly collect personal information from anyone under the age of 16. If we are notified or otherwise discover that personal information from a child has been wrongly collected, we will take commercially reasonable steps to delete such information.
12. DATA PROCESSING METHODS
The processing of personal data is carried out by means of the operations indicated in the art. 4 no. 2) of the EU Regulation and precisely: the collection, recording, organisation, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of making available, comparison or interconnection, limitation, cancellation or destruction, blocking. The processing of personal data takes place by those in charge of the organization responsible for managing requests, using manual, IT and telematic tools with logic strictly related to the purposes themselves and in any case in such a way as to guarantee the security and confidentiality of the data itself in full. compliance with what is indicated in the art. 32 of the EU Regulation. Filing can be carried out both electronically and on paper.
It is highlighted that the processing methods implemented do not imply the need to subject the interested party to a decision, which may include a measure, which evaluates personal aspects concerning him, which is based solely on automated processing and which produces legal effects that concern or similarly significantly affect you, without human intervention.
Both with regard to the data present on their devices and for any data present at providers, the data controller has implemented adequate technical and organizational measures to guarantee an adequate level of security, in full compliance with what is indicated in the art. 32 of the EU Regulation.
Further information is available by sending a written request to the owner at the contact details indicated in the "Contacts" section of this information.
13. RIGHTS OF THE INTERESTED PARTY
At any time the interested party may exercise his rights towards the Data Controller, pursuant to EU Regulation 679/2016 through the contact details indicated in the contact section of the policy:
To guarantee the correct exercise of rights, the interested party must make himself or herself identifiable in an unequivocal manner.
Ares undertakes to provide feedback within 30 days and, in case of impossibility to respect these times, to justify any extension of the established deadlines. The feedback will take place free of charge except in cases of unfoundedness (e.g. there are no data concerning the requesting interested party) or excessive requests (e.g. repetitive over time) for which an expense contribution may be charged not exceeding the costs actually borne for the search carried out in the specific case. The rights relating to personal data concerning deceased persons can be exercised by those who have an interest of their own or act to protect the interested party or for family reasons worthy of protection. The interested party can also lodge a complaint with the supervisory authority.
In the event of a personal data breach suffered by Ares, the owner will notify the breach to the competent supervisory authority within 72 hours of the occurrence and will also communicate the event to the interested party, except in the cases of exclusion provided for by the law.
Art. 15 (right of access), 16 (right of rectification) of EU Reg. 2016/679
The interested party has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed and, in this case, to obtain access to the personal data and the following information:
• the purposes of the processing;
• the categories of personal data in question;
• the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients are from third countries or international organizations;
• the expected retention period of personal data or, if this is not possible, the criteria used to determine this period;
• the existence of the interested party's right to ask the data controller to rectify or delete personal data or limit the processing of personal data concerning him or to oppose their processing;
• the right to lodge a complaint with a supervisory authority;
• the existence of an automated decision-making process, including profiling and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party.
Right referred to in art. 17 of EU Reg. 2016/679 - right to cancellation ("right to be forgotten")
The interested party has the right to obtain from the data controller the deletion of personal data concerning him or her without unjustified delay and the data controller has the obligation to delete the personal data without unjustified delay, if one of the following reasons exists:
• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the interested party withdraws the consent on which the processing is based in accordance with Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), and if there is no other legal basis for the processing;
• the interested party objects to the processing pursuant to Article 21, paragraph 1, and there is no overriding legitimate reason to proceed with the processing, or objects to the processing pursuant to Article 21, paragraph 2;
• the personal data have been processed unlawfully;
• the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the data controller is subject;
• the personal data were collected in relation to the offer of information society services referred to in Article 8, paragraph 1 of EU Reg. 2016/679
Right referred to in art. 18 Right to limit processing
The interested party has the right to obtain from the data controller the limitation of processing when one of the following hypotheses occurs:
• the interested party contests the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
• the processing is unlawful and the interested party opposes the deletion of the personal data and instead requests that their use be limited;
• although the data controller no longer needs them for the purposes of the processing, the personal data are necessary for the interested party to ascertain, exercise or defend a right in court;
• the interested party has objected to the processing pursuant to Article 21, paragraph 1, EU Reg. 2016/679 pending verification regarding the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.
Revocation of consent to processing
The interested party has the right to revoke consent to the processing of his/her personal data by sending a registered letter with return receipt to the address shown in the contact section, accompanied by a photocopy of his/her identity document, with the following text: "revocation of consent to the processing of all my personal data." At the end of this operation, your personal data will be removed from the archives as soon as possible, together with the photocopy accompanying the request.
In any case, you always have the right to lodge a complaint with the competent supervisory authority (Guarantor for the protection of personal data), pursuant to art. 77 of the Regulation, if you believe that the processing of your data is contrary to the legislation in force.
14. LINKS TO OTHER WEBSITES
Our site may contain links to third-party websites. Please note that we are not responsible for the collection, use, management, sharing or disclosure of data and information by these third parties. If you provide information on and use third-party sites, the privacy policies and terms of service of those sites will apply. We encourage you to read the privacy policies of the websites you visit before submitting any personal information. In some cases, these sites may be co-branded and display our logos or other trademarks. To find out if you are on our website, check the URL of the page you are visiting.
15. MODIFICATIONS
Ares reserves the right to modify or simply update the content of this Privacy Policy, in part or completely, also due to changes in applicable legislation. Ares will inform you of these changes as soon as they are introduced and they will be binding as soon as they are published on the Site. For this reason we therefore invite you to regularly visit this section to become aware of the most recent and updated version of the Privacy Policy in order to always be up to date on the data collected and the use that Ares makes of them.
16. CONTACTS
To exercise the above rights or for any other request you can write to:
Ares Investment Property S.r.l.
Via Giuseppe Mazini 2/3, 40138 Bologna,
VAT number:04108421209
Email: [email protected]
Phone: +39 051 021 6274
Ares website http://www.aresprop.com
Premise
Ares Investment Property S.R.L. (hereinafter “Ares”), as Data Controller (hereinafter: “Data Controller”) pursuant to EU Regulation 679/2016 (hereinafter: “Regulation”) – considers privacy and protection of personal data is one of the main objectives of its business. We therefore invite you, before communicating any personal data to the Data Controller, to carefully read this Privacy Policy because it contains important information on the protection of your personal data.
It describes the personal data processing activities carried out by Ares through the website www.aresprop.com (hereinafter: "Site"), the related commitments undertaken in this regard and constitutes an integral part of it in relation to the services offered. Ares may process the user's personal data when they visit the Site and use the services and features on it. In the sections of the Site in which the user's personal data are collected, a specific information is normally published pursuant to art. 13 of EU Reg. 2016/679.
Where required by EU Reg. 2016/679, the user's consent will be requested before proceeding with the processing of their personal data. If the user provides personal data of third parties, he must ensure that the communication of the Ares data and the subsequent processing for the purposes specified in the applicable privacy information complies with EU Reg. 2016/679 and the legislation to which it refers.
We also inform you that the processing of your personal data will be based on the principles of correctness, lawfulness, transparency, purpose limitation and conservation, minimization and accuracy, integrity and confidentiality, as well as the principle of accountability referred to in art. 5 of the Regulation. Your personal data will therefore be processed in accordance with the legislative provisions of the Regulation and the confidentiality obligations provided therein. By processing of personal data we mean any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or modification, retrieval, consultation, use, communication by transmission, dissemination or any other form of provision, comparison or interconnection, limitation, cancellation or destruction.
We inform you that the personal data being processed may consist - also depending on your decisions on how to use the services - of textual information, photographic or video images and any other information suitable for making the interested party identified or identifiable, depending on the type of services requested.
INDEX
Below we provide the index of this Privacy Policy so that you can easily find the information relating to the processing of personal data that interests you.
• 1. DATA CONTROLLER
• 2.LAWS AND REGULATIONS
• 3. THE PERSONAL DATA SUBJECT TO PROCESSING
or 3.1. Browsing data
or 3.2.Data provided voluntarily by you
or 3.3. Third party data voluntarily provided by you
or 3.4.Personal information we receive from other sources
o 3.5. Data processed in interaction with social networks
o 3.6.Special categories of data
or 3.7.Cookies
• 4. PURPOSE OF THE TREATMENT
• 5. LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF THE PROVISION
• 6. RECIPIENTS OF PERSONAL DATA
• 7. TRANSFERS OF PERSONAL DATA
• 8. SECURITY AND QUALITY OF PERSONAL DATA
• 9. STORAGE OF PERSONAL DATA
• 10. SPECIAL DATA SUBJECT TO SPECIAL TREATMENT
• 11.MINORS
• 12. RIGHTS OF THE INTERESTED PARTY
• 13. DATA PROCESSING METHODS
• 14.LINKS TO OTHER WEBSITES
• 15. CHANGES
• 16.CONTACTS
1. DATA CONTROLLER
The data controller is:
Ares Investment Property S.r.l.; VAT number:04108421209; with headquarters located in Via Giuseppe Mazini 2/3, 40138 Bologna, represented by the Legal Representative pro tempore.
2. LAWS AND REGULATIONS
The regulatory sources we refer to for the protection of personal data are:
• "REGULATION (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (General Data Protection Regulation ) ("GDPR");
• National code regarding the protection of personal data (Legislative Decree no. 196 of 30 June 2003), as amended by Legislative Decree 101/2018;
• National Supervisory Authority for the protection of personal data, through provisions and guidelines issued by it on the matter.
3. THE PERSONAL DATA SUBJECT TO PROCESSING
Visiting and consulting the Site do not generally involve the collection and processing of the user's personal data except for navigation data and cookies as specified below. In addition to the so-called "navigation data", personal data voluntarily provided by the user may be processed when the user interacts with the functions of the Site or requests to use the services offered on the Site. Such data may consist of an identifier such as the name, your email, to an online identifier or to one or more characteristic elements suitable for making the interested party identified or identifiable, depending on the type of information that you yourself could report in the text of the message with which you decided to interact with us (hereinafter only "personal data").
The personal data processed through the Site are as follows:
• 3.1.Navigation data
The computer systems and software procedures used to operate the Site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users who connect to the Site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user's IT environment. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the Site to check its correct functioning, to identify anomalies and/or abuses, and are deleted immediately after processing. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the Site or third parties.
• 3.2.Data provided voluntarily by you
Except for the reference to specific information, this Privacy Policy is also intended for the processing of data voluntarily provided by you through the Site to obtain information regarding the services provided by Ares, or when you decide to book a stay, in which case the Your name and e-mail address are requested as basic data. We may also ask for your home address, telephone number, nationality, payment information, the names of any other people traveling with you and any preferences for your stay. If you want to get in touch with us, or contact us through other means (for example on social media), we will also collect information through these channels. You may be interested in subscribing to our newsletter to receive information on advantageous promotions that we reserve for this channel. In this regard, we invite you not to enter, in the forms contained within the Site, information that may fall within the category of particular categories of personal data referred to in art. 9 of the Regulation (for example, data referring to your state of health or that of other subjects), unless expressly requested (see below, "special categories of data").
• 3.3. Third party data provided voluntarily by you
You may also need to book a stay for other people traveling with you, or make a reservation on behalf of another person. In these cases, you will also have to provide data about them during the booking process. In these cases, the information provided will only be used as described on the specific pages of the service, you can read all the details there. We want to make it clear that it is our responsibility to ensure that the people about whom you have provided information are aware of this, and that they have accepted the ways in which Ares uses their information (i.e. as described in this privacy policy). In this sense we specify that if you provide or otherwise process personal data of third parties when using the Site, you guarantee from now on - assuming all related responsibility - that this particular processing hypothesis is based on the prior acquisition - by you - of the consent of the third party to the processing of information concerning him.
• 3.4.Personal information we receive from other sources
In addition to the information you provide to us directly, we may also receive information through various sources, for example business partners such as affiliates, independent third party sub-contractors, which may be combined with information received directly from you. For example, Ares booking services are available not only on Ares, but are also integrated with services of affiliate partners that you can find online. When you use these services, you communicate your booking details to our business partners, who then send them to us. Furthermore, we rely on external international providers to manage payments between users and facilities: these service providers share information about payments, to help us manage them and take care of your booking, so as to guarantee you the best possible experience. Partner facilities can also share information about you with Ares, for example when you have questions about a current booking, if there is a dispute about a booking or if there is any communication about your booking through Ares.
• 3.5. Data processed in interaction with social networks
Some services allow interactions with social networks or other external platforms. The interactions and information acquired are in any case subject to the User's privacy settings relating to each social network. If an interaction service with social networks is installed, it is possible that, even if Users do not use the service, it collects traffic data relating to the pages on which it is installed. As an example:
o Like button and social widgets of Facebook and Instagram The "Like" button and social widgets of Facebook are interaction services with the social network Facebook and Instagram, provided by Facebook Ireland Ltd. Personal data collected: Cookies and navigation and use data . Place of Processing: Ireland – Privacy Policy
o Tripadvisor social widgets button (Tripadvisor) Tripadvisor social widgets are interaction services with the web review portal on hotels, B&Bs, restaurants, tourist attractions, controlled by Tripadvisor LLC through the representative appointed for the European Union. Personal data collected: Cookies and navigation and use data. Place of Processing: USA – Privacy Policy
o Linkedin social widget button The Facebook "Like" button and social widgets are interaction services with the Facebook and Instagram social networks, provided by Likedin Corporation through the Data Controller LinkedIn Ireland Unlimited Company.
Personal data collected: Cookies and navigation and use data. Place of Processing: USA – Privacy Policy
• 3.6. Special categories of data
When interacting with the Site, no information is requested in any way that could lead to the processing of data that falls within the category of particular categories of personal data referred to in art. 9 of the Regulation.
• 3.7.Cookies
Information on the cookies served by the Site is available in the specific section of the site
4. PURPOSE OF THE PROCESSING
Your personal data will be processed, with your consent where necessary, for the following purposes:
• 4.1. allow navigation of the Site;
• 4.2. meet specific requests for information addressed to Ares and contact it via e-mail, post, telephone or SMS, depending on the contact method you have chosen;
• 4.3.manage booking requests for stays, auxiliary transport services, etc. either through our online services or by means of direct contact with the structure or through external commercial partners, also through the use of the interested party's credit card which may be used for purposes related to guaranteeing the service requested for any debit as a penalty in the event of cancellation after the agreed deadline for exercising the right of withdrawal indicated in the booking confirmation, or in the case of failure to arrive within the defined deadline;
• 4.4. fulfill any obligations established by current laws, regulations or community legislation, or satisfy requests from the authorities, such as for example:
or to fulfill the obligation established by article 109 of the Royal Decree. 18.6.1931 n. 773, which requires us to register and communicate to the Police Headquarters the personal details of the clients accommodated;
o to fulfill the obligation to communicate to the Regional Tourism Observatory, in order to monitor the tourism sector through the acquisition, management and dissemination of information and statistical data relating to the flow between regional tourism supply and demand (L.R. n. 13/2007, articles 28 and 31, as amended by Regional Law no. 17/2011).
• 4.5.carry out direct marketing activities via e-mail for products and/or services similar to those previously purchased, unless you expressly refuse to receive such communications, which you can easily express during registration or on subsequent occasions, objecting to the processing;
• 4.6. subject to consent, carry out marketing activities such as:
o send you informative and promotional material relating to the activities and services of Ares and its commercial partners;
or send you personalized offers based on preferences, liking, customizations or other so-called elements. profiling;
or send you surveys to improve the service (“customer satisfaction”);
o newsletter and any other communications,
These communications may be made via e-mail or text message, through paper mail and/or the use of the telephone with an operator and/or through the official Ares pages on social networks; it is specified that the Data Controller collects differentiated consents for the marketing purposes described here and for sending newsletters, pursuant to the General Provision of the Guarantor for the Protection of Personal Data "Guidelines regarding promotional activities and combating spam" , of 4 July 2013; if, in any case, you wish to object to the processing of your data for marketing purposes carried out with the means indicated here, you may do so at any time by contacting the Data Controller at the contact details indicated in the "Contacts" section of this policy, without prejudice to the lawfulness of the processing based on the consent given before the revocation.
• 4.7. for statistical purposes, without it being possible to trace your identity. Specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access.
5. LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF THE PROVISION
The legal basis inherent to the processing of personal data for the purposes referred to in sections 4.1, 4.2 and 4.3 is art. 6(1)(b) of the Regulation ([…]the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same), as the processing is necessary to the provision of services. The provision of personal data for these purposes is optional, but failure to provide it would make it impossible to activate the requested services.
The purpose referred to in section 4.4 represents legitimate processing of personal data pursuant to art. 6(1)(c) of the Regulation ([…]processing is necessary to fulfill a legal obligation to which the data controller is subject). Once the personal data has been provided, in fact, the processing is indeed necessary to fulfill legal obligations indicated in the purpose described above, to which Ares is subject.
The processing carried out for the marketing and profiling purposes described in section 4.5 is based on legitimate interest pursuant to art. 6(1)(f) of the Regulation ([…] the processing is necessary for the pursuit of the legitimate interest of the data controller or third parties, provided that the interests or fundamental rights and freedoms of the interested party which require the protection of personal data, in particular if the interested party is a minor): for processing carried out for these purposes and with this legal basis, the interested party may exercise the right to object. For processing carried out for marketing purposes, the legitimate interest is applicable within the limits set by the Regulation and art. 130 c. 4 of the Code regarding the protection of personal data (Legislative Decree 196/2003), if the processing is aimed at providing services similar to those already subscribed to or in which the interested party has expressed interest, unless express refusal to receive such communications, which you may express by objecting both during the registration phase and on subsequent occasions.
The processing carried out for the marketing and profiling purposes described in section 4.6 is based on the granting of your consent pursuant to art. 6(1)(a) ([…] the interested party has expressed consent to the processing of their personal data for one or more specific purposes) and art. 22(2)(c) of the Regulation. The provision of your personal data for these purposes is therefore completely optional and does not prejudice the use of further services. If you wish to revoke consent to the processing of your data for marketing and profiling purposes, you may do so at any time by contacting the owner at the contact details indicated in the "Contacts" section of this policy.
It is also specified that the processing referred to in section 4.7 is not carried out on personal data and therefore can be freely carried out by Ares.
6. RECIPIENTS OF PERSONAL DATA
For the purposes referred to in section 4 of this Privacy Policy, your personal data may be shared with third parties, either because you have agreed to do so, or for legal reasons connected to them. These are personnel working in the owner's organization authorized to process and/or our service providers and other third parties as described in detail below:
• 6.1. Electronic invoicing: if you receive a receipt or invoice by email, a summary of the goods and services provided to you during your stay will be sent to your payment card provider and, if you participate in a corporate invoicing program and uses a company payment card, your payment card provider may provide this summary to your employer. Once we have transferred your information, the privacy policies of your employer, payment card provider and card issuer apply.
• 6.2.Group Events or Meetings: If you attend an event or meeting, information collected to plan that event or meeting may be shared with the organizers and, if appropriate, guests organizing or attending the event or meeting.
6.3. Business partners: We may partner with other companies to provide you with products, services or offers based on your needs and experiences and share your information with our business partners accordingly. For example, we may receive assistance from our business partners for car rental or other services and share your personal information with them to provide you with the services you request.
• 6.4.Service Providers: We rely on third parties to provide services on our behalf and, if necessary, we may share your personal information with them. These are subjects who typically act as data controllers, i.e.:
or companies that provide support in the management of booking reception services made via the Ares website.
o companies that provide web mailing services for the automated sending of communications such as invitations, promotions, newsletters;
o people, companies or professional firms that provide assistance and consultancy to Ares in tax, accounting, administrative, legal, tax, financial and regulatory compliance matters;
or subjects delegated to carry out technical maintenance activities of the Ares IT infrastructures and the website. In general, our service providers undertake by contract through the signing of confidentiality agreements by their staff, to protect your information personal and will not be able to use or share it, unless required by law.
• 6.5.Telemarketing: If you stay at our property, we may share your phone number and email with the portfolio of collaborating brands, for telemarketing purposes in accordance with your preferences and applicable law. We may also receive your telephone number from our partners or other sources and use it for telemarketing purposes.
• 6.6.Other reasons: we may communicate your personal information to:
o comply with applicable laws;
or respond to government requests or requests from public authorities,
or comply with valid legal process,
or protect the rights, privacy, safety or property of Ares, site visitors, guests, employees or the public,
or allow us to implement available remedies or limit the damages we may sustain,
or enforce terms and conditions of our websites,
or deal with an emergency.
• 6.7.Aggregated or Anonymized Data with Personal Information Removed: We may, from time to time, provide data to third parties that has been aggregated or anonymized. This means that your personal information that could be used to identify you has been removed from the data. Data provided to third parties in this way is not personal data; however, you retain the right to object.
• 6.8. Credit institutions or insurance companies and brokers (only in the event of accidents that may occur in the structure).
• 6.9.Persons authorized by Ares to process personal data, necessary to carry out activities strictly related to the provision of services, who are committed to confidentiality or have an adequate legal obligation of confidentiality.
The complete list of data controllers is available by sending a written request to the Data Controller at the contact details indicated in the "Contacts" section of this policy.
7. TRANSFERS OF PERSONAL DATA
We primarily store and process your personal data in Italy/EU/European Economic Area ("EEA"). If we transfer your personal data outside the EEA, we assure you from now on that the transfer of data outside the EEA will take place in compliance with the applicable legal provisions, subject to verification of the certification of compliance with the principles and protocols adopted by non-EEA states -EU with the European Union
The data may be transferred outside the EEA area, if the level of data protection implemented by them has been deemed adequate by the European Commission pursuant to art. 45 of the GDPR, through a specific adequacy decision.
The owner also declares that, in the absence of an adequacy decision from the European Commission on the level of protection of interested parties guaranteed by the countries pursuant to art. 45 of the GDPR, the transfer of data will take place, where possible, upon signing of the Standard Contractual Clauses (SCC) adopted by the European Commission pursuant to art. 46, 2, letter. c) and exceptionally, with the prior consent of the interested party.
8. SECURITY AND QUALITY OF PERSONAL DATA
Ares undertakes to protect the security of the user's personal data and respects the security provisions established by the applicable legislation in order to avoid data loss, illegitimate or illicit use of the data and unauthorized access to the same. Furthermore, the information systems and computer programs used are configured in such a way as to minimize the use of personal and identifying data; such data are processed only to achieve the specific purposes pursued from time to time. Ares uses multiple advanced security technologies and procedures aimed at promoting the protection of users' personal data; for example, personal data is stored on secure servers located in places with protected and controlled access. The user can help and contribute to updating and keeping their personal data correct by communicating any changes relating to their address, title, contact information, etc.
9. STORAGE OF PERSONAL DATA
The personal data processed for the purposes referred to in sections 4.1, 4.2 and 4.3 will be kept for the time strictly necessary to achieve those same purposes. In any case, since these are treatments carried out for the provision of services, Ares will retain the personal data for the period of time envisaged and permitted by Italian legislation to protect its interests (Art. 2946 of the Civil Code et seq.).
The personal data processed for the purposes referred to in section 4.4 will be kept until the time required by the specific obligation or applicable law. For the purposes referred to in section 4.5, your personal data will be processed until you have objected to the treatment.
For the purposes referred to in sections 4.6 and 4.7, your personal data will instead be processed, as a general rule, until your consent is revoked. If you withdraw from the services provided by Ares without having revoked such consent, the data may also be processed after your withdrawal. It is expected that a periodic check will be carried out on an annual basis on the data processed and on the possibility of being able to delete them if they are no longer necessary for the intended purposes. With reference to personal data subject to Processing for Marketing Purposes or Processing for profiling purposes, the same will be kept in compliance with the principle of proportionality and in any case until the purposes of the processing have been achieved or until the revocation of specific consent by the interested party.
Specifically, the Data Controller will process the data for no longer than 2 years from the collection of data for Marketing Purposes and one year for data collected for Profiling Purposes.
Further information regarding the data retention period and the criteria used to determine this period can be requested by sending a written request to the owner at the contact details indicated in the "Contacts" section of this policy. In any case, Ares is entitled to retain your personal data for the period of time established and permitted by Italian law to protect its interests (Art. 2947(1)(3) of the Civil Code).
10. SPECIAL DATA SUBJECT TO SPECIAL TREATMENT
The term "confidential data subject to special processing" means your information relating to racial or ethnic origin, political opinions, religion or other beliefs, trade union membership, health, sexual life or orientation, genetic information, criminal record and biometric data used to purposes of unique identification. We generally do not collect any particular data unless you provide it voluntarily. We may use the information you have provided about your health to provide you with a better service and meet your particular needs (for example, providing special access arrangements for people with disabilities). They are therefore data whose protection has the aim of guaranteeing freedom of thought and opinion, the dignity of the person and freedom from possible discrimination, for the processing of which explicit consent is required, even if not necessarily written, because they concern aspects particularly private to the individual and can be used for discriminatory purposes.
11. MINORS
The new European Regulation (GDPR) has prescribed, in Article 8, the obligation not to allow the direct offer of information society services (therefore registration to social networks and messaging services) to persons under 16 years of age unless the consent of the parents is obtained (it must be ensured that the consent is given by the person exercising parental authority) or of their guardian.
Registration for an online service, therefore, is subject to the rules for the conclusion of contracts, for which the subject must be able to appreciate the nature and consequences of his consent.
In any case, parental consent is not always necessary. According to Article 8 of the new European regulation, parental consent is required only if the processing of minors' data is legitimized on the basis of consent. If, however, the processing has another legal basis, such as compliance with a legal obligation, legitimate interests, etc., parental consent is not necessary. Furthermore, this limit can be further lowered by national states (but the limit cannot go below 13 years). In this perspective, the Italian legislator has set the age limit to be applied in Italy at 14 years, with the decree adapting the Privacy Code.
Our website does not intend to solicit or knowingly collect personal information from anyone under the age of 16. If we are notified or otherwise discover that personal information from a child has been wrongly collected, we will take commercially reasonable steps to delete such information.
12. DATA PROCESSING METHODS
The processing of personal data is carried out by means of the operations indicated in the art. 4 no. 2) of the EU Regulation and precisely: the collection, recording, organisation, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of making available, comparison or interconnection, limitation, cancellation or destruction, blocking. The processing of personal data takes place by those in charge of the organization responsible for managing requests, using manual, IT and telematic tools with logic strictly related to the purposes themselves and in any case in such a way as to guarantee the security and confidentiality of the data itself in full. compliance with what is indicated in the art. 32 of the EU Regulation. Filing can be carried out both electronically and on paper.
It is highlighted that the processing methods implemented do not imply the need to subject the interested party to a decision, which may include a measure, which evaluates personal aspects concerning him, which is based solely on automated processing and which produces legal effects that concern or similarly significantly affect you, without human intervention.
Both with regard to the data present on their devices and for any data present at providers, the data controller has implemented adequate technical and organizational measures to guarantee an adequate level of security, in full compliance with what is indicated in the art. 32 of the EU Regulation.
Further information is available by sending a written request to the owner at the contact details indicated in the "Contacts" section of this information.
13. RIGHTS OF THE INTERESTED PARTY
At any time the interested party may exercise his rights towards the Data Controller, pursuant to EU Regulation 679/2016 through the contact details indicated in the contact section of the policy:
To guarantee the correct exercise of rights, the interested party must make himself or herself identifiable in an unequivocal manner.
Ares undertakes to provide feedback within 30 days and, in case of impossibility to respect these times, to justify any extension of the established deadlines. The feedback will take place free of charge except in cases of unfoundedness (e.g. there are no data concerning the requesting interested party) or excessive requests (e.g. repetitive over time) for which an expense contribution may be charged not exceeding the costs actually borne for the search carried out in the specific case. The rights relating to personal data concerning deceased persons can be exercised by those who have an interest of their own or act to protect the interested party or for family reasons worthy of protection. The interested party can also lodge a complaint with the supervisory authority.
In the event of a personal data breach suffered by Ares, the owner will notify the breach to the competent supervisory authority within 72 hours of the occurrence and will also communicate the event to the interested party, except in the cases of exclusion provided for by the law.
Art. 15 (right of access), 16 (right of rectification) of EU Reg. 2016/679
The interested party has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed and, in this case, to obtain access to the personal data and the following information:
• the purposes of the processing;
• the categories of personal data in question;
• the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients are from third countries or international organizations;
• the expected retention period of personal data or, if this is not possible, the criteria used to determine this period;
• the existence of the interested party's right to ask the data controller to rectify or delete personal data or limit the processing of personal data concerning him or to oppose their processing;
• the right to lodge a complaint with a supervisory authority;
• the existence of an automated decision-making process, including profiling and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party.
Right referred to in art. 17 of EU Reg. 2016/679 - right to cancellation ("right to be forgotten")
The interested party has the right to obtain from the data controller the deletion of personal data concerning him or her without unjustified delay and the data controller has the obligation to delete the personal data without unjustified delay, if one of the following reasons exists:
• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the interested party withdraws the consent on which the processing is based in accordance with Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), and if there is no other legal basis for the processing;
• the interested party objects to the processing pursuant to Article 21, paragraph 1, and there is no overriding legitimate reason to proceed with the processing, or objects to the processing pursuant to Article 21, paragraph 2;
• the personal data have been processed unlawfully;
• the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the data controller is subject;
• the personal data were collected in relation to the offer of information society services referred to in Article 8, paragraph 1 of EU Reg. 2016/679
Right referred to in art. 18 Right to limit processing
The interested party has the right to obtain from the data controller the limitation of processing when one of the following hypotheses occurs:
• the interested party contests the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
• the processing is unlawful and the interested party opposes the deletion of the personal data and instead requests that their use be limited;
• although the data controller no longer needs them for the purposes of the processing, the personal data are necessary for the interested party to ascertain, exercise or defend a right in court;
• the interested party has objected to the processing pursuant to Article 21, paragraph 1, EU Reg. 2016/679 pending verification regarding the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.
Revocation of consent to processing
The interested party has the right to revoke consent to the processing of his/her personal data by sending a registered letter with return receipt to the address shown in the contact section, accompanied by a photocopy of his/her identity document, with the following text: "revocation of consent to the processing of all my personal data." At the end of this operation, your personal data will be removed from the archives as soon as possible, together with the photocopy accompanying the request.
In any case, you always have the right to lodge a complaint with the competent supervisory authority (Guarantor for the protection of personal data), pursuant to art. 77 of the Regulation, if you believe that the processing of your data is contrary to the legislation in force.
14. LINKS TO OTHER WEBSITES
Our site may contain links to third-party websites. Please note that we are not responsible for the collection, use, management, sharing or disclosure of data and information by these third parties. If you provide information on and use third-party sites, the privacy policies and terms of service of those sites will apply. We encourage you to read the privacy policies of the websites you visit before submitting any personal information. In some cases, these sites may be co-branded and display our logos or other trademarks. To find out if you are on our website, check the URL of the page you are visiting.
15. MODIFICATIONS
Ares reserves the right to modify or simply update the content of this Privacy Policy, in part or completely, also due to changes in applicable legislation. Ares will inform you of these changes as soon as they are introduced and they will be binding as soon as they are published on the Site. For this reason we therefore invite you to regularly visit this section to become aware of the most recent and updated version of the Privacy Policy in order to always be up to date on the data collected and the use that Ares makes of them.
16. CONTACTS
To exercise the above rights or for any other request you can write to:
Ares Investment Property S.r.l.
Via Giuseppe Mazini 2/3, 40138 Bologna,
VAT number:04108421209
Email: [email protected]
Phone: +39 051 021 6274
Ares website http://www.aresprop.com