Privacy Notice

Pursuant to Article 13 of Regulation (EU) 2016/679 – GDPR, as amended

DATA CONTROLLER

Ottoservice di Ottorino Menici
25050 Temù (BS), Via Val d’Avio 39/b, Italy
VAT No. 01871490981 – Tax Code MNCTRN68D01L094G
E-mail:info@pistaghiacciovaldisole.com
Certified e-mail (PEC):menici.ottorino@aziendapec.it

  1. PERSONAL DATA SUBJECT TO PROCESSING

Personal data are collected and processed in connection with requests for information, the purchase and use of services, and the fulfilment of legal obligations.

Personal data may be provided directly by the Data Subject through the website, the authorised purchasing platform, e-mail, telephone, forms, and paper or electronic documents, or may be collected in the course of purchasing and using the Service.

Depending on the relationship with the Supplier and the service requested, the following categories of personal data may be processed:

a) identification and contact data, such as first name, surname, date of birth, tax code, e-mail address, telephone number and, where necessary, address and other personal and identification data; for business or professional Customers, data necessary for the administrative and tax management of the relationship, such as VAT number, tax code, SDI recipient code and billing details;

b) data relating to requests and services, such as the service requested or purchased and, where applicable, booking details;

c) data relating to and connected with the use of the services, including the data and declarations provided by the Participant in the Waiver and Liability Declaration;

d) payment data, processed in connection with the payment methods used to purchase the services;

e) data used to send newsletters and other promotional communications, such as first name, surname and e-mail address, subject to the Data Subject’s consent;

f) photographs and audio/video recordings that may be taken during the activities and processed for the purposes indicated in the relevant information notice and/or on the basis of the consent requested.

2.PURPOSES OF PROCESSING

Personal data are processed for the following purposes:

  1. a) managing requests for information and contacts;
  2. b) managing bookings, purchases and payments for services;
  3. c) providing services, including verifying the applicable eligibility requirements and managing the necessary documentation;
  4. d) fulfilling administrative, accounting and tax obligations arising from the relationship with the Customer;
  5. e) managing communications with the Customer and Participant concerning the service purchased or requested;
  6. f) sending promotional communications and newsletters, subject to the Data Subject’s consent;
  7. g) producing and using photographs and audio/video recordings made during the provision of the service for communication and promotional purposes, on the basis of the specific consent where required;
  8. h) exercising or defending the Data Controller’s rights and managing any claims or disputes.

For the purposes referred to in letters a), b), c) and e), processing is carried out, as applicable, for the performance of the contract or for the purposes of taking steps at the request of the Data Subject prior to entering into a contract; for the purpose referred to in letter d), on the basis of compliance with a legal obligation; for the purposes referred to in letters f) and g), on the basis of the Data Subject’s consent; and for the purpose referred to in letter h), on the basis of the Data Controller’s legitimate interest in protecting its rights.

  1. MANDATORY OR VOLUNTARY NATURE OF THE PROVISION OF DATA

The provision of personal data necessary for the management of requests, the conclusion of the contractual relationship and the provision of the Services is mandatory.

In the absence of such data, the Data Controller cannot ensure the proper management of requests, bookings, purchases or use of the Services.

The provision of personal data for promotional purposes (newsletters and commercial communications) and for the use of photographic images and/or audio/video recordings is voluntary.

Failure to provide consent does not affect the possibility of using the Services.

  1. PROCESSING METHODS AND DATA SECURITY

Personal data are processed using electronic tools and, where necessary, paper records, in compliance with the principles of fairness, lawfulness, transparency and data minimisation and for the purposes indicated in this Privacy Policy.

The data are processed by personnel authorised by the Data Controller and, where necessary, by external parties providing services that are functional and instrumental to the management of the Data Controller’s activities, within the limits necessary to perform their respective duties.

The Data Controller adopts appropriate technical and organisational measures to ensure the security, confidentiality and integrity of personal data and to prevent unauthorised access, loss, destruction or alteration of data.

  1. AUTOMATED DECISION-MAKING AND PROFILING

The Data Controller does not carry out processing by means of automated decision-making, including profiling, which produces legal effects or similarly significantly affects the Data Subject pursuant to Article 22 of the GDPR.

  1. RECIPIENTS OF PERSONAL DATA

Personal data may be communicated, to the extent necessary to pursue the purposes indicated in this Privacy Policy, to parties that cooperate with the Data Controller or provide services that are functional and instrumental to the management of Ottoservice’s activities.

In particular, the data may be processed by parties belonging to the following categories:

  1. a) providers of IT, hosting, e-mail and digital storage services;
  2. b) providers of platforms for managing bookings and purchases;
  3. c) providers of payment and transaction management services;
  4. d) providers of services for sending communications and newsletters;
  5. e) professionals and consultants appointed by the Data Controller, where necessary;
  6. f) parties to whom the data must be communicated in order to comply with legal obligations or orders issued by the competent authorities.

Personal data are not subject to public disclosure and are not transferred to third parties for their own purposes other than those connected with the management of the requested services or the fulfilment of legal obligations.

  1. TRANSFER OF PERSONAL DATA

Personal data may also be transferred and/or processed by service providers operating, in whole or in part, within the European Union, the European Economic Area and third countries, for the purposes indicated in this Privacy Policy.

In such cases, the Data Controller ensures that the transfer of data takes place in compliance with applicable legislation and on the basis of the safeguards provided for by the GDPR and/or other applicable legislation.

  1. RETENTION PERIOD FOR PERSONAL DATA

Personal data are retained for the period necessary to achieve the purposes for which they were collected and, subsequently, for the period required by legal obligations (including, by way of example and without limitation, accounting, tax and anti-money laundering purposes) and/or necessary to protect rights (assessment, exercise and defence).

More specifically, given that retention periods may vary depending on the type of data and the purpose of the processing, the following retention periods apply:

a) data relating to requests for information that do not result in a relationship with the Data Controller are retained for the period necessary to manage the request and until the end of the season during which the request was submitted;

b) contractual data (bookings, e-mail correspondence, purchases, payments, privacy notices, waiver, General Terms and Conditions of Sale, and Track Regulations), invoices, Excel files containing personal data, accounting records, tax obligations and other administrative documentation are retained for a period of 10 years from the end of the season during which the event took place, unless the retention period is extended in the event of ongoing tax audits, until the relevant proceedings have been concluded;

c) data processed for promotional purposes and photographs and audio/video recordings are retained for a maximum period of 2 years from the end of the season during which the event took place.

9.RIGHTS OF THE DATA SUBJECT

In relation to the processing of their personal data, the Data Subject may exercise, where provided for by applicable law, the rights recognised under Articles 15 et seq. of Regulation (EU) 2016/679 (GDPR), including:

  1. a) the right to obtain confirmation as to whether or not personal data concerning them are being processed and, where this is the case, to obtain access to the data and the information provided for by law;
  2. b) the right to request the rectification of inaccurate personal data or the completion of incomplete data;
  3. c) the right to request the erasure of personal data, in the cases provided for by law;
  4. d) the right to request restriction of processing, in the cases provided for by law;
  5. e) the right to object to the processing of personal data, in the cases provided for by law;
  6. f) the right to receive the personal data provided to the Data Controller in a structured, commonly used and machine-readable format and, where provided for, to transmit such data to another data controller (right to data portability);
  7. g) the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise their rights, the Data Subject may contact the Data Controller using the contact details indicated in this Privacy Policy, as provided for by law.

  1. RIGHT TO LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY

Without prejudice to any other administrative or judicial remedy, the Data Subject who considers that the processing of their personal data is carried out in violation of applicable legislation has the right to lodge a complaint with theItalian Data Protection Authority (Garante per la protezione dei dati personali), as the competent supervisory authority.

Last updated: [30th September, 2026]