INFORMATION pursuant to Regulation (EU) 2016/679 and Legislative Decree no. 196/2003 as amended.
By means of this document ("Information Notice"), the Data Controller, as defined below, wishes to inform you of the purposes and methods of the processing of your personal data and of the rights granted to you by Regulation (EU) 2016/679 and Legislative Decree 196/2003 and subsequent amendments, concerning the protection of individuals with regard to the processing of personal data and their free movement ("GDPR" and Italian adaptation legislation).
This information does not apply to other websites that may be consulted via links on the owner's domain, and the owner is in no way responsible for the websites of third parties.
1. Who is the Data Controller
The Data Controller is Fondazione CVC - Centro Velico Caprera ETS with headquarters at Via Cornelio Tacito 6 Milan - 20137 (MI), in the person of the pro-tempore legal representative.
In order to exercise your rights, as listed in point 6 below, as well as for any other request, you may contact the Controller by writing to the following e-mail address
info1@centrovelicocaprera.it
or by registered mail with return receipt to: Fondazione CVC - Centro Velico Caprera ETS, Via Crocefisso n°5 - 20122 Milan.
We inform you that if the Data Controller has doubts about the identity of the natural person making the request, it may request further information necessary to confirm the identity of the person concerned.
2. What personal data we process
2.1. Personal data
For the purposes set out in this Policy, the Controller may process common personal data, which are, for example, personal data (name, surname, address, telephone number, e-mail and other contact details, an online identifier).
2.2. Special categories of personal data
The Data Controller may process special categories of personal data, such as data revealing racial or ethnic origin, religious, philosophical or other beliefs, as well as personal data concerning health.
In particular, the Controller will process special categories of your personal data:
directly and on a permanent basis, insofar as this is necessary for the content and offer of services and benefits related to the activity of the CVC (e.g. type of food or health-related profiles with regard to courses to be attended).
For the above-mentioned hypothesis of processing special categories of your personal data, the Controller requires your explicit consent to the processing.
Any decision not to grant such consent will make it impossible for the Controller to continue the relationship.
2.3. Navigation data
The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.
This information is not collected to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes, by way of example, the IP addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computer environment.
2.4. Data provided voluntarily by the user
The optional, explicit and voluntary sending of electronic mail to the addresses indicated on this site and/or the filling in of data collection forms entails the subsequent acquisition of the sender's address, which is necessary in order to reply to requests, as well as any other personal data entered.
2.5. Cookies
With regard to cookies, please refer to the specific cookie policy on the website.
2.6. Source of personal data.
Your personal data processed by the Controller are those provided directly by you to the Controller or collected from Third Parties such as, for example, in the event that the Controller acquires data from external companies for the purposes of commercial information, market research, direct offers of products or services. This Information Notice also covers the processing of your personal data acquired from Third Parties.
3. What are the purposes of the processing
3.1 Execution of contracts
The processing of your personal data is necessary for:
- browsing this website;
- possible completion of data collection forms for requests for quotes and/or contacts;
- possible completion of data collection forms for on-line booking;
- administrative-accounting activities in general. For the purposes of applying the provisions on the protection of personal data, processing carried out for administrative-accounting purposes is that connected with the performance of activities of an organisational, administrative, financial and accounting nature, regardless of the nature of the data processed. In particular, internal organisational activities, those functional to the fulfilment of contractual and pre-contractual obligations and information activities pursue these purposes;
- purely commercial purposes of the CVC.
Nature of conferment: compulsory
Consequences of refusal to provide data: Failure to provide data will make it impossible for the Data Controller to follow up on your pre-contractual/contractual requests and execute the contract.
Period of storage of personal data: Your personal data will be processed for the time necessary to carry out the purposes of the processing described above, without prejudice to any storage obligations relating to particular categories of data, for longer periods of time, prescribed by the legal system or made necessary by the activity carried out and the service provided.
3.2 Marketing activities
With your consent, the Data Controller may process your personal data in order to send you commercial communications about products and services, including direct marketing conducted using the results of analytical activity, as well as direct sales and carrying out surveys or market research. The Data Controller will use automated methods of contact (such as, for example, e-mail, fax, SMS, MMS, instant messaging, social networks, apps, automated call systems without the intervention of an operator, etc.) and/or traditional methods (such as, for example, telephone calls with an operator and paper mail).
The personal data provided when filling in the data collection forms on the websites or data collection forms in general (such as name, surname, e-mail address) will be processed, subject to consent, by the Data Controller and the Data Processors for activities of a commercial promotional nature and e-mail newsletters more precisely, subject to the specific consent of the data subject:
a) may be used by CVC for its own promotion and marketing activities;
b) may be transmitted to CVC members (Touring Club Italiano; Lega Navale Italiana, Milan section, Associazione Allievi e Volontari CVC) for institutional and/or commercial purposes;
c) may be transmitted and/or transferred to CVC's commercial partners operating in the publishing, clothing, nautical, industrial, new economy, financial, public bodies and bodies with purposes similar to its own.
Purposes of the processing: a) Sending of advertising material, direct sales, surveys or market research and/or commercial communications, b) promotion and sale of products and services through the use of tools such as, for example, e-mail, fax, SMS, MMS, etc., c) direct marketing, promotion and sale of products and services through the use of the results of the analysis and segmentation activity if you have also given your consent to the profiling activity.
Nature of conferment: Optional.
Consequences of refusal to provide data: Failure to provide data will not affect the fulfilment of your requests or the execution of contracts, but it will make it impossible for the Data Controller to send you marketing communications.
Legal basis for processing: Express consent of the person concerned.
Personal data retention period: Your personal data for this purpose will be processed until you decide to revoke your consent and/or obtain the termination of the processing.
Right to object to direct marketing activities
We inform you that, at any time, you have the right to object to direct marketing activities by contacting the Controller at one of the contacts indicated in point 1 of this Policy.
4. How your personal data will be processed
Your personal data will be processed in compliance with the provisions of the GDPR, using paper, computer and telematic tools, with logic strictly related to the purposes indicated and, in any case, in such a way as to ensure their security and confidentiality in accordance with the provisions of Article 32 GDPR.
5. To whom your personal data may be communicated and who may become aware of them
For the pursuit of the purposes described in point 3 above, your personal data will be known by the employees, assimilated personnel, collaborators and of the Data Controller who will act as persons authorised to process and/or responsible for processing.
In addition, the Controller may need to communicate your personal data to third parties, the list of which is as follows
can be requested at the registered office of the Holder.
The personal data processed by the Controller are not disseminated.
6. What rights do you have as a data subject
In relation to the processing described in this Information Notice, as a data subject you may, under the conditions set out in the GDPR, exercise the rights set out in Articles 15 to 21 of the GDPR and, in particular, the following rights:
Right of access - Article 15 GDPR: the right to obtain confirmation as to whether or not personal data concerning you are being processed and, if so, to obtain access to your personal data - including a copy thereof - and communication of, inter alia, the following information:
purpose of processing
categories of personal data processed
recipients to whom the data have been or will be communicated
data retention period or criteria used
data subject's rights (rectification, erasure of personal data, restriction of processing and right to object to processing
right to lodge a complaint
right to receive information on the source of my personal data where it has not been collected from the data subject
existence of automated decision making;
right of rectification - Article 16 GDPR: Right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data;
right to erasure (right to be forgotten) - Article 17 GDPR: Right to obtain, without undue delay, the erasure of personal data concerning you, when:
the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
you have withdrawn your consent and there is no other legal basis for the processing;
you have successfully objected to the processing of your personal data;
the data have been unlawfully processed,
the data must be erased in order to comply with a legal obligation;
the personal data have been collected in connection with the provision of information society services as referred to in Article 8(1) GDPR.
The right to erasure does not apply to the extent that the processing is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or for the establishment, exercise or defence of legal claims.
Right to restriction of processing - Article 18 GDPR: right to obtain restriction of processing, when:
the data subject disputes the accuracy of the personal data;
the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead that its use be restricted
the personal data are necessary for the establishment, exercise or defence of legal claims;
the data subject has objected to the processing pending verification as to whether the legitimate reasons of the data controller prevail over those of the data subject.
right to data portability - Article 20 GDPR: the right to receive, in a structured, commonly used and machine-readable format, personal data concerning you provided to the Data Controller and the right to transmit them to another data controller without hindrance, where the processing is based on consent and is carried out by automated means. In addition, the right to have your personal data transmitted directly by the Controller to another controller if this is technically feasible;
right to object - Article 21 GDPR: right to object, at any time, to the processing of personal data concerning you based on the condition of legitimate interest, including profiling, unless there are legitimate grounds for the Controller to continue the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of a legal claim.
right not to be subjected to an automated decision-making process - Article 22 GDPR: you have the right not to be subjected to a decision based solely on automated processing which produces legal effects concerning you or significantly affects you in a similar way, unless this is necessary for the conclusion or performance of a contract or you have given your consent.
In any case, an automated decision-making process shall not affect your personal data and you may at any time obtain human intervention by the controller, express your opinion and contest the decision.
lodge a complaint with the Guarantor Authority for the protection of personal data, Piazza di Montecitorio n. 121, 00186, Rome (RM);
revoke the consent given at any time and with the same ease with which it was provided.
The above-mentioned rights may be exercised, with regard to the Data Controller, by contacting the references indicated in point 1 above.
The exercise of your rights as a data subject is free of charge pursuant to Article 12 GDPR. However, in the case of manifestly unfounded or excessive requests, including due to their repetitiveness, the Data Controller may charge you a reasonable fee in light of the administrative costs incurred in handling your request, or deny you satisfaction of your request.
7. Social plug-in
Our web pages may contain plug-ins from social networks (e.g. Facebook.com, operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). If you access one of our web pages with such a plug-in, your internet browser connects directly to the social network and the plug-in is displayed on your screen due to the browser connection. Before using such plug-ins, please consult the privacy policy of the social networks themselves, on their official pages.
Information on the processing of personal data Covid 19
Pursuant to the EU Regulation No. 679/2016 (so-called GDPR), information is provided below regarding the processing of personal data of individuals who, during the COVID-19 emergency, so-called Coronavirus, access the base of the CVC Foundation - Centro Velico Caprera ETS or other places however referable to it.
Data controller
CVC Foundation - Centro Velico Caprera ETS, Punta Coda Caprera Location - 07024 La Maddalena (OT), e-mail: info@centrovelicocaprera.it.
Type of personal data processed and data subjects
Within the limits of the purposes and methods defined in this information notice, they are processed:
a) data on the measured body temperature and the occurrence of the following symptoms in the last 21 days:
- fever >37.5°;
- cough;
- muscle aches;
- sore throat;
- difficulty breathing;
- chills;
- loss of sense of smell or taste;
b) information on contacts with confirmed Covid-19 cases and/or people who have had at least one of these symptoms in the last 21 days;
The personal data being processed refer to suppliers, students, visitors and any other third party authorised to access the Caprera base of CVC or other places that can be referred to it.
Purpose and legal basis of processing
Personal data will be processed exclusively for the purpose of preventing infection by COVID-19, in execution of the "COVID emergency behavioural standards" provided for in the Rules of Life, adopted in compliance with national and regional legislation.
The legal basis of the processing is therefore to be found in the need to fulfil a legal obligation (Art. 6, lett. c) G.D.P.R.), i.e. in the implementation of anti-contagious security protocols pursuant to Art. 1, no. 7, lett. d) of DPCM 11 March 2020 and subsequent provisions.
Nature of the provision of personal data
The provision of data is necessary to access the base of the CVC Foundation - Centro Velico Caprera ETS or other places however referable to it. Any refusal to confer them prevents allowing entry.
Methods, scope and duration of processing
Processing is carried out by the staff of the CVC Foundation - Centro Velico Caprera ETS acting on the basis of specific instructions given regarding the purposes and methods of processing.
Personal data will not be disclosed or communicated to third parties, except in accordance with specific regulatory provisions (e.g. in the event of a request from the Health Authority for the reconstruction of the chain of any close contacts of a person who has tested positive for COVID-19).
The data will be processed for the time strictly necessary to pursue the aforementioned purpose of preventing infection from COVID-19 and kept no longer than 60 days after the closure of the CVC courses of the 2020 season, given the needs, including health needs, underlying the same courses of the 2020 season.
Rights of the persons concerned
At any time, interested parties have the right to access their personal data (art. 15 G.D.P.R.), to ask for them to be corrected (art. 16 G.D.P.R.), updated and deleted (art. 17 G.D.P.R.). It is also possible to request the limitation of processing (art. 18 G.D.P.R.).
These requests may be addressed to CVC Foundation - Centro Velico Caprera ETS, with registered office at Via Cornelio Tacito 6 Milan - 20137 (MI), e -mail: info@centrovelicocaprera.it.
In addition, in the event that the processing is deemed to have been carried out in breach of data protection legislation, the right to lodge a complaint with the Data Protection Authority is recognised.
