INFORMATION pursuant to Regulation (EU) 2016/679 and Legislative Decree no. 196/2003 as amended.

By means of this document ("Information Notice"), the Data Controller, as defined below, wishes to inform you of the purposes and methods of the processing of your personal data and of the rights granted to you by Regulation (EU) 2016/679 and Legislative Decree 196/2003 and subsequent amendments, concerning the protection of individuals with regard to the processing of personal data and their free movement ("GDPR" and Italian adaptation legislation).

This information does not apply to other websites that may be consulted via links on the owner's domain, and the owner is in no way responsible for the websites of third parties.

1. Who is the Data Controller

The Data Controller is the CVC Foundation - Centro Velico Caprera ETS with registered office in Caprera - Punta Coda Location - La Maddalena (OT) and administrative office in Via Cornelio Tacito 6 Milan - 20137 (MI), in the person of the pro-tempore legal representative.

In order to exercise your rights, as listed in point 6 below, as well as for any other request, you may contact the Controller by writing to the following e-mail address

info@centrovelicocaprera.it

or by registered mail with return receipt to: CVC Foundation - Centro Velico Caprera ETS, Via Cornelio Tacito 6 - 20137 Milan.

We inform you that if the Data Controller has doubts about the identity of the natural person making the request, it may request further information necessary to confirm the identity of the person concerned.

2. What personal data we process

2.1. Personal data

For the purposes set out in this Policy, the Controller may process common personal data, which are, for example, personal data (name, surname, address, telephone number, e-mail and other contact details, an online identifier).

2.2. Special categories of personal data

The Data Controller may process special categories of personal data, such as data revealing racial or ethnic origin, religious, philosophical or other beliefs, as well as personal data concerning health.

In particular, the Controller will process special categories of your personal data:

directly and on a permanent basis, insofar as this is necessary for the content and offer of services and benefits related to the activity of the CVC (e.g. type of food or health-related profiles with regard to courses to be attended).

For the above-mentioned hypothesis of processing special categories of your personal data, the Controller requires your explicit consent to the processing.

Any decision not to grant such consent will make it impossible for the Controller to continue the relationship.

2.3. Navigation data

The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes, by way of example, the IP addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computer environment.

2.4. Data provided voluntarily by the user

The optional, explicit and voluntary sending of electronic mail to the addresses indicated on this site and/or the filling in of data collection forms entails the subsequent acquisition of the sender's address, which is necessary in order to reply to requests, as well as any other personal data entered.

2.5. Cookies

Regarding cookies, please refer to the appropriate cookie policy on the website.

2.6. Source of personal data.

Your personal data processed by the Controller are those provided directly by you to the Controller or collected from Third Parties such as, for example, in the event that the Controller acquires data from external companies for the purposes of commercial information, market research, direct offers of products or services. This Information Notice also covers the processing of your personal data acquired from Third Parties.

3. What are the purposes of processing

3.1 Execution of contracts

The processing of your personal data is necessary for:

- browsing this website;

- possible completion of data collection forms for requests for quotes and/or contacts;

- possible completion of data collection forms for on-line booking;

- administrative-accounting activities in general. For the purposes of applying the provisions on the protection of personal data, processing carried out for administrative-accounting purposes is that connected with the performance of activities of an organisational, administrative, financial and accounting nature, regardless of the nature of the data processed. In particular, internal organisational activities, those functional to the fulfilment of contractual and pre-contractual obligations and information activities pursue these purposes;

- purely commercial purposes of the CVC.

Nature of conferment: compulsory

Consequences of refusal to provide data: Failure to provide data will make it impossible for the Data Controller to follow up on your pre-contractual/contractual requests and execute the contract.

Period of storage of personal data: Your personal data will be processed for the time necessary to carry out the purposes of the processing described above, without prejudice to any storage obligations relating to particular categories of data, for longer periods of time, prescribed by the legal system or made necessary by the activity carried out and the service provided.

3.2 Marketing activities

With your consent, the Data Controller may process your personal data in order to send you commercial communications about products and services, including direct marketing conducted using the results of analytical activity, as well as direct sales and carrying out surveys or market research. The Data Controller will use automated methods of contact (such as, for example, e-mail, fax, SMS, MMS, instant messaging, social networks, apps, automated call systems without the intervention of an operator, etc.) and/or traditional methods (such as, for example, telephone calls with an operator and paper mail).

The personal data provided when filling in the data collection forms on the websites or data collection forms in general (such as name, surname, e-mail address) will be processed, subject to consent, by the Data Controller and the Data Processors for activities of a commercial promotional nature and e-mail newsletters more precisely, subject to the specific consent of the data subject:

1. a) may be used by CVC for its own promotion and marketing activities;
2. b) may be transmitted to the founding members of the CVC Foundation (Touring Club Italiano; Lega Navale Italiana, Milan section; and the Association of Volunteer Instructors and Students of Centro Velico Caprera - A.I.V.A. CVC) for institutional and/or commercial purposes;
3. c) may be transmitted and/or transferred to CVC's commercial partners operating in the publishing, clothing, nautical, industrial, new economy, financial, public bodies and bodies with purposes similar to its own.

Purposes of the processing: a) Sending of advertising material, direct sales, surveys or market research and/or commercial communications, b) promotion and sale of products and services through the use of tools such as, for example, e-mail, fax, SMS, MMS, etc., c) direct marketing, promotion and sale of products and services through the use of the results of the analysis and segmentation activity if you have also given your consent to the profiling activity.

Nature of conferment: Optional.

Consequences of refusal to provide data: Failure to provide data will not affect the fulfilment of your requests or the execution of contracts, but it will make it impossible for the Data Controller to send you marketing communications.

Legal basis for processing: Express consent of the person concerned.

Personal data retention period: Your personal data for this purpose will be processed until you decide to revoke your consent and/or obtain the termination of the processing.

Right to object to direct marketing activities

We inform you that, at any time, you have the right to object to direct marketing activities by contacting the Controller at one of the contacts indicated in point 1 of this Policy.

4. How your personal data will be processed

Your personal data will be processed in compliance with the provisions of the GDPR, using paper, computer and telematic tools, with logic strictly related to the purposes indicated and, in any case, in such a way as to ensure their security and confidentiality in accordance with the provisions of Article 32 GDPR.

5. To whom your personal data may be disclosed and who may become aware of them

For the pursuit of the purposes described in point 3 above, your personal data will be known by the employees, assimilated personnel, collaborators and of the Data Controller who will act as persons authorised to process and/or responsible for processing.

In addition, the Controller may need to communicate your personal data to third parties, the list of which is as follows

can be requested at the registered office of the Holder.

The personal data processed by the Controller are not disseminated.

6. What rights do you have as a data subject

In relation to the processing described in this Information Notice, as a data subject you may, under the conditions set out in the GDPR, exercise the rights set out in Articles 15 to 21 of the GDPR and, in particular, the following rights:

• Right of access - Article 15 GDPR: the right to obtain confirmation as to whether or not personal data concerning you are being processed and, if so, to obtain access to your personal data - including a copy thereof - and communication of, inter alia, the following information:

1. purpose of processing
2. categories of personal data processed
3. recipients to whom these have been or will be communicated
4. Data retention period or the criteria used

• Rights of the data subject (rectification, erasure of personal data, restriction of processing, and right to object to processing);
• Right to file a complaint;
• Right to receive information about the origin of my personal data if it has not been collected from the data subject
  the existence of an automated decision-making process;
• Right of rectification - Article 16 GDPR: Right to obtain, without undue delay, rectification of inaccurate personal data concerning you and/or supplementation of incomplete personal data;
• Right to erasure (right to be forgotten) - Article 17 GDPR: Right to obtain, without undue delay, the erasure of personal data concerning you when:

1. the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. You have revoked your consent and there is no other legal basis for processing;
3. You successfully objected to the processing of personal data;
4. The data were processed unlawfully;
5. data must be deleted to fulfill a legal obligation;
6. personal data have been collected in relation to the provision of information society services referred to in Article 8(1) GDPR.

The right to erasure does not apply to the extent that the processing is necessary for the fulfillment of a legal obligation or the performance of a task carried out in the public interest or for the establishment, exercise or defense of a right in court.

• Right to restriction of processing - Article 18 GDPR: right to obtain restriction of processing, when:

1. the data subject disputes the accuracy of personal data;
2. processing is unlawful and the data subject objects to the deletion of personal data and instead requests that their use be restricted;
3. personal data are necessary to the data subject for the establishment, exercise or defense of a legal claim;
4. the data subject has objected to the processing pending verification as to whether the data controller's legitimate reasons prevail over those of the data subject.

• Right to data portability - Article 20 GDPR: the right to receive, in a structured, commonly used and machine-readable format, personal data concerning you provided to the Data Controller and the right to have it transmitted to another data controller without hindrance where the processing is based on consent and is carried out by automated means. In addition, the right to have your personal data transmitted directly from the Controller to another controller if this is technically feasible;
• Right to object - Article 21 GDPR: the right to object, at any time, to the processing of personal data concerning you based on the condition of legitimate interest, including profiling, unless there are legitimate grounds for the Controller to continue the processing that override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims;
• Right not to be subjected to automated decision-making - Article 22 GDPR: You have the right not to be subjected to a decision based solely on automated processing, which produces legal effects concerning you or significantly affects you in a similar way, unless this is necessary for the conclusion or performance of a contract or you have given your consent.
  In any case, an automated decision-making process may not affect your personal data and you may at any time obtain human intervention from the data controller, express your opinion and challenge the decision;
• Propose complaints to the Italian Data Protection Authority, Piazza di Montecitorio n. 121, 00186, Rome (RM);
• revoke the consent given at any time and as easily as it was given;

The above rights may be exercised, vis-à-vis the Holder, by contacting the references indicated in point 1 above.

The exercise of your rights as a data subject is free of charge pursuant to Article 12 GDPR. However, in the case of manifestly unfounded or excessive requests, including due to their repetitiveness, the Data Controller may charge you a reasonable fee in light of the administrative costs incurred in handling your request, or deny you satisfaction of your request.

7. Social plug-ins

Our web pages may contain plug-ins from social networks (e.g. Facebook.com, operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). If you access one of our web pages with such a plug-in, your internet browser connects directly to the social network and the plug-in is displayed on your screen due to the browser connection. Before using such plug-ins, please consult the privacy policy of the social networks themselves, on their official pages.

Rights of the persons concerned

At any time, interested parties have the right to access their personal data (art. 15 G.D.P.R.), to ask for them to be corrected (art. 16 G.D.P.R.), updated and deleted (art. 17 G.D.P.R.). It is also possible to request the limitation of processing (art. 18 G.D.P.R.).

These requests may be addressed to CVC Foundation - Centro Velico Caprera ETS, at the administrative office at Via Cornelio Tacito 6 Milan - 20137 (MI), e -mail: info@centrovelicocaprera.it.

In addition, in the event that the processing is deemed to have been carried out in breach of data protection legislation, the right to lodge a complaint with the Data Protection Authority is recognised.