EU REGULATION 679/2016 ON THE PROCESSING OF PERSONAL DATA - ART. 13

Privacy Policy

Wonderful Italy S.r.l. offers stays in selected houses and unique experiences in the most fascinating places in Italy; we carry out our activities with the will to support the entrepreneurial spirit of local territories and operators who, like us, believe that welcoming tourists is a fundamental resource for their own development. We specialize in the selection, management and promotion of homes in authentic locations, we provide professional services with carefully selected local partners as well as complementary services to guests, and we offer them authentic and immersive experiential products in lesser-known Italian locations and traditions, thanks to the in-depth knowledge of the territory of our expert local collaborators.

The protection of privacy and the legitimate use of personal data are an absolute priority for Wonderful Italy; we undertake to guarantee you that your personal data will be processed in accordance with the principles of correctness, lawfulness, transparency, in compliance with the purposes and methods indicated below, collecting them to the extent necessary and accurate for processing.

Pursuant to Legislative Decree no. 196/2003, as amended by Legislative Decree no. 101/2018 (hereinafter, "Privacy Code") and Article 13 EU Regulation no. 2016/679 (hereinafter, "GDPR") below we provide our Privacy Policy with the aim of informing all users about the use and processing of their personal data.

Please note that this Privacy Policy does not apply to the Work with Us section of the website for which we have prepared a specific Information Notice (Candidate Information Notice).

1. Who we are

Wonderful Italy S.r.l. with registered office in Via Vigevano, 35 - 20144 - Milan, P.IVA 09902710962 is the owner of the processing of personal data (hereinafter, "Owner"). You can contact the Data Controller at any time by sending an e-mail to privacy@wonderfulitaly.eu.

2. Purpose of the processing

This Privacy Policy concerns the methods of management of the https://www.wonderfulitaly.eu website with reference to the processing of users' personal data. Processing of personal data means any operation or set of operations, carried out with or without the help of automated processes and applied to personal data or sets of personal data, even if not registered in a database, such as collecting, recording, organizing, structuring storage, processing, selection, blocking, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction, erasure or destruction.

2.1. Type of data collected

Pursuant to EU Regulation 679/2016 on the processing of personal data when you use our services, you agree that our Company collects some of your personal data. The purpose of this notice is to tell you what data we collect, why and how we use it.

2.1.1. Data provided by you

When you use our services, we ask you to provide us with certain personal data that we need in order to use them. Below is a list of the services that Wonderful Italy makes available to its users through the use of the website; for each service we list, by way of example and not limited to, the data processed by the Owner:

Booking accommodation or an experience Personal data processed: - first name - surname - identity document/passport data - tax code - e-mail address - telephone number - home address - any payment information - personal data of persons traveling with you (name, surname, date of birth, e-mail address, identity document/passport details).

We inform you that it will be your responsibility to ensure that these individuals have received this information and have understood and accepted the way in which Wonderful Italy uses their personal data - children's data (name, surname, nationality, gender, date of birth). The circumstances in which we may have to collect the personal data of minors are limited to cases where such data are part of a reservation; such information will be processed only to comply with a legal obligation - only if explicitly requested by the user, the Data Controller may possibly process data belonging to special categories under Article 9 GDPR (hereinafter also referred to as 'special data'), such as information revealing the data subject's state of health (e.g. for accessibility purposes or in order to take advantage of the exemption from tourist tax)

We would like to inform you that, in relation to stays at the accommodation, 2 different situations may arise:

1. the accommodation is managed directly by Wonderful Italy or it is owned by a third party (owner of the accommodation) but Wonderful Italy acts as a mediator with representation. In this case, all activities relating to the lease for tourist use are carried out by Wonderful Italy and you will be issued a specific privacy policy at the time of signing the lease contract for tourist use; 2. the accommodation is owned by a third party (owner of the accommodation) and Wonderful Italy deals only with the commercial contact with the guest. In this case, all the activities inherent to the lease for tourist use are carried out by the owner of the accommodation, who will be configured as an autonomous owner of the treatment; in this case, therefore, we invite you to read the information on the treatment of personal data issued by the owner of the accommodation.

Request general information via the Contact form

Personal data processed: - first name - surname - e-mail address - telephone number - any other information you provide in the message text

Request specific information on opening a Wonderful Italy Hub, using the Open a Hub in your area form

Personal data processed: - first name - surname - e-mail address - telephone number - any other information you provide in the message text

For tour operators, request specific information to collaborate with us, using the form Propose your activity Personal data processed:

- first name - surname - e-mail address - telephone number - any other information you provide in the message text

For property owners, please contact us to request a free property valuation using the Request an Estimate form

Personal data processed: - first name - surname - e-mail address - telephone number - type of accommodation - address of the accommodation - if the accommodation is already online, links to any other sites to which the accommodation owner is registered - any other information you provide in the message text

For guests, register a guest account and use it to manage bookings

Personal data processed: - first name - surname - e-mail address - country

For agencies, to register a B2B account, using the Register your agency form, and use it to manage your relationship with Wonderful Italy

Personal data processed: - name - company name - tax code/VAT number - website link - contact name - e-mail address - telephone number - company address - billing information - any other information you provide in the message text

Subscribe to our newsletter

Personal data processed: - first name - surname - e-mail address

2.1.2 Data we automatically collect from the website

We collect the following data through the services we use: technical data: e.g. IP address, browser type, information about your computer, data about the current (approximate) location of the tool you are using; data collected using cookies or similar technologies. For more information on the types of cookies used and how to disable them, please consult the Cookie Policy.

2.1.3 Data we receive from other sources

In addition to the information you directly provide to us, we may receive other personal data from a variety of sources; this includes our business partners such as affiliates, Wonderful Italy subsidiaries, Online Travel Agencies with whom we work (e.g. Booking, Airbnb, Expedia) etc. We also integrate with third party service providers to facilitate the payment process; they share payment information to help us manage and take care of your booking so that we can provide you with the best possible experience. We also collect information in the unfortunate event that we receive a complaint about you from our partners, for example in the event of misconduct.

3. Purpose of processing and legal basis

The personal data indicated in the preceding paragraph are processed by the Controller for:

3.1) Purposes related to the provision of services requested by you. By way of example:

a) allow the user access to https://www.wonderfulitaly.eu; b) allow the user to book accommodation or an experience c) acquire, confirm and manage your booking for accommodation experiences and services as well as for any ancillary services and, in general, provide you with the services you have requested; this includes sending you communications relevant to your booking such as confirmations, changes and reminders d) allow the user to request general information through the Contact form; e) allow the user to request specific information on the opening of a Hub of Wonderful Italy, through the appropriate form Open a Hub in your area; f) allow tour operators to request specific information to collaborate with us, through the appropriate form Propose your activity; g) allow accommodation owners to contact us to request a free valuation of their property, using the Request an Estimate form; h) allow guests to register a guest account and use it to manage bookings; i) allow agencies to register a B2B account, through the Register your agency form, and use it to manage their relationship with Wonderful Italy; j) manage any disputes that may arise between us; k) assist you and respond to your requests; l) provide assistance to our users. The legal basis for the processing is the performance of an agreement/contract to which the data subject is party or the performance of pre-contractual measures taken at the data subject's request, pursuant to Article 6(1)(b) GDPR.

3.2) Your data will also be processed in order to:

a) send you questionnaires or invite you to provide a review of your experience; we may also arrange for people traveling with you to leave a review. By completing a review you agree to it being displayed online, on our website, on our social media accounts, on our business partners' websites; b) send you alerts/notifications in case of reports of misconduct; c) only for users who have already used our services, pursuant to Article 130, c. 4 of Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, to promote the sale of services (similar or complementary to those already used by you) via your email address, without prejudice to your right to object and no longer receive this type of communication d) to collect statistical information on the use of the site (most visited pages, number of visitors by daily time slot, geographical areas of origin, etc.) and improve its usability for its users. The legal basis in this case is the legitimate interest of the Controller in order to ensure a service that meets its expectations, pursuant to Article 6(1)(f) GDPR.

3.3) Your data will also be processed in order to

a) fulfill obligations provided for by law, by a regulation, by Community legislation; b) respond to an official request from a public or judicial authority. The legal basis for the processing is the fulfillment of a legal obligation to which the Controller is subject, pursuant to Article 6(1)(c) GDPR.

3.4) Finally, with your express consent, your data will also be processed for

a) monitoring phone calls. When you contact our customer care, we may record your call, in order to check the quality and effectiveness of our customer care services; a recorded message will advise you that if you continue the call, your consent to the recording of the same will be deemed to have been given; b) send you - also by email, SMS and MMS - advertising material, newsletters and communications with informative and/or promotional content in relation to the services provided and/or events promoted by the Data Controller, unless you disagree, which can be exercised by means of the unsubscribe links that can be found at the bottom of the communications sent by us; The legal basis for the processing is your express and prior consent, pursuant to Article 6(1)(a) GDPR. c) only upon your explicit request, moreover, in order to provide you with the services you have requested which envisage the processing of particular data and specifically to take advantage, if necessary, of the exemption from tourist tax in accordance with the provisions of Article 4 of Legislative Decree No. 23 of 14 March 2011 and the Municipal Regulations adopted by each Municipality pursuant to Article 52 of Legislative Decree No. 446 of 15 December 1997. In this case, we invite you to give your consent through the dedicated tools made available to you; otherwise, the Data Controller will not be able to provide the services you have requested. The legal basis for the processing, in this case, is your express and prior consent, pursuant to Article 9(2)(a) GDPR

4. Processing methods

The processing of your personal data is carried out by means of the operations indicated in Article 4 n. 2) GDPR and precisely: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data. Your personal data are subject to both paper and electronic and/or automated processing.

5. Data access and communication

Your data may be made accessible for the purposes referred to in points 3.1), 3.2), 3.3) and, subject to your express consent 3.4) sub a) to: - employees and collaborators of the Data Controller in their capacity as authorized and/or internal data processors and/or system administrators - to third party companies or other entities (by way of example, ICT companies, website and payment service providers, consultants, etc.) that perform outsourcing activities on behalf of the Owner, in their capacity as autonomous data controllers or external data processors - business partners (companies controlled by Wonderful Italy, accommodation owners, agencies, tour operators, etc..), in their capacity as independent data controllers or external data processors.

The Data Controller may also communicate your data for the above-mentioned purposes to: - Supervisory Bodies, Judicial Authorities, Police Bodies, Public Bodies and all those subjects to whom communication is obligatory by law for the fulfillment of the aforementioned purposes. Said subjects will process the data in their capacity as autonomous data controllers.

Only with your express and prior consent for the purposes set out in point 3.4) sub b) above, the Controller may communicate your personal data to third party companies such as business partners and event organizers, who will process the data in their capacity as external data processors. Lastly, only with your express and prior consent for the purposes set out in point 3.4) sub c), the Data Controller will communicate your personal data to public bodies (in particular, to the municipality where the accommodation is located) and, in general, to all those subjects to whom communication is compulsory by law in order to take advantage of the exemption from tourist tax; these subjects will act as autonomous data controllers. Your data will not be disseminated.

6. Retention period

Data collected for the purposes set out in points 3.1), 3.2) and 3.3) will be kept for the time strictly necessary to carry out the specified activities. On expiry, the data will be deleted or anonymised, unless there is a further purpose for retaining the data, e.g. for security reasons in the event of possible misuse. In such cases, the Data Controller will retain the personal data acquired for as long as necessary to fulfill legal obligations and/or possibly to assert and/or defend a right in the appropriate forums. Recordings of telephone calls referred to in point 3.4) sub a), on the other hand, will be retained for a maximum of 90 days, after which they will be automatically deleted. The data collected in connection with the purposes referred to in point 3.4) sub b) above, moreover, will be processed and retained until your consent is revoked. Finally, the personal data required, if any, to take advantage of the exemption from the tourist tax referred to in point 3.4) sub c) above, will have to be kept by the Data Controller for 5 years in order to make tax checks by the municipality where the accommodation is located possible.

7. Transfer of data

Personal data are not transferred outside the European Union. In any case, it is understood that, should it become necessary, the Data Controller may also transfer personal data to countries outside the EU, guaranteeing as of now that the transfer of personal data outside the EU will take place in compliance with the applicable legal provisions (starting with EU Reg. no. 679/2016) and therefore entering into, if and to the extent necessary, specific agreements that guarantee an adequate level of protection of personal data or in any case adopting the standard contractual clauses provided by the European Commission for the transfer of personal data outside the EU.

8. Nature of data provision

The provision of data for the purposes referred to in points 3.1), 3.2) and 3.3) is compulsory for all that is required by legal and contractual obligations and therefore any refusal to provide such data in whole or in part may make it impossible for the Controller to execute the contract/carry out its services. The provision of data for the purposes set out in point 3.4) sub a) is optional but necessary in order to provide customer care services through the call center. On the other hand, failure to provide data for the purposes referred to in point 3.4) sub b) of the paragraph "Purposes of processing" will have no consequences in relation to the provision of services. The provision of data for the purposes referred to in point 3.4) sub c) is optional and any refusal will result in the failure to grant the exemption from tourist tax and the impossibility for the Data Controller to provide any services requested by you. With reference to the consequences of non-acceptance and/or removal of cookies, see the Cookie Policy.

9. Rights of the data subject and how to exercise them

We would like to inform you that, at any time and if the prerequisites are met, you may exercise your rights as set out in Articles 15 et seq. of the GDPR: - obtain confirmation of the existence or non-existence of your personal data and a copy thereof in intelligible form; - obtain the updating, rectification or integration of your data - request the deletion of your data, within the terms allowed by law - object, in whole or in part, to the processing of your personal data - limit the processing, in case of violation, request rectification or opposition; - request the portability of electronically processed data provided on the basis of consent or contract - withdraw consent to the processing of your data, where applicable. - in relation to fully automated profiling, obtain human intervention by the Controller to express your opinion and contest the decision.

Should you deem it appropriate, you may lodge a complaint with the Data Protection Authority.

To exercise your rights, you may contact the Data Controller at the following e-mail address: privacy@wonderfulitaly.eu