Mandarin Oriental, Milan

Privacy Policy

INFORMATION ON THE WEBSITE IN ACCORDANCE WITH ARTICLES 13 AND 14 OF THE EUROPEAN REGULATION 2016/679 (GDPR)

Summary information is progressively provided or displayed on the pages of the site designed for specific services upon request that involve forms for data collection. We also inform you that, in order to provide a complete service, our website may contain links to other websites, not managed by BLUVACANZE SPA. BLUVACANZE SPA is not responsible for errors, content, cookies, publication of illegal content, advertisements, banners, or files that do not comply with current regulations and the respect for Privacy rules by websites not managed by the Data Controller.

BLUVACANZE SPA, as Joint Data Controller of your personal data, together with MD S.p.A., pursuant to Articles 13 and 14 of European Regulation 2016/679, hereby informs you that the aforementioned regulation ensures the protection of data subjects in relation to the processing of personal data and that such processing will be based on the principles of fairness, lawfulness, transparency, and safeguarding your privacy and rights. The information and personal data you provide or otherwise acquire through the use of the website will be processed in accordance with the legislative provisions of the aforementioned regulation and the confidentiality obligations outlined therein.

DATA SUBJECTS AND RETENTION PERIOD

A) Users (browsers) of the website md-viaggi.itType of Data Processed:

Browsing Data: IP addresses or domain names of the computers and other devices used by users who connect to the site; URI (Uniform Resource Identifier) addresses of the requested resources and any temporal indications of the same; parameters relating to the user’s operating system and IT environment; starting and ending pages; navigation index and identifying behaviors during the viewing of pages on the site.Personal Data Provided Voluntarily by the User: the optional, explicit, and voluntary sending of emails to the addresses indicated on this site and the completion of forms present on the site results in the subsequent acquisition of the sender’s personal data (e.g., name, surname, email address). Specific summary information is available on the pages with forms.

Purpose of Data Processing: The data collected during your navigation will be processed for the following purposes:

Performing operations strictly related and instrumental to managing relationships with users or visitors of the site;Collecting, storing, and processing your data for statistical analysis, even in anonymous and/or aggregated form; statistical analysis aimed at verifying the quality of services offered on the site;Sharing interactions and usage data with social network operators related to pages where cookies are installed, integrating products or software features;Improving the browsing experience in order to send services and advertisements in line with preferences expressed during browsing.

The processing of data for the purposes outlined in point 1 is necessary to fulfill your request, and refusal may limit and/or prevent full use of the site’s functionalities and services. The legal basis for the processing of your data for the purposes of point 1 is the fulfillment of your request, under Article 6.1.b.) of the GDPR. Refusal to provide such data would prevent you from consulting the site. The provision of data for purposes 2, 3, and 4 is optional, based on consent, and refusal to process these does not affect the site’s functionalities and services. The legal basis for processing your data for purposes 2, 3, and 4 is consent, under Article 6.1.a). Consent is given by clicking on the “ACCEPT ALL” button in the brief information. More information regarding the cookies on the site is provided in the cookie policy document, also accessible from the brief notice.

Browsing data are stored for the times indicated in the cookie policy available on the site.

COOKIES AND OTHER TRACKING SYSTEMS

Your data is also collected through tools and services provided by third parties and stored by them. For more information, refer to the "cookie policy" document.

Please note that BLUVACANZE SPA only acts as an intermediary for the links in the cookie policy and cannot assume any responsibility for potential changes.

METHODS OF PROCESSING PERSONAL DATA

Your personal data will be processed manually, electronically, and/or telematically, using cookies (as indicated in the cookie policy available on the site) through electronic devices using third-party software, in compliance with Articles 6 and 32 of the GDPR, and through the adoption of appropriate security measures.

USE OF SOCIAL PLATFORMS

BLUVACANZE SPA may also provide links to other social media platforms that lead to servers installed by individuals or organizations over which it has no control. BLUVACANZE SPA makes no representations and assumes no responsibility for the accuracy or any other aspect of the information available on such sites. The link to a third-party site should not be understood as an endorsement by BLUVACANZE SPA or the third party of the products and services of others. BLUVACANZE SPA does not make any statements or warranties regarding the use or storage of user data on third-party sites. Users are encouraged to carefully review the privacy policy of third-party sites linked to our website to fully understand the possible use of their personal data.

RECIPIENTS OF PERSONAL DATA AND DISCLOSURE OF DATA

Your data will be processed by duly authorized personnel and communicated externally to companies acting as independent Data Controllers or Data Processors:

External parties providing cloud services;Companies providing services for managing the IT system, including hosting services for servers and backups.

The full list can be requested by writing to the Data Controller’s contact details.

Your data will not be subject to dissemination.

TRANSFER OF PERSONAL DATA

Your data may be transferred to non-EU countries, as indicated in the Cookie Policy of third-party cookie service providers. For more information, contact rpdblu@bluvacanze.it.

MINORS

The site is not intended for use by minors, and the Data Controller does not collect minors’ data. If the Data Controller becomes aware of such data collection (e.g., via the contact form), the data will be immediately deleted. The Data Controller will respond to information requests in accordance with applicable laws. It is reminded that the person exercising parental responsibility must consent to the collection of personal data of a minor in case of an information request.

JOINT DATA CONTROLLERS

The Joint Data Controller is BLUVACANZE SPA, located at Piazzale Lorenzo Lotto, 2 – 20148 Milan (MI), represented by its legal representative. The Data Controller has appointed the Data Protection Officer available at rpdblu@bluvacanze.it.

Another Joint Data Controller is MD S.p.A., located in Gricignano Di Aversa (Ce) Zona Industriale A.S.I. Capannone N.18, processing personal data solely for the purpose of executing and managing the commercial collaboration agreement with Blu Vacanze. The company does not appoint a Data Protection Officer (DPO). Contact email: privacy@mdspa.it.

You have the right to request from the joint controllers the erasure, restriction, updating, rectification, portability, or opposition to the processing of your personal data, as well as to exercise all rights provided for by Articles 15 and following of the GDPR by writing to rpdblu@bluvacanze.it or using the request form in the privacy section of the website. The data subject has the right to file a complaint with the Supervisory Authority.

APPLICATION OF THIS NOTICE

If you have any questions about this Privacy Policy, please contact BLUVACANZE SPA by sending an email to rpdblu@bluvacanze.it or by contacting the Data Controller through the provided company details.

MODIFICATIONS TO THIS PRIVACY NOTICE

BLUVACANZE SPA reserves the right to update this notice to comply with new legislation, as well as to take into account suggestions from employees, customers, collaborators, and users. In the event of changes by BLUVACANZE SPA, the Privacy Notice on the main privacy page and the homepage of the website www.bluvacanze.it will be promptly updated.

RIGHTS OF THE DATA SUBJECT

EU Regulation 2016/679: Articles 15, 16, 17, 18, 19, 20, 21, 22 – Rights of the Data Subject

1. The data subject has the right to obtain confirmation as to whether or not personal data concerning them exists, even if not yet recorded, and to have the data communicated in an intelligible form, as well as the right to file a complaint with the Supervisory Authority.
2. The data subject has the right to obtain the following information:

◦ the origin of the personal data;

◦ the purposes and methods of processing;

◦ the logic applied in the case of processing carried out with the use of electronic tools;

◦ the identification details of the data controller, data processors, and the designated representative according to Article 5, paragraph 2;

◦ the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them as representatives designated in the State, data processors, or personnel authorized to process the personal data.

3.The data subject has the right to obtain:

◦ the updating, correction, or, when relevant, the integration of data;

◦ the deletion, transformation into anonymous form, or blocking of data processed in violation of the law, including data that are no longer necessary to be stored in relation to the purposes for which they were collected or subsequently processed;

◦ confirmation that the operations referred to in items a) and b) have been brought to the attention of those to whom the data have been communicated or disseminated, except in cases where this is impossible or involves a clearly disproportionate effort compared to the protected right;

◦ data portability.

4.The data subject has the right to object, in whole or in part:

◦ for legitimate reasons, to the processing of personal data concerning them, even if relevant to the purpose of the collection;

◦ to the processing of personal data for the purpose of sending advertising material, direct selling, or conducting market research or commercial communication.