Privacy Policy

**Privacy Policy:**

**INFORMATION PURSUANT TO ART. 13 OF EU REGULATION 679/2016**

1. **Introduction**

At Lu Ciaccaru srl, your privacy and the security of your personal data are of utmost importance. We collect and process your data with the highest care and attention, while adopting specific and adequate technical and organizational measures to ensure full security in processing.

Therefore, we inform you, pursuant to Article 13 of the European Regulation 2016/679 ("GDPR" or "Regulation") and the Privacy Code ("Privacy Code"), as amended by Legislative Decree 101/2018 (collectively, the "Regulations"), that your personal data are processed in ways that guarantee security and confidentiality and are carried out using paper, IT, and telematic supports, as detailed in this privacy policy.

2. **Data Controller**

Your personal data is processed by Lu Ciaccaru srl (hereinafter referred to as "Lu Ciaccaru" or "Controller"), with registered office at Località Lu Ciaccaru (Strada Arzachena/S. Antonio di Gallura) 07021 Arzachena (OT), acting as the Data Controller under the terms of the Regulation.

For any questions or requests related to the processing of your personal data, you can contact the Company at any time by sending a request to the following contacts:

**Data Controller**

Company Name: Lu Ciaccaru srl  
Registered office address: Località Lu Ciaccaru (Strada Arzachena/S. Antonio di Gallura) 07021 Arzachena (OT)  
Phone contact details: +39 0789844001, +39 078981947, +39 335 7989844  
Email contact details: info@stazzoluciaccaru.it  

3. **Type of Data Processed, Purposes, and Legal Basis for Processing**

The personal data processed by the Company are those you provide while browsing or using the online services offered by the Company through the website www.stazzoluciaccaru.it.

The Company may collect data such as personal information including name, surname, email, phone number, your requests, and browsing data.

No special data under Art. 9 GDPR or data relating to criminal convictions and offenses under Art. 10 GDPR are processed.

Once collected, your personal data are processed for the following purposes:

- To assess your experience using our websites, the services we offer, and to ensure the proper functioning of our web pages and their content. The processing activities for these purposes are based on the legitimate interest of the Controller and do not require specific consent from the data subject.
- To comply with obligations established by laws, regulations, or European legislation. The processing activities for these purposes are necessary to fulfill legal obligations and provide the requested service, and do not require specific consent from the data subject.
- Subscription to our Newsletter service. Processing for these purposes is carried out with the specific and voluntary consent provided by the user.
- Carrying out direct promotional activities, including sending newsletters and other promotional materials to the email address you voluntarily provided when registering on the Website. Processing for this purpose is carried out with the specific consent provided by the user, except for commercial communications regarding products and/or services similar to those already purchased and/or subscribed by the user, for which the processing is based on the Controller’s legitimate interest.

Your personal data are processed exclusively by the Company’s personnel who are specifically authorized and designated pursuant to Art. 4 paragraph 10 of the Regulation and Art. 2-quaterdecies of the Privacy Code, who have been properly trained concerning regulatory privacy obligations, and who process data following precise instructions from the Data Controller.

4. **Data Processors Under Art. 28 and Data Recipients**

Your personal data may also be transmitted to third parties we work with. These parties have been carefully selected by us and offer adequate guarantees for compliance with personal data processing regulations. If they process data on behalf of Lu Ciaccaru, they have been appointed as Data Processors pursuant to Art. 28 of the Regulation and are required to perform their activities based on specific instructions from the Company and under its supervision.

These third parties may belong to the following categories: financial operators; internet providers; IT service providers; consultancy firms; cloud service providers. Additionally, your data may be communicated to third-party companies operating in the publishing sector and to companies operating in the following sectors, with which Lu Ciaccaru may conclude digital marketing partnership agreements for hotels. A specific and updated list of these subjects is available at the Data Controller’s registered office and can be consulted upon request by the data subject.

For administrative purposes, we inform you that your data may be communicated by the Controller to other companies in the Group.

It is understood that your personal data will not be disclosed to third parties for their promotional purposes and will not be in any way disseminated.

Your data may also be transmitted to public authorities to comply with legal obligations or to law enforcement and judicial and administrative authorities, in accordance with the law, for the detection and prosecution of crimes, the prevention of threats to public security, and to enable the Company to exercise or defend its rights in court, as well as for other reasons related to the protection of the rights and freedoms of others.

5. **Mandatory or Voluntary Data Provision**

While data provision is generally voluntary, please note that:

- The provision of data for purposes A) and B) as outlined in paragraph 3 is mandatory. Failure to provide such data will make it impossible for the Company to establish any relationship with you or allow you to use the website.
- The provision of data for purposes C) and D) as outlined in paragraph 3 is optional. Failure to provide data will result in the inability to subscribe to the newsletter service or benefit from the promotional services offered by the Company.

6. **Transfer of Data Outside the EU**

Some of the third parties to whom data are transferred may be located in countries outside the European Union, including as a result of the use of cloud services implemented by the Company. This transfer occurs to countries that offer an adequate level of data protection, as established by specific decisions of the European Commission.

The transfer of your personal data to third parties residing or located in countries outside the European Union, which do not guarantee adequate levels of protection, will only be carried out with your consent or after the conclusion of specific agreements between the Company and such parties containing appropriate safeguards, such as "standard contractual clauses" approved by the European Commission.

7. **Data Retention**

Your data will be stored for a limited period of time, which varies depending on the type of processing activity and the specific purposes, as outlined below:

- Data collected in the context of using the services offered by the Company: these data are retained for the entire duration of the service until it ends or the user cancels their subscription, or withdraws their consent;
- Data collected for sending newsletters or carrying out promotional activities (purposes C) and D) in paragraph 3): until the user requests to stop the activity, and in any case within 2 years from the last interaction with the Company.

After these periods, your data will be permanently deleted or anonymized by the Company.

8. **Your Rights**

We inform you that you have the right to exercise the following rights concerning your personal data under the Regulation:

- **Right of access and rectification** (Articles 15 and 16 of the Regulation): You have the right to access your personal data and request their correction, modification, or supplementation. If you wish, we will provide you with a copy of the data we hold.
- **Right to data erasure** (Article 17 of the Regulation): In the cases provided for by applicable law, you can request the deletion of your personal data. Once we receive and assess your request, we will stop processing and delete your data if it is legitimate.
- **Right to restrict processing** (Article 18 of the Regulation): You have the right to request the restriction of processing your personal data in cases of unlawful processing or data inaccuracies.
- **Right to data portability** (Article 20 of the Regulation): You have the right to request that the Data Controller provides your personal data to you so that they can be transferred to another Controller, where applicable.
- **Right to object** (Article 21 of the Regulation): You have the right to object to the processing of your personal data carried out based on our legitimate interest, explaining the reasons for your request. The Company will evaluate these reasons before proceeding.
- **Right to lodge a complaint** (Article 77 of the Regulation): You have the right to lodge a complaint with the relevant Data Protection Authority if you believe that your rights concerning the processing of your personal data have been violated.

You may exercise your rights regarding the specific processing of your personal data by the Company at any time.

These rights may be exercised via email at info@stazzoluciaccaru.it or by regular mail at: Lu Ciaccaru srl, Località Lu Ciaccaru (Strada Arzachena/S. Antonio di Gallura) 07021 Arzachena (OT).

Further information on the rights of the data subject can be obtained by requesting a full extract of the relevant articles from the Controller.

9. **Security Measures**

The Company adopts appropriate security measures to safeguard the confidentiality, integrity, completeness, and availability of personal data. Measures are implemented to prevent damages, accidental losses, alterations, misuse, and unauthorized access to the data processed.

Furthermore, the Controllers cannot be held responsible for the accuracy of information sent directly by the user (e.g., correctness of email or postal address) or for information concerning the user provided by a third party, including fraudulently.

10. **Changes to this Privacy Policy**

The continuous evolution of our services may result in changes to the characteristics of personal data processing. This privacy policy may undergo changes and additions over time, necessary due to new legal requirements regarding personal data protection or the evolution of

 our services.

We invite you, therefore, to periodically check this page. Where possible, we will try to inform you of any significant changes, including via email or through other communications.

11. **Contact Information**

If you have any questions regarding our privacy policy, please feel free to contact us via email at info@stazzoluciaccaru.it.