Privacy Policy Online Booking

Privacy Policy pursuant to Art. 13 GDPR

Alajmo S.p.A. (the "Company"), with registered office in via Liguria n. 1, Sarmeola di Rubano, (PD) (Tax Code/VAT no. 04384890283) is the Data Controller of the personal data you will provide through the "PRENOTA WEB" booking procedure on the website "alajmo.it" (the "Website"). In this Policy, we will also refer to you as "Data Subject", i.e., the person to whom the collected personal data refers.
The Data Controller has appointed a DPO (or "Data Protection Officer"), whom you can contact at privacy@alajmo.it if you have any questions about the use of your data or wish to exercise your legal rights.

What data do we collect?

The following data is collected through the Website:

- Browsing data: the IT systems of the Website collect some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with you, but by its very nature, through processing and association with data held by third parties, it could allow you to be identified. These include: 

• IP address;
• URI (Uniform Resource Identifier) of the requested resources;
• the time and date of interaction with the Website;
• the type of operating system, the browser used, the screen resolution, and other technical information about the device used.

- Data communicated voluntarily:

• Personal data: first name, last name, email address, phone number, last four digits of the credit card, credit card type, expiration date;
• Special categories of data if voluntarily indicated by the Data Subject at the time of booking: food intolerances, or dietary choices for religious reasons.

The data are used, in compliance with applicable law, for the purposes indicated in this Policy. The indication of the requested data is necessary for the Data Controller to perform the services contractually provided. The data you communicate must refer to you or to third parties who have expressly authorized you to provide them, and in this case, by communicating them, you assume the related obligations and responsibilities.

How do we use your data? On what legal bases?

Personal data are processed using IT and/or telematic tools, with organizational methods and logic strictly related to the purposes listed below.
Specific security measures are observed to prevent data loss, illicit or incorrect use, and unauthorized access.
For all occasions in which the Company processes your data, there is a legal basis that legitimizes the processing.
Sometimes your consent is required to process personal data, for example, to allow the installation of profiling cookies, analytical cookies, or to send you newsletters.
Other times, when permitted by law and without prejudice to your fundamental rights, the Company is not obliged to ask for your consent to data processing. This occurs when data is processed due to a legal obligation or following your request, which you submitted by contacting the Company and/or requesting certain services. 
Failure to provide the data indicated as "mandatory" in each form could make it impossible to respond to your request or fulfill a legal obligation to which the Company is subject.
At the end of the retention period, the collected personal data will be irreversibly deleted.

PROCESSED DATA, PURPOSES, LEGAL BASIS/RETENTION PERIOD

Browsing data:
1) to obtain anonymous statistical information on the use of the site and to check its correct functioning;
2) to ascertain responsibility in case of hypothetical cybercrimes against the site and the Data Controller only at the request of the competent supervisory bodies.

6.1.b – Contract (Purpose n.1)
6.1.c – Legal obligation (Purpose n. 2)

Retention period:
for the technical time necessary to fulfill the functions for which they were collected and in any case for a maximum period of 6 months. The Data Controller may be obliged to keep personal data for a longer period in compliance with a legal obligation or by order of an authority.

Data contained in email communications sent to the addresses indicated on the Website or data sent via chat:

1) to respond to your requests.

6.1.b – Contract or pre-contractual measures (Purpose n.1)
6.1.c – Legal obligation (Purpose n.1)

Retention period:
For the time necessary to respond to your request and allow you to exercise your rights. Where necessary, for the time required to fulfill legal obligations or to ascertain, exercise, or defend a right in court.

Data entered in the booking form:
1) to allow you to make a reservation and for the correct execution of the service;
2) to carry out any checks and evaluations on the progress of the execution of the services offered, as well as on the risks associated with them (e.g., veracity of the data provided, solvency in the case of a "no show fee");
3) to contact you if there are problems with the reservation;
4) for marketing purposes.

6.1.b – Contract or pre-contractual measures (Purpose n. 1, 3)
6.1. f – Legitimate interest (Purpose n. 2, 4)

Retention period:
Until the requested service is completed. Only contact data may be processed for purpose n.4 until opposition to processing.

Data collected via cookies:

1) if they are technical cookies, to allow the correct functioning of some sections of the Website;
2) if they are analytical cookies, the data collected with your prior consent will be used to track your visits to the Website and how you used it, in order to improve our services;
3) if they are profiling cookies, the data collected with your prior consent will be used to show you advertisements of your interest on this Website and on the websites of other companies; if you do not accept them, it may happen that you will still see advertisements, but not related to your interests.
For more information, please read the Cookie Policy.

6.1.a – Consent (Purposes nn. 2, 3)
6.1.b – Contract or pre-contractual measures (Purpose n.1)

Retention period:
Until the end of each session or until the end of the retention period provided for each type of cookie, unless consent is revoked.
For more information, please read the Cookie Policy.

Minor users

The services offered through the Website are aimed at adult users. If you are a minor, you must not communicate data to the Data Controller and you cannot use the services offered. If we discover that you are a minor, we will immediately and irreversibly delete all your data, personal and non-personal, as well as any accounts created.

Is my data shared with other parties?

The personal data provided will not be disseminated, meaning it will not be disclosed to unspecified subjects.
However, the data may be communicated to subjects defined by the Data Controller for the indicated purposes, appointed, if necessary, as Data Processors by the Data Controller. By way of example and not exhaustive, the following may have access to the data:

- subjects authorized by us to process, who have committed to confidentiality or have an adequate legal obligation of confidentiality;
- those who maintain the Website and our legal or tax consultants, as autonomous Data Processors or Controllers;
-  public authorities, where required by law or at their request;
- subjects involved in the management of your order. 

The updated list of Processors can always be requested from the Data Controller by writing to privacy@alajmo.it.
In particular, your data provided for using the online booking service will be processed by E-GROUP S.r.l. and LA FOURCHETTE SAS, which have been previously appointed as Data Processors.
If you accept third-party cookies, the data collected by them will be shared with the subjects indicated in our Cookie Policy.
The Website incorporates links to its social media accounts, in order to allow easy access to content disseminated through them. These are simple links to social networking platforms and no data is communicated to these platforms through the Website. Cookies can be activated, if provided by social networks, only when you click on the relevant icons. Please note that if you are browsing while logged into the social network, you have already consented to the use of cookies conveyed through this Website. The collection and use of information obtained from social networks are governed by their respective privacy policies, to which we ask you to refer.

How do I delete my personal data?

The data sent for table booking is not stored once the requested service has been performed.
To learn how to delete cookies, please read our Cookie Policy.

What are my rights as a Data Subject?

We will always guarantee you control over your personal data.
In particular, you have the right to:

- request information about your personal data processed by the Company and request a copy in a structured and readable format;
- not be subject to automated decisions, unless you consent to them;
- ask the Data Controller to correct your data that is inaccurate, delete it, or use it only for certain purposes;
- change your mind and ask us to stop using your data, for example by disabling third-party cookies or deleting your account.

However, please note that in some limited cases we will not be able to fulfill your requests, such as if we are prohibited by law or by order of an Authority.
These requests must be addressed to the DPO who can be contacted at the following email address: privacy@alajmo.it
In any case, you have the right to lodge a complaint with the competent supervisory authority (Garante per la Protezione dei Dati Personali - Italian Data Protection Authority) if you believe that the processing of your personal data is contrary to current regulations.

Where is my data stored?

Your data may be transferred abroad by the Data Processors. Data collected through third-party cookies may be transferred to third countries in accordance with what is indicated in our Cookie Policy and the privacy policies of third parties. However, it is specified that the Data Processors declare that such third countries guarantee an adequate level of protection of the Data Subject's rights by virtue of compliance with one or more of the conditions provided for in Articles 45-47 of the GDPR. It is also acknowledged that, in the event that the service providers are US companies, US government authorities may access such data, if the conditions provided by law are met.

How will I be informed of any changes to this Policy?

The Company will update this Policy when it deems it necessary. If there are substantial changes, particularly with regard to the purposes for which we use your personal data, we will inform you by email, to the address indicated during account registration, if you have a registered account or have made purchases through e-commerce.
If you do not agree with the changes, you can always stop using our services, by deleting your account and/or ceasing to communicate further personal data to us.