Information ex art. 13 EU Regulation 2016/679 (GDPR)
Dear User,
Coast Edutainment S.p.A. communicates below the information, referred to in Article 13 EU Regulation 2016/679 (GDPR), regarding the processing of personal data you have provided by completing this form.
Data controller
The Data Controller is Costa Edutainment S.p.A. P.IVA 03362540100, with registered office in Riccione (RN), Via Ascoli Piceno n. 6, c.a.p. 47838 (RN), in the person of its legal representative pro tempore (hereinafter referred to as "Society" o "Holder“).
Contact information Data Processor
The Data Protection Officer (DPO) or Data Protection Officer can be reached at e-mail: dpo@costaedutainment.com or by regular mail by writing to the Company's administrative office located in Genoa, Porto Antico Area - Ponte Spinola Ambrogio sn, c.a.p. 16128 (GE), to the attention of the same.
Purpose of processing
Your personal data will be processed, including by computer and electronic means, for the purpose of:
- respond to your request for information;
- Send you, with your consent, information about the Company's services, products and commercial initiatives by means of automated methods (e.g., e-mail, SMS, WhatsApp etc.);
- Communicate your personal data to third parties, subject to your consent, so that they can send you commercial information regarding their products or services, including by automated means. The third parties to which your data may be disclosed are the subsidiaries, affiliates or investees of the Data Controller or other third-party companies operating in the entertainment sector marked by the qualitative use of leisure time, combining culture, science, education, entertainment and nature.
Legal basis for processing
The legal basis justifying the aforementioned processing for the purpose mentioned in point 1 above is Article 6 paragraph 1 letter b) of the GDPR i.e. processing necessary within the framework of a contract or for the purpose of concluding a contract.
The legal basis for the above processing for the purposes mentioned in 2 and 3 above is your consent.
Consequences of not providing personal data
Failure to provide your personal data for the purpose mentioned in point 1 will result in the Company being unable to respond to your requests for information.
Period of retention of personal data
Your personal data will be kept, for the purpose mentioned in 1, for the period necessary to process your request for information.
Your personal data will be kept, for the purposes mentioned in 2 and 3, for a period of 24 months from the date of their disclosure.
Data recipients
The manager of the Company's website may have access to your personal data. In the case of your consent to receive commercial communications, may, likewise, have access to your personal data by the entities that provide the services of sending commercial communications.
Each of the above individuals acts as a Data Processor appointed by the Controller pursuant to Article 28 of the GDPR.
The full list of appointed data controllers, which by its nature is changeable, is available in an always-updated version by making a request to the Controller at any time by writing to privacy@costaedutainment.com.
Subject to your consent, your personal data may be disclosed to subsidiaries, affiliates or investees of the Owner or other third-party companies operating in the entertainment sector marked by the qualitative use of leisure time, combining culture, science, education, entertainment and nature.
They can, also, have access to your personal data, the employees of the Company, defined as data processors, if the task of these employees requires it. Each processor is specifically identified, authorized and trained, and acts on the basis of specific instructions provided by the Company regarding the purposes, methods of such processing and the security measures to be taken for the protection of personal data.
Rights of the Interested Party
The Data Controller informs you that you, as a Data Subject, have the right, pursuant to Art. 15 et seq. EU Regulation 2016/679, and within the limits prescribed therein, to:
- Obtain data and information about the processing, particularly in relation to the type of personal data processed, the purposes for which the personal data are processed, the period of processing, and the parties to whom the data are disclosed (c.d. right of access);
- Obtain rectification or supplementation of inaccurate personal data concerning you (c.d. right of rectification);
- Obtain the deletion of personal data concerning you in the following cases: (i) the personal data are no longer necessary for the purposes for which they were collected; (ii) you have withdrawn your consent to the processing of personal data, if they are processed on the basis of such consent; (iii) you have objected to the processing of personal data concerning you if they are not processed for a legitimate interest of the Controller; (iv) the processing of personal data does not comply with the law. However, the retention of your personal data by the Controller is lawful if it is necessary to enable the Controller to comply with a legal obligation or to establish, exercise or defend a right in court (c.d. right of cancellation);
- obtain that the personal data concerning you be only retained without any other use of them in the following cases: (i) you contest the accuracy of the personal data, for the period necessary to allow the Controller to verify the accuracy of such personal data; (ii) the processing of the personal data is unlawful you object, however, to the deletion of the personal data by the Controller; (iii) the personal data are necessary for the establishment, exercise or defense of a legal claim; (iv) you object to the processing and are awaiting verification as to whether the Controller's legitimate grounds for processing, if any, prevail over yours (c.d. right of limitation);
- Submit opposition at any time to the processing of data and in particular to the processing of data processed for direct marketing purposes (c.d. right of objection);
- Receive in a commonly used, machine-readable and interoperable format the personal data concerning you, if they are processed under a contract or on the basis of your consent, and/or request to transmit the data to another data controller, if feasible (c.d. right to portability);
- withdraw consent at any time to the processing for which it is requested. Withdrawal of consent does not affect the lawfulness of the processing based on consent prior to withdrawal.
The above rights may be exercised by you by writing to the Holder by e-mail at the address dedicated to privacy@costaedutainment.com or by writing by mail to the administrative headquarters of Costa Edutainment S.p.A., located in Genoa, Area Porto Antico - Ponte Spinola Ambrogio sn, c.a.p. 16128 (GE).
You also have the right not to be subjected to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or that significantly affects you in a similar way.
Right of complaint
If you believe that the processing of your personal data by the Data Controller occurs in violation of the provisions of the EU Regulation 2016/679, you have the right to lodge a complaint with the Office of the Privacy Guarantor, as provided for in Article 77 of the EU Regulation 2016/679 (by e-mail, at: garante@gpdp.it, or by mail, to the Guarantor for the Protection of Personal Data, located in Rome (Italy), Piazza Venezia 11 Scala B, zip code 00187), or to take appropriate legal action, as provided for in Art. Art. 79 of EU Regulation 2016/679.
The Holder
Coast Edutainment S.p.A.
