Versione italiana →

Privacy Policy

Information on the processing of personal data
Users of the TL – Travel&Learn website

Pursuant to Regulation (EU) 2016/679 (the “Regulation”) and Italian Legislative Decree No. 196/2003 (collectively, the “Applicable Legislation”), this document describes the general arrangements for processing the personal data of users and/or any personal data of third parties provided by users (collectively, “Personal Data”) who interact with the Travel and Learn website of TEMPO LIBERO – SOCIETA’ COOPERATIVA SOCIALE ONLUS, accessible at https://www.travelandlearn.org.

This information does not apply to other websites, pages or online services accessible through hyperlinks that may be published on this website and/or refer to resources outside the above domain.

Personal Data will be processed in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

Specific security measures are implemented to prevent loss of personal data, unlawful or improper use and unauthorised access.

Data controller

The data controller is TEMPO LIBERO – SOCIETA’ COOPERATIVA SOCIALE ONLUS (the “Controller”), Italian tax code 02891720175, with registered office at Via XX Settembre 72, 25121 Brescia (BS), Italy. Contact details: telephone 0302808358; certified email (PEC): cooptempolibero@pec.it.

Categories of personal data processed, purposes and legal bases

Browsing data

During normal operation, the computer systems and software procedures used to operate this website acquire certain personal data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected to be associated with identified individuals. However, by its nature, it could enable users to be identified through processing and combination with other data held by third parties.

This category includes IP addresses or domain names of the computers used by visitors, the URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file returned, the numerical code indicating the status of the server’s response (successful, error, etc.) and other parameters relating to the user’s operating system and computer environment.

These data, which are necessary to use the web services, are also processed to:

  • obtain statistical information on use of the services, such as the most visited pages, visitor numbers by time of day or day, and geographical areas of origin;
  • check that the services offered are operating correctly.

Browsing data are retained for no longer than seven days and are deleted immediately after aggregation, except where the judicial authorities require them to investigate criminal offences.

Cookies and other tracking systems

Information about what cookies are and how they are used on this website is available in the dedicated “Cookies” section of the website.

Data provided voluntarily by users

Except as specified for browsing data, users are free to provide Personal Data. Sending messages voluntarily, explicitly and optionally to the contact addresses, or completing and submitting forms on the website, entails acquisition of the Personal Data needed to respond to and fulfil the requests submitted, and processing of those data for these purposes.

In general, in addition to responding to requests, Personal Data will be processed for the following purposes:

  • distribution of promotional and/or informational and/or educational material by email, traditional post, telephone, fax, newsletters, text messages, SMS and MMS (legal basis: consent);
  • aggregate statistical analysis and market research (legal basis: consent).

Processing methods

Personal Data provided and/or collected through the website are processed in accordance with applicable legislation, mainly using computer-based tools but also on paper. Appropriate security measures are used against the risks of destruction or loss, alteration, unauthorised disclosure or access, or processing inconsistent with the purposes for which the data were collected.

Personal Data will be retained for the time needed to fulfil the purposes for which they were collected and, in any event, until consent is withdrawn. They will be deleted within 30 days of the date on which the Controller receives the withdrawal of consent.

Recipients of the data

The Personal Data collected will be processed by authorised persons, in particular the Controller’s internal staff and/or collaborators, who are duly trained and authorised under specific instructions issued by the Controller in accordance with applicable legislation and the purposes and methods of processing.

Personal Data will also be disclosed to parties used by the Controller to carry out activities necessary to achieve the purposes described above, including, for example:

  • processors and any sub-processors in accordance with Article 28 of Regulation (EU) 2016/679;
  • companies and/or third parties providing technical coordination, support and maintenance of computer systems for the Controller;
  • more generally, companies and/or third parties, including professionals, providing assistance to the Controller.

The updated list of processors and persons authorised to process data is kept at the Controller’s registered office. Personal Data will not, in any event, be disseminated to the public.

Retention period

Contractual and legal obligations

Data, including log files and IP addresses needed to demonstrate that a purchase has taken place or to prevent and investigate possible fraud in online transactions, will be retained for the time strictly necessary to achieve the purposes for which they were collected and, in any event, within the statutory limitation periods. Longer retention may be necessary to establish, exercise or defend a legal claim, or may be required by law or by orders of the authorities.

Data processed on the basis of consent

Data processed on the basis of consent will be retained until the purpose for which they were acquired has been achieved or until consent is withdrawn. Longer retention may be necessary to establish, exercise or defend a legal claim, or may be required by law or by orders of the authorities.

Deletion from the website

Data will be retained solely for administrative purposes for no longer than the statutory limitation period, subject to the provisions of the preceding section on contractual and legal obligations.

Transfers of data outside the European Union

Data are not transferred outside the European Union. If any data need to be transferred abroad to locations outside the European Union, the transfer will in any event comply with the safeguards required by the GDPR for this type of activity.

Rights of data subjects

Data subjects have the following rights:

  • Access: to obtain confirmation as to whether personal data concerning them are being processed and, if so, access to those data, including a copy.
  • Rectification: to obtain correction of inaccurate personal data concerning them and/or completion of incomplete personal data without undue delay.
  • Erasure (the right to be forgotten): to obtain deletion of personal data concerning them without undue delay.
  • Restriction of processing: to obtain restriction of processing in the cases set out in Article 18 of the Regulation.
  • Data portability: to receive from the Controller personal data concerning them in a structured, commonly used, machine-readable format, and to transmit those data to another controller without hindrance, where processing is based on consent and is carried out by automated means; also to have the data transmitted directly to another controller where technically feasible.
  • Objection: to object at any time, on grounds relating to their particular situation, to processing based on legitimate interests, performance of a task in the public interest or exercise of official authority, including profiling, unless the Controller has compelling legitimate grounds that override the data subject’s interests, rights and freedoms, or processing is necessary to establish, exercise or defend legal claims. Data subjects also have the right to object at any time to processing for direct marketing purposes, including profiling insofar as it relates to direct marketing.
  • Withdrawal of consent: to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
  • Lodging a complaint: to lodge a complaint with the Italian Data Protection Authority, following the instructions available at www.garanteprivacy.it.