PRIVACY POLICY - Information pursuant to art. 13 of EU Regulation 679/2016

Dear user,

The "Privacy Policy" of this site is available on this page and has the purpose of providing information on how the personal data of users who interact with this website, who use the services rendered by it to users, are processed, as well as to provide the information required by art. 13 of EU Regulation 2016/679.

This information is provided only for this site and not for other websites that may be consulted by the user via links on the web pages of this site.

Regulation (EU) 2016/679 on the protection of personal data (hereinafter, the “Regulation”) establishes rules relating to the protection of natural persons with regard to the processing of personal data, as well as rules relating to the free movement of such data and protects the fundamental rights and freedoms of natural persons, with particular reference to the right to protection of personal data.

The art. 4, no. 1 of the Regulation provides that "Personal Data" means any information relating to an identified or identifiable natural person (hereinafter, "Data subject").

"Processing" must instead mean any operation or set of operations, carried out with or without the aid of automated processes and applied to Personal Data or sets of Personal Data, such as the collection, recording, organisation, structuring, preservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction (art. 4, n. 2 of the Regulation).

Pursuant to the articles. 12 et seq. of the Regulation, it is also envisaged that the data subject must be made aware of the appropriate information relating to the processing activities carried out by the data controller and the rights of the interested parties.

DATA CONTROLLER

Cdl Franco D’Onghia

Via Pietro della Valle, n. 13

00193 Rome ((Italy)

E-mail: francodonghia@studiodonghia.it

Tel: +39 335 6539545

www.studiodonghia.it

VAT Number: 06375711006

​

DATA, PURPOSE AND LEGAL BASIS OF THE PROCESSING

The user's personal data will be processed for the pursuit of the following purposes and with the legal bases indicated below:

1. in order to conclude a contract with the data subject, execute it, respond to requests for information relating to the products/services provided by the Data Controller, the legal basis for the listed processing is represented by art. 6 par. 1 letter b) of EU Regulation 2016/679 (“processing is necessary for the execution of a contract of which the data subject is a party or for the execution of pre-contractual measures adopted at the request of the data subject”);

2. periodically send, via remote communication technologies (email, telephone, SMS, WhatsApp), commercial communications on the services, products and activities offered by the Data Controller; the legal basis is represented by consent as provided for by the art. 6 par. 1 letter a) of EU Regulation 2016/679;

3. send emails for the purpose of commercial and promotional information for the sale of our products/services, of the same type as previous purchases by the data subject, unless the data subject refuses to process, which may be objected to at any time; the legal basis for this type of processing is represented by the legitimate interest of the Data Controller as provided for in art.6 par. 1 letter f);

4. respond to requests sent by the user via email and/or form on the site; the legal basis for the listed data processing is represented by the art. 6 par. 1 letter b) of EU Regulation 2016/679;

5. make navigation of the site possible and functional, as well as guarantee an adequate level of security, integrity and availability; the legal basis for this type of processing is represented by the legitimate interest of the Data Controller as provided for in art.6 par. 1 letter f);

6. analysis of statistical data on aggregate or anonymous data, with the aim of monitoring the correct functioning of the Site, traffic, usability and interest; the legal basis for this type of processing is represented by the legitimate interest of the Data Controller as provided for in art.6 par. 1 letter f);

7. establish, exercise or defend a right in court; the legal basis for this type of processing is represented by the legitimate interest of the Data Controller as provided for in art.6 par. 1 letter f);

8. to fulfill the obligations established by law, by a regulation, by community legislation or by an order from the Authority; the legal basis for this type of processing is represented by art.6 par.1 letter. c).

 

DATA TYPES

The data necessary for the pursuit of the purposes set out above will be collected and processed:

• identification data

• contact details

• data relating to the contractual relationship

• data relating to bookings of stays and services

• data relating to payment procedures

 

BROWSING DATA

The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This is information that is not collected to be associated with identified interested parties, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes the IP addresses or domain names of the computers used by users who connect to the site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user's IT environment.

These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and are deleted immediately after processing.

The data could be used to ascertain responsibility in case of hypothetical computer crimes against the site.

 

REFUSAL TO PROVIDE DATA

Apart from what is specified for navigation data, users/visitors are free to provide their personal data. The provision of data is in some cases necessary because any refusal to provide it could lead to the failure to conclude or incorrect fulfillment of the contract of which the data subject is a party and/or failure to comply with the legal obligations to which the Data Controller is subject.

The provision of Data for processing that requires consent is optional, failure to provide it will not make it impossible to use the products/services offered by the Data Controller. Even in the case of consent, the data subject will still have the right to subsequently object, in whole or in part, to the processing of their personal data for the purposes set out above, by simply making a request to the Data Controller at the addresses indicated above.

 

Data source

The Data will be provided by the data subject.

 

DATA PROCESSING

In compliance with the provisions of the art. 5 of the Regulation, the Personal Data processed will be:

1. processed in a lawful, correct and transparent manner towards the data subject;

2. collected and recorded for specific, explicit and legitimate purposes, and subsequently processed in terms compatible with these purposes;

3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

4. accurate and, if necessary, updated;

5. processed in a manner that guarantees an adequate level of security;

6. stored in a form that allows identification of the data subject for a period of time not exceeding the achievement of the purposes for which they are processed.

The processing will be carried out both with manual and/or IT and telematic tools with organization and processing logic strictly related to the purposes themselves and in any case in such a way as to guarantee the security, integrity and confidentiality of the data themselves in compliance with the organisational, physical measures and logics envisaged by the provisions in force.

 

DATA COMMUNICATION

The personal data may be communicated to the subjects authorized to process it, as well as to the external data processors appointed by the Data Controller (the complete list of external data processor is available from the Data Controller), responsible for managing the purposes set out above. As part of the pursuit of the purposes indicated above, the data may be communicated to other subjects acting as independent data controllers.

The data may be communicated to:

• companies and consultants, in the field of legal, accounting and tax assistance and consultancy;

• entities that provide services for the management of the information system and telecommunications networks; including email, website management and newsletters;

• companies that collaborate with the Data Controller for direct marketing activities;

• banks and other financial institutions for the management of payments and collections.

The information may also be communicated whenever communication may be necessary to comply with requests from the Judicial or Public Security Authorities.

 

DATA DISSEMINATION

Personal data will not be disclosed.

 

TRANSFER OF DATA ABROAD

For the purposes indicated above, Personal Data will be processed within the European Economic Area (EEA). If they are transferred to Third Countries, in the absence of an adequacy decision from the European Commission, the provisions of the applicable legislation regarding the transfer of Personal Data to third Countries will still be respected, such as the Standard Contractual Clauses provided by the European Commission.

 

DATA RETENTION PERIOD

In general, Personal Data will be retained for the time strictly necessary to achieve the purposes for which they were collected and processed, including the retention period required by applicable legislation and, in any case, for a maximum period of 10 years from termination. of the relationship with the Data Controller and for a maximum period of 2 years for the purposes for which your consent is required, except for any need for the Data Controller to defend his rights in court.

 

RIGHTS OF THE DATA SUBJECT

Pursuant to EU Regulation 2016/679 articles. 15 et seq. and the national legislation in force, the data subject may, according to the methods and within the limits established by the legislation in force, exercise the following rights:

​

Art. 15 Right of access by the data subject

The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed and, in this case, to obtain access to the personal data and the following information:

a) the purposes of the processing;

b) the categories of personal data in question;

c) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients are from third countries or international organisations;

d) when possible, the expected retention period of personal data or, if this is not possible, the criteria used to determine this period;

e) the existence of the right of the data subject to ask the data controller to rectify or delete personal data or to limit the processing of personal data concerning him or to oppose their processing;

f) the right to lodge a complaint with a supervisory authority;

g) if the data are not collected from the data subject, all available information on their origin;

h) the existence of an automated decision-making process, including profiling referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the data subject.

If personal data are transferred to a third country or to an international organisation, the data subject has the right to be informed of the existence of adequate guarantees pursuant to Article 46 relating to the transfer.

The data controller provides a copy of the personal data being processed. In case of further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. If the data subject submits the request by electronic means, and unless the data subject indicates otherwise, the information is provided in a commonly used electronic format.

The right to obtain a copy of your personal data must not adversely affect the rights and freedoms of others.

The data subject can exercise the right by sending a request to the email address francodonghia@studiodonghia.it

In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

Before providing a response, the Data Controller may need to identify the data subject, as the right can only be exercised by the data subject or his delegate.

​

Art. 16 Right to rectification

The data subject has the right to obtain from the data controller the rectification of inaccurate personal data concerning him without unjustified delay. Taking into account the purposes of the pro

Processing of inaccurate and/or incomplete data

The data subject can exercise the right by sending a request to the email address francodonghia@studiodonghia.it

In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

Before providing a response, the Data Controller may need to identify the data subject, as the right can only be exercised by the data subject or his delegate.

cessing, the data subject has the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration.

​

Art. 17 Right to erasure (“right to be forgotten”)

The data subject has the right to obtain from the data controller the deletion of personal data concerning him or her without unjustified delay and the data controller has the obligation to delete the personal data without unjustified delay.

The data controller, if he has made personal data public and is obliged, pursuant to the previous paragraph, to delete them, taking into account the available technology and implementation costs, adopts reasonable measures, including technical ones, to inform the data controllers that are processing the personal data of the data subject's request to delete any link, copy or reproduction of his/her personal data.

The right can be exercised if one of the following reasons exists:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b) the data subject withdraws the consent on which the processing is based in accordance with Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), and if there is no other legal basis for the processing ;

c) the data subject objects to the processing pursuant to Article 21, paragraph 1, and there is no overriding legitimate reason to proceed with the processing, or objects to the processing pursuant to Article 21, paragraph 2;

d) the personal data have been processed unlawfully;

e) the personal data must be erased to comply with a legal obligation under Union or Member State law to which the data controller is subject;

f) the personal data have been collected in relation to the offer of information society services referred to in Article 8, paragraph 1 (Where Article 6, paragraph 1, letter a applies), in respect of the offer of information society services to minors, the processing of personal data of the minor is lawful where the minor is at least 16 years old. Where the minor is under the age of 16, such processing is lawful only if and to the extent that such consent is given or authorized by the holder of parental responsibility. Member States may establish by law a lower age for these purposes provided that it is not less than 13 years.).

The right to erasure does not apply to the extent processing is necessary:

a) for the exercise of the right to freedom of expression and information;

b) for the fulfillment of a legal obligation which requires processing provided for by Union or Member State law to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of public authority of which the data controller is vested;

(c) for reasons of public interest in the field of public health in accordance with Article 9(2)(h) and (i) and Article 9(3);

(d) for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1), to the extent that the right referred to in paragraph 1 is likely to render impossible or seriously undermine the achievement of the objectives of such processing; or

1. e) for the establishment, exercise or defense of a right in court.

The data subject can exercise the right by sending a request to the email address francodonghia@studiodonghia.it

In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

Before providing a response, the Data Controller may need to identify the data subject, as the right can only be exercised by the data subject or his delegate.

​

Art. 18 Right to restriction of processing

The data subject has the right to obtain from the data controller the limitation of processing

If the processing is limited in accordance with the previous paragraph, such personal data are processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defense of a right in court or for protect the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

The data subject who has obtained the limitation of processing pursuant to the initial paragraph is informed by the data controller before said limitation is revoked.

The right can be exercised if one of the following reasons exists:

a) the data subject disputes the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data;

b) the processing is unlawful and the data subject opposes the deletion of the personal data and instead requests that their use be limited;

c) although the data controller no longer needs them for the purposes of the processing, the personal data are necessary for the data subject to ascertain, exercise or defend a right in court;

1. d) d) the data subject has objected to the processing pursuant to Article 21, paragraph 1, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the data subject.

The data subject can exercise the right by sending a request to the email address francodonghia@studiodonghia.it

In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

Before providing a response, the Data Controller may need to identify the data subject, as the right can only be exercised by the data subject or his delegate.

​

Art. 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing

The data controller shall communicate to each of the recipients to whom the personal data have been transmitted any rectifications or cancellations or limitations of processing carried out pursuant to Article 16, Article 17, paragraph 1, and Article 18, unless this proves impossible or involves a disproportionate effort. The data controller communicates these recipients to the data subject if the data subject requests it.

The data subject can exercise the right by sending a request to the email address francodonghia@studiodonghia.it

In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

Before providing a response, the Data Controller may need to identify the data subject, as the right can only be exercised by the data subject or his delegate.

​

Art. 20 Right to data portability

The data subject has the right to receive the personal data concerning him/her provided to a data controller in a structured, commonly used and machine-readable format and has the right to transmit such data to another data controller without impediments from part of the data controller to whom he provided them.

In exercising their rights relating to data portability pursuant to the previous paragraph, the data subject has the right to obtain the direct transmission of personal data from one data controller to another, if technically feasible

The exercise of the right referred to in the initial paragraph is without prejudice to Article 17 - Right to erasure ("right to be forgotten").

The data subject has the right to object at any time.

The data controller shall refrain from further processing the personal data unless he demonstrates the existence of compelling legitimate reasons to proceed with the processing which prevail over the interests, rights and freedoms of the data subject or for the assessment, exercise or the defense of a right in court.

If personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes, including profiling to the extent that it is connected to such direct marketing.

If the data subject objects to the processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

If personal data are processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89, paragraph 1, the data subject, for reasons relating to his particular situation, has the right to object to the processing of personal data which concerns, unless the processing is necessary for the performance of a task in the public interest.

The right can be exercised if one of the following reasons exists:

a) the processing is based on consent pursuant to Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), or on a contract pursuant to Article 6, paragraph 1, letter b); And

b) the processing is carried out by automated means

This right does not apply to processing necessary for the execution of a task of public interest or connected to the exercise of public powers vested in the data controller.

The exercise of the right must not harm the rights and freedoms of others.

The data subject can exercise the right by sending a request to the email address francodonghia@studiodonghia.it

In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

Before providing a response, the Data Controller may need to identify the data subject, as the right can only be exercised by the data subject or his delegate.

​

Art. 21 Right to object

The right can be exercised if one of the following reasons exists:

- reasons related to your particular situation,

• - to the processing of personal data concerning him pursuant to Article 6, paragraph 1, letters and (the processing is necessary for the execution of a task of public interest or connected to the exercise of public powers vested in the Data Controller of the processing) or f (the processing is necessary for the pursuit of the legitimate interests of the data controller or of third parties, provided that the interests or fundamental rights and freedoms of the data subject which require protection of personal data do not prevail, in particular if the data subject is a minor.), including profiling on the basis of these provisions

The data subject can exercise the right by sending a request to the email address francodonghia@studiodonghia.it

In order to be able to provide a positive response to the request, it is necessary to provide the information necessary to identify the data subject.

In the context of the use of information society services, and without prejudice to Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

Before providing a response, the Data Controller may need to identify the data subject, as the right can only be exercised by the data subject or his delegate.

​

Complaint

In the event that the data subject believes that the processing of their personal data violates the provisions of EU Regulation 2016/679, they have the right to lodge a complaint with the Guarantor Authority for the Protection of Personal Data based in Rome, pursuant to art. 77 of the Regulation itself, as well as appealing to the judicial authorities.

​

Version: 1.0

Last edit: 10/10/2025