Privacy Policy: Website, Email and Photo Credits – Madonna di Campiglio Azienda per il Turismo S.p.A.

Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679

This page constitutes the "Privacy Policy" of this website and is intended to provide information on how the personal data of users who interact with this website and use the services provided through it are processed, as well as to provide the information required under Articles 13 and 14 of Regulation (EU) 2016/679.

This Privacy Policy applies exclusively to this website and not to any other websites that users may access through links contained on its web pages.

Regulation (EU) 2016/679 on the protection of personal data (hereinafter referred to as the "Regulation") lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of such data, and protects the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data.

Article 4(1) of the Regulation defines "Personal Data" as any information relating to an identified or identifiable natural person (hereinafter referred to as the "Data Subject").

"Processing" means any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Article 4(2) of the Regulation).

Pursuant to Articles 12 et seq. of the Regulation, the Data Subject must also be provided with appropriate information concerning the Processing activities carried out by the Data Controller and the rights of Data Subjects.

Data Controller

Madonna di Campiglio Azienda per il Turismo S.p.A.
Via Pradalago 4
38086 – Madonna di Campiglio (TN)
Tel.: +39 0465 447501
Email: info@campigliodolomiti.it
Website: https://www.campigliodolomiti.it
VAT No.: 01854660220

Purposes of Processing and Legal Bases for Processing

Users' Personal Data will be processed for the following purposes and on the legal bases indicated below:

1. For the conclusion and proper performance of a contract to which the Data Subject is party, or in order to take steps at the request of the Data Subject prior to entering into a contract, in relation to the information and/or services/products requested, as well as to respond to requests submitted by the Data Subject. The legal basis for the Processing activities listed above is Article 6(1)(b) of Regulation (EU) 2016/679.

2. To periodically send, through remote communication technologies (email, telephone, SMS, WhatsApp), newsletters and commercial communications concerning services, products, initiatives and activities offered by the Data Controller. The legal basis is consent pursuant to Article 6(1)(a) of Regulation (EU) 2016/679.

3. To periodically send, through remote communication technologies (email, telephone, SMS, WhatsApp), newsletters and communications concerning services, products and activities offered by the Data Controller's partners and sponsors, including those operating in the automotive sector, which may be of interest to the Data Subject. The legal basis is consent pursuant to Article 6(1)(a) of Regulation (EU) 2016/679.

4. To send emails containing commercial and promotional information for the sale of our products/services of the same type as those previously purchased by the Data Subject, unless the Data Subject objects to such Processing, which may be done at any time. The legal basis for this type of Processing is the legitimate interests pursued by the Data Controller pursuant to Article 6(1)(f).

With reference to email communications sent for the marketing purposes referred to in points 2 and 3, the Data Controller may use tracking technologies, such as tracking pixels or equivalent tools, which make it possible to collect certain information relating to interactions with the message, such as whether the email has been opened and whether links contained therein have been used.

Such information is used to measure the effectiveness of campaigns and to improve the content, methods and frequency of communications.

Individual tracking is carried out on the basis of the Data Subject's consent, which may be withdrawn at any time, including independently of the consent to receive communications, through the "Manage Preferences" function available in emails or through the other methods indicated in this Privacy Policy.

If the Data Subject withdraws consent to tracking only, they may continue to receive communications without being individually tracked.

For the communications referred to in point 4, in the absence of consent to individual tracking, only aggregated or anonymous statistics, where available, or communications without individual tracking will be used.

5. To respond to requests submitted by users via email and/or forms available on the website. The legal basis for the Processing activities listed above is Article 6(1)(b) of Regulation (EU) 2016/679.

6. To enable and ensure the proper functioning of website navigation, as well as to guarantee an adequate level of security, integrity and availability. The legal basis for this type of Processing is the legitimate interests pursued by the Data Controller pursuant to Article 6(1)(f).

7. To analyse statistical data in aggregated or anonymous form in order to monitor the proper functioning of the Website, traffic, usability and user interest. The legal basis for this type of Processing is the legitimate interests pursued by the Data Controller pursuant to Article 6(1)(f).

8. To establish, exercise or defend legal claims. The legal basis for this type of Processing is the legitimate interests pursued by the Data Controller pursuant to Article 6(1)(f).

9. To comply with obligations imposed by law, regulations, European Union legislation or orders issued by an Authority. The legal basis for this type of Processing is Article 6(1)(c).

10. Subject to consent, to ensure that marketing communications relating to products and services offered by the Data Controller, as well as those of commercial partners and sponsors, and online advertising, are more relevant to the Data Subject's interests. For this purpose, data relating to preferences and interests may be used to personalise communications. Where information relating to interactions with emails is also used for this personalisation purpose, this will take place exclusively on the basis of the relevant consent. The legal basis is consent pursuant to Article 6(1)(a) of Regulation (EU) 2016/679.

11. To conduct market research in order to develop and improve the range of products, services and activities offered by the Data Controller and its partners. The legal basis is consent pursuant to Article 6(1)(a) of Regulation (EU) 2016/679.

Categories of Data

The Data necessary to pursue the purposes described above will be collected and processed:

• Identification data

• Contact data

• Data relating to the contractual relationship

• Data relating to the Data Subject's preferences and interests

• Data relating to interactions with email communications, such as message openings and the use of links, when tracking is enabled

Browsing Data

The computer systems and software procedures used to operate this website acquire, during their normal operation, certain Personal Data whose transmission is inherent in the use of Internet communication protocols.

This information is not collected for the purpose of associating it with identified Data Subjects, but by its very nature could, through processing and association with data held by third parties, make it possible to identify users.

This category of data includes the IP addresses or domain names of the computers used by users connecting to the website, the Uniform Resource Identifier (URI) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's response (successful, error, etc.), and other parameters relating to the user's operating system and IT environment.

These data are used solely to obtain anonymous statistical information on website usage and to monitor its proper functioning, and are deleted immediately after processing.

The data may be used to establish liability in the event of alleged cybercrimes committed against the website.

Refusal to Provide Data

Except as specified for browsing data, users/visitors are free to provide their Personal Data.

The provision of Data is necessary in certain cases, as refusal to provide such Data may prevent the conclusion or proper performance of a contract to which the Data Subject is party and/or compliance with legal obligations to which the Data Controller is subject.

The provision of Data for Processing activities requiring consent is optional, and failure to provide such Data will not prevent the use of products or services offered by the Data Controller.

Consent may be withdrawn at any time, without affecting the lawfulness of Processing based on consent before its withdrawal.

With reference to email communications, the Data Subject may also choose to continue receiving communications while disabling only the tracking technologies through the "Manage Preferences" function available in emails or through the other methods indicated in this Privacy Policy.

Source of Data

The Data will be provided by the Data Subject, collected from third parties in cases permitted by law, or automatically acquired in the context of interactions with the website and, subject to consent where required, with email communications sent by the Data Controller.

Methods of Processing

In accordance with Article 5 of the Regulation, the Personal Data subject to Processing will be:

1. Processed lawfully, fairly and in a transparent manner in relation to the Data Subject.

2. Collected and recorded for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

4. Accurate and, where necessary, kept up to date.

5. Processed in a manner that ensures appropriate security.

6. Kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the Personal Data are processed.

Processing will be carried out using manual and/or electronic and telematic tools, according to organisational and processing methods strictly related to the purposes themselves and, in any case, in a manner that guarantees the security, integrity and confidentiality of the data, in compliance with the organisational, physical and technical measures required by the applicable provisions.

No decisions are taken based solely on automated processing which produce legal effects concerning the Data Subject or similarly significantly affect them.

Any personalisation of communications referred to in point 10 is carried out exclusively for marketing purposes and does not produce such effects.

Disclosure of Data

Personal Data may be disclosed to persons authorised to process Personal Data, as well as to external Data Processors appointed by the Data Controller (the complete list of external Data Processors is available from the Data Controller), who are responsible for managing the purposes described above.

Subject to the Data Subject's consent, the Data may also be disclosed to third-party companies acting as sponsors and/or commercial partners of the Data Controller, which may use them for the purposes set out in point 3 of the section "Purposes of Processing" above.

In pursuing the purposes indicated above, the data may be disclosed to other parties acting as independent Data Controllers.

Dissemination of Data

Personal Data will not be disseminated.

Transfers of Personal Data to Third Countries

For the purposes indicated above, Personal Data will be processed within the European Economic Area (EEA).

Should Personal Data be transferred to Third Countries, in the absence of an adequacy decision by the European Commission, the requirements laid down by the applicable legislation concerning transfers of Personal Data to third countries will nevertheless be complied with, including through the use of Standard Contractual Clauses adopted by the European Commission.

Data Retention

In general, Personal Data will be retained for the period strictly necessary to achieve the purposes for which they were collected and processed.

Data relating to contractual relationships and compliance with legal obligations may be retained, where applicable, for a maximum of 10 years following termination of the relationship.

Data processed for purposes based on consent will be retained for a maximum period of 2 years, unless consent is withdrawn earlier.

Individual data relating to interactions with email communications will be retained within the same maximum period, unless they are deleted or aggregated in anonymous form beforehand.

This is without prejudice to any further retention necessary for the establishment, exercise or defence of legal claims.

Rights of the Data Subject

Pursuant to Articles 15 to 21 of European Regulation (EU) 2016/679 and the applicable national legislation, the Data Subject may, in accordance with the procedures and within the limits established by the legislation in force, exercise the following rights:

• Request confirmation as to whether Personal Data concerning them exist (right of access).

• Obtain information about the origin of such data.

• Receive such data in an intelligible form.

• Obtain information about the logic, methods and purposes of Processing.

• Request the updating, rectification, completion, erasure, anonymisation or blocking of data processed in breach of the law, including data no longer necessary for the purposes for which they were collected.

• Lodge a complaint with a supervisory authority (Italian Data Protection Authority – Garante per la protezione dei dati personali).

• More generally, exercise all rights granted to them under the applicable legal provisions.

• Obtain, where provided for by law, restriction of Processing and data portability.

• Object to Processing in the cases provided for by law.

• Withdraw consent at any time, including solely with regard to the tracking of email communications, while continuing, if desired, to receive marketing communications without individual tracking.

The Data Subject may exercise their rights by submitting a request, without any formal requirements, to the Data Controller using the contact details provided above.

Template Version: 3.1
Last Updated: 27/10/2026

See all privacy policies here