PRIVACY POLICY

Information on the processing of personal data pursuant to art. 13 EU Regulation 2016/679

The company Costa Edutainment SpA ., with this information, communicates to you the information relating to the processing of your personal data released during registration on this website (hereinafter for brevity referred to as "the Site") and during the subsequent purchase, receipt and use of the products and services marketed through it. This processing of your personal data may also take place using IT and electronic tools.

Data controller
The Data Controller of your personal data is the company Costa Edutainment SpA , with registered office in 47839 Riccione (RN), via Ascoli Piceno n.6, Tax Code / VAT number 03362540100, in the person of its legal representative pro tempore ( hereinafter for brevity referred to as “the Owner” or “the Company”).

Contact details of the Data Protection Officer (DPO)
The Data Protection Officer appointed by the Company can be reached at the e-mail address: dpo@costaedutainment.com or by ordinary mail by writing to the administrative headquarters of the same in Genoa, Porto Antico Area – Ponte Spinola Ambrogio sn GE, to the attention of the same.

Categories of data subject to processing
The Data Controller will process, by way of example and not exhaustively, the following categories of personal data released by you during registration on the Site, during the purchase of products and services and during the processing of the order and provision of the services purchased:
• personal data (e.g. name, surname, date of birth, tax code, residence address);
• contact details (e.g. telephone number, e-mail address);
• access credentials to the personal area created following registration on the Site (e.g. username and password);
• data relating to the products or services purchased;
• data relating to the payment system used;
• data acquired by the Data Controller during the execution of the purchase contract for a product;
• data acquired by the Owner during the provision of the purchased service;
• the result of your profiling based on the history of purchases made by you, where you have given consent to such processing.

Purpose of data processing
Your personal data will be processed by the Data Controller for the following purposes:
1) to allow you to register on the Site and use the services connected to registration such as a personal space where you can check your orders, the purchases you have made, express your satisfaction with the services offered by the Owner and access the provision of the additional services offered by the same;
2) to allow you to proceed with the purchase of the products and services offered by the Owner through the Site;
3) to allow the Owner to manage any accidents that may occur while using the services, or any complaints you may have;
4) to allow the Data Controller to send you communications on activities and promotions relating to services or products equal or similar to those already used and/or relating to offers or promotions relating to them, limited to the use, for this purpose, of the personal data represented from your e-mail address provided by you when concluding the contract;
5) to send you, subject to your consent, commercial information, including via newsletter, relating to products and/or services offered by the Data Controller, also using contact details other than your e-mail address (e.g. mobile phone number, email address residence or domicile);
6) for profiling and/or market analysis purposes, so that the Data Controller can create, with your consent, a profile to send you commercial communications selected based on your preferences, or other behavioral aspects, as emerged from the profiling activity ;
7) so that the Data Controller can communicate your personal data to third parties, subject to your consent, so that they can send you commercial information relating to their products or services. The third parties to whom your data may be communicated are companies controlled, connected or owned by the Data Controller or other third-party companies operating in the entertainment sector based on the qualitative use of free time, combining culture, science, education, entertainment and nature. ;
8) so that the Data Controller can send you a "reminder" communication in order to warn you of the imminent deletion of your account and the data saved through it, a circumstance which will entail the need for a new registration to access the connected services;
9) so that the Data Controller can protect their rights both in the judicial and extrajudicial phases;
10) to allow the Data Controller to fulfill the legal obligations to which it is subject.

Legal basis of the processing
The legal basis on which the processing of your personal data is based for the purposes referred to in point 1) above is the execution of the registration contract on the Site.
The legal basis on which the processing of your personal data is based for the purposes referred to in point 2) above is the execution of the purchase contract for the good or service or the execution of pre-contractual measures adopted at your request.
The legal basis on which the processing of your personal data is based for the purpose referred to in point 3) above is the legitimate interest of the Data Controller in the management of any accidents occurring during use of the service, or any complaints connected to the products or services marketed by the same. In the event that the management of the accident involves the processing of particular data (e.g. data relating to health), the legal basis will be represented by the need for the Data Controller to ascertain, exercise or defend his rights in court.
The legal basis on which the processing of your personal data is based for the purposes referred to in the previous point 4) is the provisions of art.130 paragraph 4 of Legislative Decree 196/2003 et seq. modifications and additions.
The legal basis on which the processing of your personal data is based for the purposes referred to in points 5), 6) and 7) above is your consent. The provision of consent for these purposes is optional, in the sense that failure to provide it will not in any way limit registration on the Site, nor the purchase of products and services or their use. It is specified that failure to provide the requested consent, or their subsequent revocation, will not allow the Data Controller to carry out the processing activities for which such consent is requested.
The legal basis on which the processing of your personal data is based for the purposes referred to in the previous point 8) is the legitimate interest of the Data Controller in ensuring that the account on which the loyalty relationship with the customer is based is not cancelled. user, balanced with the user's interest in continuing to use the services connected to him, without having to proceed with a further subsequent registration and not losing the data previously saved through his account, an interest considered prevalent with respect to the consequent compression of the your rights that such processing entails.
The legal basis on which the processing of your personal data is based for the purposes referred to in point 9) above is the legitimate interest of the Data Controller in the protection of his rights both in judicial and extrajudicial proceedings in the event of any contractual violations on his part or of damage caused by you to the Owner's assets or to third parties or to third party assets. In the event that the protection of his right by the Data Controller involves the processing of his particular data (e.g. data relating to health), the legal basis will be represented by the need for the Data Controller to ascertain, exercise or defend his own right in the judicial.
The legal basis on which the processing of your personal data is based for the purposes referred to in the previous point 10) is the need for the Data Controller to fulfill legal obligations to which he is subject.

Consequence of failure to provide data
The provision of your personal data is necessary to allow your registration on the Site, and for the subsequent purchase, through the Site, of the Owner's products and services. Failure to provide your personal data will not allow you to proceed with registration on the site and with the subsequent purchase of the products or services marketed by the Owner.

Data retention period
Your personal data processed for the purposes referred to in point 1) will be kept for the entire duration of your registration on the Site. It is specified that, in any case, 6 years after the last purchase made by you on your account, this will be automatically deactivated with consequent cancellation of the same and the data associated with it. A "reminder" communication will be sent to you before the deadline for the actual deletion of your account expires in order to keep your registration on the Site active.
Your personal data processed for the purposes referred to in point 2) will be retained for the entire duration of the purchase procedure of the goods and the service and, subsequently, until the order or use of the service has been completely processed.
Your personal data processed for the purposes referred to in point 3) will be kept for the entire duration of the management of the accident or complaint and until its definition.
Your personal data processed for the purposes referred to in points 4), 5), 6) 7) and 8) will be kept for the entire duration of your registration on the Site without prejudice to your express request to delete the data which can be exercised at any time. according to the methods reported in the paragraph of this information dedicated to the exercise of your rights.
Please note that, in any case, 6 years after your last purchase your account will be automatically deactivated with consequent cancellation of the same and the data associated with it.
Your personal data processed for the purposes referred to in point 9), and in particular the data relating to the stipulation and execution of contracts with the Data Controller, will be kept for a period of 10 years from the stipulation of the relevant contract. After this period they may be further stored in case they are necessary in the context of ongoing legal proceedings.
Your personal data processed for the purposes referred to in point 10) will be kept for the entire duration necessary so that, through them, the Data Controller can fulfill legal obligations to which it is subject (e.g. 10 years in relation to the data contained in the accounting documentation).

Recipients of the data
Your personal data may be communicated to third-party companies that offer or manage, on behalf of the Owner, support services for the online sales of the Owner's products or services.
Your personal data may be communicated, subject to your consent, to other third parties, so that they can send you commercial information relating to their products or services. The third parties to whom your personal data may be communicated are companies associated, owned and/or controlled by the Data Controller, third-party companies operating in the entertainment sector oriented towards the qualitative use of free time, combining culture, science, education, entertainment and nature, as well as companies controlled or owned by the Data Controller.
Your personal data may also be communicated to further third parties, such as, for example, lawyers, consultants, insurance companies.
Third-party companies that offer or manage, on behalf of the Data Controller, services relating to the management of the website, its registration and companies supplying CRM or similar applications may have access to your personal data, limited to these purposes and subject to their appointment as data controllers, pursuant to art 28 of EU Regulation 2016/679.
The list of those responsible for processing personal data, which by its nature is changeable, may be requested from the Data Controller at any time by writing to privacy@costaedutainment.com .
The Company's employees, defined as data processors, may also have access to your personal data if the duties of such employees require it. Each data processor is specifically identified, authorized and trained, and acts on the basis of specific instructions provided by the Company regarding the purposes, methods of the processing itself and the security measures to be adopted for the protection of personal data.

Rights of the interested party
You, as an interested party in the processing, have the right, pursuant to art. 15 et seq. EU Regulation 2016/679, and within the limits prescribed by it, to:
• obtain data and information on the processing, in particular in relation to the type of personal data processed, the purposes for which the personal data are processed, the period of processing and the subjects to whom the data are communicated ( so-called right of access );
• obtain the rectification or integration of inaccurate personal data concerning you ( so-called right of rectification );
• obtain the deletion of personal data concerning you in the following cases: (i) the personal data are no longer necessary for the purposes for which they were collected; (ii) you have revoked your consent to the processing of personal data, if they are processed on the basis of such consent; (iii) you have objected to the processing of personal data concerning you in the event that they are not processed for a legitimate interest of the Data Controller; (iv) the processing of personal data does not comply with the law. However, the retention of your personal data by the Data Controller is lawful if it is necessary to allow the Data Controller to fulfill a legal obligation or to ascertain, exercise or defend a right in court ( so-called right of cancellation );
• obtain that the personal data concerning you are only stored without any other use being made of them in the following cases: (i) you contest the accuracy of the personal data, for the period necessary to allow the Data Controller to verify the accuracy of such personal data; (ii) the processing of personal data is unlawful and you oppose, in any case, the deletion of personal data by the Data Controller; (iii) the personal data is necessary for the establishment, exercise or defense of a right in court; (iv) you have objected to the processing and are awaiting verification regarding the possible prevalence of the legitimate reasons of the Data Controller with respect to yours ( so-called right of limitation );
• object at any time to the processing of data and in particular to the processing of data processed for direct marketing purposes, also in relation to services identical to those already provided by the Data Controller, and for the purpose of profiling ( so-called right of opposition );
• receive in a commonly used format, readable by an automatic and interoperable device, the personal data concerning you, if they are processed pursuant to a contract or on the basis of your consent, and/or transmit the data to another data controller , if feasible ( so-called right to portability ).
• revoke consent at any time to the processing for which it is requested. The revocation of consent does not affect the lawfulness of the processing based on consent before the revocation.
• ask the Data Controller, at any time, to no longer send commercial information relating to services that are the same or similar to those already used and/or relating to offers or promotions relating to them (so-called "soft spam" referred to in Art. 130 paragraph 4 of Legislative Decree no. 196 of 30 June 2003).
The aforementioned rights may be exercised upon your request to this effect sent to the dedicated email address privacy@costaedutainment.com or by writing by ordinary mail to the company Costa Edutainment SpA ., at its administrative headquarters in Genoa, Porto Area Ancient – Ponte Spinola Ambrogio sn GE.

Right to complain
If you believe that the processing of your personal data carried out by the Data Controller is in violation of the provisions of EU Regulation 2016/679, you have the right to lodge a complaint with the Office of the Privacy Guarantor (via e-mail, at the address: garante@ gpdp.it, or by post, to the Guarantor for the protection of personal data, which is based in Rome (Italy), Piazza Venezia 11 Scala B, CAP 00187), as required by art. 77 of EU Regulation 2016/679, or to take action in the appropriate judicial offices as provided for by the art. 79 of EU Regulation 2016/679.