Privacy Policy

1. Data Controller

Data controller under Art. 4(7) GDPR:
Senoner Sartëur KG-SAS di Senoner Andreas & C.
Meisules 111
I-39048 Selva Val Gardena, Wolkenstein (BZ)

VAT 01184640215 | E-mail: info@senoner-sarteur.it

2. General

We process personal data confidentially and in accordance with the GDPR (Reg. EU 2016/679), the Italian Privacy Code (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018) and the guidelines of the Italian Data Protection Authority (Garante).

3. Legal bases (Art. 6 GDPR)

• Consent (lit. a)
• Contract performance and pre-contractual measures (lit. b)
• Legal obligation (lit. c)
• Legitimate interests (lit. f)

4. Server log files

On each visit, technically necessary data is stored: IP address (anonymized), date and time, requested page, browser, operating system, referrer. Purpose: technical provision and security (Art. 6(1)(f)). Retention: max. 14 days.

5. Cookies and tracking

See separate Cookie Policy. Non-strictly-necessary cookies are only set after explicit consent.

6. Contact form and e-mail

When you contact us via form, e-mail or phone, we process the transmitted data (name, e-mail, phone, request content) to process your enquiry (Art. 6(1)(b) or (f)). Retention: until resolution, then deletion — unless statutory retention obligations apply.

7. Contract and billing data

Upon conclusion of contract, we process master data, contract data and billing data for contract performance and invoicing. Retention: 10 years (mandatory Italian tax and accounting law, Art. 2220 c.c.).

8. Integrated third-party services

The following services are used on our website:

• Google Analytics 4 (Google Ireland Ltd., IP-anonymized, US transfer via DPF/SCC)
• Google Tag Manager (Google Ireland Ltd.)
• Meta Pixel / Conversions API (Meta Platforms Ireland Ltd., US transfer via DPF/SCC, joint controllership Art. 26 GDPR)
• Google Fonts / Google Maps (Google Ireland Ltd.)
• YouTube (enhanced privacy mode) (Google Ireland Ltd.)
• LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company)
• Hostinger (Hostinger International Ltd., Cyprus) as hosting

A complete and up-to-date list is available in our cookie banner under "Show details".

9. Third-country transfers

Data transfers to third countries (in particular USA) occur only on the basis of the EU-U.S. Data Privacy Framework (DPF), Standard Contractual Clauses (SCC, EU 2021/914) or your explicit consent (Art. 49 GDPR).

10. Retention periods (overview)

• Server logs: 14 days
• Contact enquiries: until resolution + 6 months
• Contract and accounting data: 10 years (mandatory)
• Cookie consents: 6 months (then re-consent)
• Newsletter subscribers: until unsubscribe

11. Your rights (Art. 15–22 GDPR)

Access, rectification, erasure, restriction, portability, objection, withdrawal of granted consents. Requests to: info@senoner-sarteur.it.

12. Right of complaint

You have the right to lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it.

13. Security

We use TLS encryption, access restrictions, MFA, regular backups and continuously review our security measures.

14. Minors

This website is not directed at persons under 16 years of age.

15. Changes

This statement may be adapted to legal or service changes. The current version is available here.

Updated: May 2026

16. Security and Protection of Your Personal Data

We implement comprehensive security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These measures include:

• TLS/SSL encryption for data transmission over the internet
• Access controls and role-based permission systems
• Multi-factor authentication (MFA) for administrative access
• Regular security audits and vulnerability assessments
• Continuous monitoring for unauthorized access attempts
• Regular backups to ensure data recovery in case of incidents
• Data minimization: we collect only data necessary for the stated purposes
• Encryption of sensitive data at rest where applicable

While we strive to use industry-standard security measures, no system is completely secure. We cannot guarantee absolute security, but we are committed to protecting your data to the highest standard possible under applicable law.

17. Definitions

Personal Data: Any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).

Processing: Any operation performed on personal data, such as collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, transmission, erasure or destruction (Art. 4(2) GDPR).

Restriction of Processing: The marking of stored personal data with the aim of limiting their processing in the future (Art. 4(3) GDPR).

Profiling: Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements (Art. 4(4) GDPR).

Pseudonymization: The processing of personal data in such a manner that the personal data can no longer be attributed to a data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person (Art. 4(5) GDPR).

Filing System: Any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis (Art. 4(6) GDPR).

Controller: The natural or legal person, public authority, agency or body that, alone or jointly with others, determines the purposes and means of the processing of personal data (Art. 4(7) GDPR).

Processor: A natural or legal person, public authority, agency or body that processes personal data on behalf of the controller (Art. 4(8) GDPR).

Recipient: A natural or legal person, public authority, agency or body to which the personal data are disclosed (Art. 4(9) GDPR).

Third Party: A natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data (Art. 4(10) GDPR).

Consent: Any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her (Art. 4(11) GDPR).

18. Lawfulness of Processing

All processing of personal data is performed only on the basis of a legal ground pursuant to Art. 6 GDPR. We process personal data only when one of the following applies:

• Art. 6(1)(a): You have given explicit, informed, and freely revocable consent to the processing.
• Art. 6(1)(b): Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.
• Art. 6(1)(c): Processing is necessary for compliance with a legal obligation to which we are subject.
• Art. 6(1)(d): Processing is necessary in order to protect the vital interests of you or another natural person.
• Art. 6(1)(e): Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
• Art. 6(1)(f): Processing is necessary for the purposes of the legitimate interests pursued by us or a third party, except where such interests are overridden by your interests, rights and freedoms.

19. Categories and Types of Data Collected

We collect and process the following categories of personal data:

• Identification Data: Name, surname, email address, phone number, postal address.
• Contact Data: Email address, phone number, messages and content you submit through contact forms.
• Technical Data: IP address (anonymized when possible), browser type and version, operating system, pages visited, time and date of visits, referrer information, device information.
• Cookie Data: Information stored via cookies, tracking pixels, and similar technologies.
• Contract and Transaction Data: Information related to purchase agreements, invoices, payment details, order history.
• Behavioral Data: Information about how you interact with our website, including pages visited, time spent on pages, clicks, scroll depth.
• Location Data: General location information derived from IP address or explicit geolocation data (only with your consent).
• Preference Data: Your settings, preferences, language choices, and customization options.
• Special Categories of Data: We do not intentionally collect special categories of data (Art. 9 GDPR) unless explicitly stated and with your explicit consent.

20. Purpose and Legal Basis of Processing

Personal data are processed for the following purposes and legal bases:

• a) Website operation and technical provision (Art. 6(1)(f) GDPR): To ensure the functioning, security, and optimization of our website; to detect and prevent fraud and abuse; to troubleshoot technical issues. Legitimate interest: ensuring reliable and secure website operation.
• b) Fulfillment of contractual obligations (Art. 6(1)(b) GDPR): To process orders, deliver services, send confirmations, provide customer support, and maintain billing records. Legal basis: performance of contract.
• c) Compliance with legal obligations (Art. 6(1)(c) GDPR): To comply with tax law, accounting law, labor law, and other statutory requirements. Legal basis: legal obligation.
• d) Marketing and communication (Art. 6(1)(a) GDPR): To send newsletters, promotional materials, and other marketing communications only with your prior explicit consent. You may withdraw consent at any time.

21. Methods of Data Processing

Personal data are processed using the following methods:

• Automated collection via website analytics and server logs
• Manual collection through forms, contact submissions, and customer inquiries
• Automated profiling and tracking via cookies and similar technologies
• Automated analysis and correlation with third-party data sources
• Storage in database management systems and customer relationship management (CRM) tools
• Manual review and processing by authorized personnel
• Automated decision-making and profiling (if applicable, with appropriate safeguards)

22. Transmission, Recipients, Data Processors

Your personal data may be transmitted to the following categories of recipients:

• Internal recipients: Employees and representatives of Senoner Sartëur who have a legitimate need to access data for the stated purposes.
• Service providers (processors): Hosting providers, email service providers, payment processors, analytics services, customer support platforms, marketing automation tools.
• Legal and regulatory authorities: Data may be disclosed to government agencies, law enforcement, tax authorities, and other regulatory bodies as required by law.
• Business partners and third parties: Data may be shared with business partners, affiliates, or service providers for joint projects, only on a need-to-know basis and under appropriate data protection agreements.
• Consent-based recipients: Data may be shared with third parties with your explicit consent, which you may withdraw at any time.

All recipients are subject to data protection obligations at least as stringent as those outlined in this privacy policy.

23. Collection of Personal Data When Visiting Our Website

When you visit our website, the following technical data is automatically collected:

• IP Address: Your Internet Protocol address is automatically recorded. We anonymize the last octet of IPv4 addresses and the last 80 bits of IPv6 addresses to protect your privacy.
• Date and Time: The exact date and time of your visit is recorded, including timezone information.
• Timezone: Your timezone is determined from your device or IP address to provide localized content where applicable.
• Page Requested: The URI and path of the page you visited.
• HTTP Status Code: The server's response status (e.g., 200, 404).
• Data Volume: The size in bytes of the data transmitted.
• Referrer: The URL of the page from which you navigated to our website (if applicable).
• Browser Information: The type and version of your web browser.
• Operating System: The operating system of your device (e.g., Windows, macOS, Linux, iOS, Android).
• Language Settings: Your browser's preferred language.

Purpose and retention: This data is collected for technical website provision, security analysis, fraud detection, performance optimization, and to understand user behavior. Retention: max. 14 days unless extended for security or legal reasons.

24. Use of Cookies

Our website uses cookies and similar tracking technologies to enhance user experience and analyze website usage. Detailed information is provided in our separate Cookie Policy. Here is a brief overview:

• Transient (Session) Cookies: These cookies exist only during your browser session and are automatically deleted when you close your browser. They are used for session management and security purposes and do not require consent.
• Persistent Cookies: These cookies remain on your device beyond your session and are used to remember your preferences, login information, and browsing history. Persistent cookies for analytics and marketing purposes require your explicit consent before being set.
• Flash Cookies (Local Shared Objects): Adobe Flash Player may use Local Shared Objects (LSOs), commonly known as "Flash cookies," to store user preferences. Flash cookies are not automatically deleted and have their own privacy settings separate from your browser's cookie settings.
• HTML5 Storage: Modern browsers support HTML5 local storage and session storage mechanisms. These work similarly to cookies but have larger storage capacity and are not automatically transmitted with HTTP requests. They may be used by our website or third-party services and require consent if used for non-essential purposes.

You can manage your cookie preferences at any time via our cookie banner or settings. For more detailed information, please refer to our Cookie Policy.

25. Additional Features and Services

Beyond the core website functionality, we may offer additional features and services such as:

• Personalized recommendations based on your browsing history
• User accounts and profiles for registered users
• Wishlist and saved items functionality
• Live chat and customer support services
• Newsletter subscriptions and email campaigns
• Webinars, online events, and interactive sessions
• Community forums or user-generated content platforms

Each additional feature may involve the collection and processing of personal data. You will be informed about the specific data collected and purposes when you use these features. Participation in additional features is always voluntary.

26. Use of Our Webshop

If Senoner Sartëur operates a webshop, the following data is collected and processed:

• Registration and Account Data: When you create an account, we collect your name, email address, password (securely hashed), postal address, and phone number.
• Shopping Cart and Browsing Data: We track which products you view, add to your cart, or purchase to personalize your shopping experience and for analytics.
• Order and Payment Data: When you place an order, we collect information about the products ordered, quantity, price, shipping address, and payment method. Payment information is processed securely by external payment processors.
• Delivery and Fulfillment Data: Your shipping address and delivery preferences are used to fulfill your order and may be shared with logistics partners.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interests in fraud prevention and customer service).

27. External Payment Service Providers

PayPal: If you choose to pay via PayPal, your payment information is transmitted to PayPal (PayPal Inc., San Jose, California, USA, and PayPal (Europe) S.à r.l. et Cie, SCS, Paris, France). PayPal is responsible for processing payment data and operates under its own privacy policy. For data transfers to the USA, PayPal relies on the EU-U.S. Data Privacy Framework (DPF) or Standard Contractual Clauses (SCC). We do not store your credit card or PayPal account information on our servers. All payment data is encrypted during transmission using TLS/SSL.

Other payment processors: We may use additional payment service providers depending on your location and payment method. Each processor operates under its own privacy policy. You will be informed about the applicable processor before confirming your payment.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

28. Newsletter

We offer an optional newsletter to keep you informed about our latest news, products, and promotions. Newsletter subscription is entirely voluntary.

• Double Opt-in Process: When you subscribe to our newsletter, we use a double opt-in procedure. You will first provide your email address and select your preferences. You will then receive a confirmation email with a link that you must click to confirm your subscription. Only after you confirm your email address will you be added to our newsletter list.
• Confirmation of Subscription: We store your confirmation to demonstrate that you subscribed to the newsletter.
• Newsletter Content: Our newsletters contain information about our products, services, promotions, events, and updates relevant to your interests.
• Unsubscribe: Each newsletter contains a link to unsubscribe. You may withdraw your consent and unsubscribe from our newsletter at any time without providing a reason. Upon unsubscribe, we will delete your email address from our newsletter list (except if required by law to retain it).
• Legal basis: Art. 6(1)(a) GDPR (your explicit consent via double opt-in).
• Retention: Your email address is retained as long as you are subscribed. After unsubscribing, we retain your email address for 6 months to ensure you are not re-added in case of technical errors, then delete it.

29. Google Analytics

Our website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for EU/EEA users). Google Analytics is used to analyze website traffic, understand user behavior, and optimize our website's performance.

• Data Collection: Google Analytics collects data via cookies, local storage, and similar tracking technologies. The types of data collected include: pages visited, time spent on pages, clicks, scrolling, device information, browser information, operating system, IP address, referrer, and geographic location.
• IP Anonymization: We have enabled IP anonymization in Google Analytics. Your full IP address is not sent to Google; instead, Google Analytics anonymizes the last octet of IPv4 addresses and the last 80 bits of IPv6 addresses.
• Data Transfer to the USA: Google may transfer data to servers in the United States and other third countries. Such transfers are based on the EU-U.S. Data Privacy Framework (DPF) and Standard Contractual Clauses (SCC).
• Purposes: Analyzing website performance, understanding user behavior, optimizing user experience, detecting and preventing fraud, and monitoring website security.
• Retention: Google Analytics retains user data for a default period; we have configured a retention period of 14 months for user data.
• Opt-out: You can prevent the collection of your data by Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interests in analyzing website performance and user behavior).

For more information about Google Analytics, visit Google Analytics Help or Google's Privacy Policy.

30. Google Ads Remarketing

We use Google Ads remarketing to show you personalized advertisements on other websites and platforms. Google Ads remarketing uses cookies and similar technologies to track your visits to our website and display relevant ads based on your browsing behavior.

• How it works: When you visit our website, a cookie is placed on your device. If you later visit other websites that participate in the Google Display Network, Google uses this cookie to show you ads related to products or services you previously viewed on our website.
• Data transferred: Your browsing history on our website and your Google account information (if you are logged into your Google account) may be transferred to Google.
• Purposes: To re-engage you with our products and services through personalized advertising.
• Opt-out: You can disable Google Ads remarketing by visiting Your Ad Choices or by adjusting your cookie preferences in our cookie banner.
• Legal basis: Art. 6(1)(a) GDPR (your explicit consent via our cookie banner).

31. Google Ads Conversion

We use Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. When you click on a Google ad and perform a desired action on our website (such as making a purchase or filling out a form), conversion tracking records this action.

• How it works: A conversion tracking pixel or tag is embedded on our website. When you complete a conversion action, this pixel sends data to Google, which matches it with the original ad click.
• Data collected: Conversion information, such as whether a purchase was completed, the amount spent, and the date of the conversion. Your email address may be used in hashed form for cross-device conversion tracking (with your consent).
• Purposes: To measure the ROI of our advertising campaigns, optimize ad targeting, and improve advertising effectiveness.
• Data retention: Google retains conversion data for analysis and reporting purposes.
• Legal basis: Art. 6(1)(a) GDPR (your explicit consent) or Art. 6(1)(f) GDPR (legitimate interest in measuring advertising effectiveness).

32. Conversion Measurement and Custom Audience with Meta Pixel

Our website uses the Meta Pixel (formerly Facebook Pixel), a tracking tool provided by Meta Platforms Ireland Limited (or Meta Platforms, Inc. for non-EU users). The Meta Pixel allows us to measure conversions, understand user behavior, and create custom audiences for targeted advertising on Facebook, Instagram, and other Meta platforms.

• Data collection: The Meta Pixel collects data about user actions on our website, such as page views, additions to cart, purchases, and other events. It also collects technical information such as IP address, browser information, device type, and cookies.
• Matching and hashing: For conversion API and custom audience purposes, we may send hashed email addresses or other identifiers to Meta to match with Meta user accounts. This allows Meta to attribute conversions to specific users and to create audience segments for retargeting.
• Data transfer to the USA: Meta may transfer data to servers in the United States. Such transfers are based on the EU-U.S. Data Privacy Framework (DPF) and Standard Contractual Clauses (SCC).
• Purposes: Measuring conversion rates of ads displayed on Meta platforms, understanding user behavior, optimizing ad campaigns, and creating custom audiences for retargeting.
• Retention: Meta retains pixel data for up to 90 days or longer depending on your interaction with Meta services.
• Joint controllership: With regard to the Meta Pixel, we and Meta may be considered joint controllers of the personal data processed (Art. 26 GDPR). For more information about Meta's data processing practices, please visit Meta's Privacy Policy.
• Opt-out: You can opt out of Meta's use of your data for personalized advertising by adjusting your ad preferences in your Meta account or by using the opt-out options available through your browser.
• Legal basis: Art. 6(1)(a) GDPR (your explicit consent via our cookie banner).

33. Social Media Plugins (Two-Click Solution)

Our website may include social media plugins (such as "Like" buttons and share buttons from Facebook, Instagram, LinkedIn, Twitter, and other social networks). To protect your privacy, we implement a two-click solution:

• First click: When you first encounter a social media plugin on our website, it appears as a static, non-interactive button or link. No data is sent to the social media platform.
• Second click: You must explicitly click on the button or link to activate the social media plugin. Only after this second click does the plugin become active and may establish a connection to the social media platform's servers.
• Data transmission: Once activated, the social media platform may receive information about your visit to our website, your IP address, and your interaction with the plugin. Social media platforms may use this data for their own purposes, including profiling and targeted advertising.
• Legal basis: Art. 6(1)(a) GDPR (your explicit consent by clicking the plugin) and Art. 6(1)(f) GDPR (our legitimate interest in social media presence and sharing).

For more information about how social media platforms process your data, please refer to their respective privacy policies.

34. Google Maps

Our website may embed Google Maps to display our location, directions, or geographic information. Google Maps is provided by Google Ireland Limited.

• Data collection: When you interact with an embedded Google Map (such as zooming, panning, or searching), Google may collect information about your interaction, your IP address, and your device information.
• Data transfer: Data may be transferred to Google's servers in the United States and other countries.
• Purposes: To display location information and to provide mapping functionality on our website.
• Opt-out: You can prevent Google Maps from loading by disabling JavaScript in your browser or by using privacy extensions.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing location services and useful website functionality).

For more information, visit Google's Privacy Policy.

35. Data Processors

We work with several data processors who process personal data on our behalf. Data processors must comply with the GDPR and are bound by written data processing agreements (DPAs) or standard contractual clauses that ensure an appropriate level of data protection.

Main categories of processors:

• Hosting and Infrastructure: Hostinger (Cyprus) — for website hosting, content delivery, and security.
• Email and Communication: Resend (USA), SendGrid (USA) — for sending transactional and marketing emails.
• Analytics and Data Analysis: Google Ireland Limited (Ireland/USA) — for Google Analytics and Google Tag Manager.
• Advertising and Conversion Tracking: Meta Platforms Ireland Limited (Ireland/USA), Google Ireland Limited (Ireland/USA) — for pixel tracking and ad management.
• Payment Processing: PayPal (USA), Stripe (USA) — for processing payments securely.
• Customer Relationship Management: HubSpot (USA), Salesforce (USA) — for managing customer interactions and data.
• Legal and Compliance: Law firms, compliance consultants, and auditors — for legal and regulatory compliance.

A complete and current list of data processors is available upon request. Please contact us at info@senoner-sarteur.it.

36. Your Data Subject Rights

Under the GDPR, you have the following rights regarding your personal data:

• 1. Right to Withdraw Consent (Art. 7(3) GDPR): If processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. To withdraw consent, contact us at info@senoner-sarteur.it.
• 2. Right to Confirmation of Processing (Art. 15(1)(a) GDPR): You have the right to obtain confirmation whether your personal data is being processed and, if so, to obtain information about the processing.
• 3. Right of Access (Art. 15 GDPR): You have the right to obtain a copy of the personal data we hold about you in a structured, commonly used, and machine-readable format. We will provide this information without undue delay, generally within 30 days.
• 4. Right to Rectification (Art. 16 GDPR): You have the right to correct inaccurate or incomplete personal data. We will correct your data promptly upon receipt of your request.
• 5. Right to Erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes collected, or when you withdraw consent. Please note that we may be required by law to retain certain data.
• 6. Right to Restriction of Processing (Art. 18 GDPR): You have the right to restrict the processing of your personal data in certain circumstances. When processing is restricted, we will not process your data except for storage, unless you consent or for legal claims.
• 7. Right to Data Portability (Art. 20 GDPR): You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance.
• 8. Right to Object (Art. 21 GDPR): You have the right to object to processing based on legitimate interests (Art. 6(1)(f)) or for direct marketing purposes. Please note that some processing may be necessary for contractual or legal reasons.
• 9. Rights Related to Automated Decision-Making and Profiling (Art. 22 GDPR): You have rights relating to automated decision-making, including profiling, that has a legal or similarly significant effect on you. You have the right to request human intervention, express your point of view, and contest the decision.
• 10. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR): You have the right to lodge a complaint with your national data protection authority. In Italy, this is the Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it.
• 11. Right to Judicial Remedy (Art. 79 GDPR): You have the right to an effective judicial remedy if you consider that your rights under the GDPR have been violated. You may bring proceedings before the courts of the member state where you reside, where the controller is established, or where the alleged infringement occurred.

To exercise any of these rights, please send a written request to info@senoner-sarteur.it or by post to:

Senoner Sartëur KG-SAS di Senoner Andreas & C.
Meisules 111
I-39048 Selva Val Gardena, Wolkenstein (BZ)

We will respond to your request without undue delay, generally within 30 days. If we need additional time to fulfill your request, we will inform you of the delay and the reasons for it.

37. Conditions — Suedtirol Alto Adige Guest Pass

Upon completion of the accommodation contract, the Suedtirol Alto Adige GuestPass will be issued to the guest, which according to the decision of the South Tyrolean regional government No. 732/2022, is valid for the entire duration of their stay as well as from 0:00 on the day of arrival unto 24:00 on the day of departure.

The Guest Pass includes the use of all public transport within the "suedtirolmobil" network area as well as additional services, which vary depending on the tourism organization. Detailed information can be found at: suedtirol-guestpass.info

The sole entity carrying the Guest Pass in South Tyrol is the Mobilitaetskonsortium, appointed as the unified coordination point in accordance with the above decision of the South Tyrolean regional government by the Provincial Association of Tourism Organizations of South Tyrol on November 16, 2022. The details of the additional services associated with the Guest Pass and the conditions of use of the Guest Pass are communicated by the third party responsible for issuing and managing the Guest Pass. Detailed information is available at: suedtirol-guestpass.info

38. Privacy — Suedtirol Alto Adige Guest Pass

Purpose: The personal data provided will be transmitted to the single coordinating body of the Guest Pass in order to enable the creation and use of the Guest Pass and to provide the associated services.

Recipient: In connection with the issue of the Guest Pass, your data will be transmitted to the Mobilitaetskonsortium, VAT Nr. 02735170215, which acts as the cardholder and unified coordinating body and assumes the role of autonomous data controller in processing the transferred data. For further information regarding the processing to which the data will be subjected, you can send an email to privacy@moko.bz.it.

Legal basis: The legal basis for processing is Art. 6 (1) (b) of the GDPR (contract performance).