PRIVACY POLICY AND PERSONAL DATA PROCESSING

DATA CONTROLLER
The Data Controller is IHE Tour Operator S.r.l. (Tax Code and VAT No. 10599040960), with registered office at Via Vincenzo Monti 57/4, 20145, Milan. It can be reached at the following email address: [email protected].

TYPES OF DATA COLLECTED
Browsing data: This data is automatically acquired by computer systems during use and navigation of the website. This information (such as IP addresses, browser information, or the device used by the user) is collected and used exclusively for anonymous statistical purposes, which is used to verify the proper functioning of the website, and is deleted immediately after processing.
Personal data provided by the user: In order to respond to user requests, the website acquires the data that users voluntarily enter. Specifically, names, email addresses, and, where applicable, telephone numbers. Users are free to provide or withhold the personal data requested by the site; it is understood that failure to provide such data, or partial failure to provide such data, may make it impossible to obtain the requested service. The Data Controller does not process sensitive data or data belonging to special categories pursuant to Art. 9 GDPR. Such data, if necessary to perform the service requested by the user, is collected and processed directly by third parties, without passing through the Data Controller's servers.
Cookies: These are files sent by the website to users and are used exclusively to store information relating to the user's active session and the site. If users prefer not to receive cookies or wish to be informed in advance, they can change their browser settings. To view the complete cookie policy, click here.

PROCESSING METHODS
Users' personal data is processed exclusively using IT tools, for the time strictly necessary for the purpose for which it was collected. Specific security measures are adopted to maintain the integrity of the data collected, to prevent its loss and unlawful use, and to prevent unauthorized access.

LEGAL BASIS AND PURPOSE OF PROCESSING
User data will be used for the following purposes:
1. Managing contacts and communications with the user.
2. Newsletter service.
3. Correct performance of the service by the Data Controller.
4. Website navigation and anonymous statistics.
5. Fulfillment of legal or administrative obligations relating to the website's activity.
6. Possible protection of own rights or those of third parties.
The legal basis on which the lawfulness of processing for the aforementioned activities is based is the following (see Art. 6, paragraph 1, EU Regulation No. 679/2016 or GDPR):
a. For the purposes referred to in points 1 and 2: "consent of the data subject" pursuant to Article 6, paragraph 1, letter a) of the GDPR;
b. For the purposes referred to in points 3 and 4: "performance of a contract to which the data subject is party" pursuant to Article 6, paragraph 1, letter b) of the GDPR.
c. For the purposes referred to in points 5 and 6: "legal obligation to which the Data Controller is subject" pursuant to Article 6, paragraph 1, letter c) of the GDPR.

PLACE OF PROCESSING
The data collected by this site is processed at the Data Controller's headquarters or on third-party servers within the EU, and is performed only by personnel authorized to process data.

DATA TRANSMISSION
Personal data is not disseminated but may be shared with third parties to enable the proper performance of the service requested by the user. Specifically, data may be disclosed to parties to whom disclosure is required to fulfill specific legal obligations, or to parties providing services instrumental to the Data Controller's activities (such as OLTA, suppliers, consultants, and professional firms). In the latter case, third parties are appointed as Data Processors, pursuant to Art. 28 of EU Regulation No. 679/2016.

STORAGE PERIOD
Personal data is processed and stored exclusively for the time required for the purpose for which it was collected, in compliance with applicable regulations.

USER RIGHTS
The user may exercise the rights set forth in Art. 15 et seq. of EU Regulation No. 679/2016 at any time. The user may request from the Data Controller access to their personal data and related information, the rectification of inaccurate data, or the completion of incomplete data. the erasure or limitation of the processing of personal data concerning him/her; to object at any time to the processing of personal data in the event of particular situations concerning him/her; to withdraw consent at any time, limited to the cases

Date of publication: 14 May 2024

Last modified: 11 February 2026